Threats, Vulnerabilities, and Mitigations

1234567891011121314151617181920212223242526
Across
  1. 3. An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.
  2. 6. Configuration that exposes a large attack surface, such as through unnecessary open service ports, weak or no authentication, use of default credentials, or lack of secure communications/encryption.
  3. 10. Weakness that could be triggered accidentally or exploited intentionally to cause a security breach.
  4. 12. Product life cycle phase where mainstream vendor support is no longer available.
  5. 13. A type of attack that falsifies an information resource that is normally trusted by others.
  6. 15. Demanding payment to prevent the release of information.
  7. 17. A type of attack that compromises the availability of an asset or business process.
  8. 22. A hacker operating with malicious intent.
  9. 23. A type of threat actor that is supported by the resources of its host country's military and security services.
  10. 25. The ability of threat actors to draw upon funding to acquire personnel, tools, and development of novel attack types.
  11. 26. The process by which an attacker copies data from a private network to an external network.
Down
  1. 1. Falsifying records, such as an internal fraud that involves tampering with accounts.
  2. 2. A type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident.
  3. 4. Often used to refer to someone who breaks into computer systems or spreads viruses. Ethical hackers prefer to think of themselves as experts on and explorers of computer security systems.
  4. 5. An inexperienced attacker that typically uses tools or scripts created by others.
  5. 7. Computer hardware, software, or services used on a private network without authorization from the system owner.
  6. 8. A type of threat actor that uses hacking and computer fraud for commercial gain.
  7. 9. An attack type that will entice a victim into using or opening a removable device, document, image, or program that conceals malware.
  8. 11. A hacker engaged in authorized penetration testing or other security consultancy.
  9. 14. A threat actor that is motivated by a social issue or political cause.
  10. 16. A formal classification of the resources and expertise available to a threat actor.
  11. 18. The degree of access that a threat actor possesses before initiating an attack. An external threat actor has no standing privileges, while an internal actor has been granted some access permissions.
  12. 19. Demanding payment to prevent or halt some type of attack.
  13. 20. A threat actor that causes a vulnerability or exposes an attack vector without malicious intent.
  14. 21. The end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer.
  15. 24. actor A person or entity responsible for an event that has been identified as a security incident or as a risk.