CompTIA Security+ SY0-701 Objective 2.2: Explain Common Threat Vectors and Attack Surfaces

September 10, 2025•22 min read•CompTIA Security+ Certification

CompTIA Security+ Exam Focus: This objective covers the various pathways and entry points that attackers use to compromise systems and networks. Understanding threat vectors and attack surfaces is essential for identifying vulnerabilities, implementing appropriate defenses, and developing comprehensive security strategies. Master these concepts for both exam success and real-world security implementation.

Introduction to Threat Vectors and Attack Surfaces

Threat vectors are the pathways or methods that attackers use to gain unauthorized access to systems, networks, or data. Attack surfaces represent all the points where an attacker could potentially enter or extract data from an environment. Understanding these concepts is crucial for identifying vulnerabilities and implementing effective security controls.

By analyzing threat vectors and attack surfaces, security professionals can prioritize security investments, implement targeted defenses, and reduce the overall risk to their organizations. This comprehensive approach helps protect against both known and emerging threats.

Message-Based Threat Vectors

Message-based attacks exploit communication channels to deliver malicious content, steal credentials, or trick users into performing harmful actions. These attacks often target human psychology and trust in communication systems.

Email

Email remains one of the most common and effective threat vectors due to its widespread use and the trust users place in email communications.

Email Attack Types:

Phishing: Fraudulent emails designed to steal credentials or personal information
Spear Phishing: Targeted phishing attacks against specific individuals or organizations
Whaling: Phishing attacks targeting high-level executives
Malware Attachments: Emails containing malicious files or links
Business Email Compromise (BEC): Impersonation of executives for financial fraud
Spam: Unsolicited bulk emails, often containing malicious content

Email Security Risks:

Credential theft and account compromise
Malware distribution and system infection
Financial fraud and wire transfer scams
Data exfiltration and information theft
Reputation damage and brand impersonation
Compliance violations and regulatory penalties

Short Message Service (SMS)

SMS-based attacks (smishing) exploit the trust users have in text messages and the limited security controls available on mobile devices.

SMS Attack Methods:

Smishing: Fraudulent SMS messages designed to steal information
Malicious Links: SMS containing links to malicious websites
Premium Rate Scams: Messages that charge premium rates to user accounts
Two-Factor Authentication Bypass: Intercepting or redirecting 2FA codes
Social Engineering: Urgent messages designed to prompt immediate action
Malware Distribution: Links to malicious mobile applications

Instant Messaging (IM)

Instant messaging platforms provide attackers with real-time communication channels that can be exploited for social engineering and malware distribution.

IM Attack Vectors:

Malicious File Sharing: Distribution of infected files through IM
Social Engineering: Real-time manipulation and deception
Account Impersonation: Fake profiles to gain trust and access
Link Shortening Abuse: Malicious links disguised as legitimate URLs
Chatbot Exploitation: Automated attacks through IM bots
Privacy Violations: Unauthorized access to private conversations

Image-Based Threat Vectors

Image-based attacks exploit the trust users have in visual content and the limited security scanning applied to image files.

Image-Based Attack Methods:

Steganography: Hidden data or malware embedded within images
Malicious Image Files: Images containing exploit code or malware
Social Engineering: Manipulative images designed to influence behavior
QR Code Abuse: Malicious QR codes redirecting to harmful sites
Image-Based Phishing: Fake login pages disguised as images
Metadata Exploitation: Sensitive information in image metadata

Image Security Considerations:

Images can contain hidden malicious code
Metadata may reveal sensitive information
Visual content can be used for social engineering
Limited security scanning of image files
Trust users place in visual content

File-Based Threat Vectors

File-based attacks exploit the trust users have in various file types and the complexity of file format vulnerabilities.

File-Based Attack Types:

Malicious Documents: PDF, Word, Excel files containing malware
Executable Files: Malicious programs disguised as legitimate software
Archive Files: Compressed files containing malware or exploits
Script Files: JavaScript, PowerShell, or other scripting attacks
Macro-Enabled Documents: Office documents with malicious macros
File Format Exploits: Vulnerabilities in file parsing and rendering

Voice Call Threat Vectors

Voice-based attacks (vishing) exploit the trust users have in phone communications and the difficulty of verifying caller identity.

Voice Call Attack Methods:

Vishing: Fraudulent phone calls to steal information
Caller ID Spoofing: Falsifying caller identification information
Social Engineering: Manipulation through voice communication
Technical Support Scams: Impersonating legitimate support personnel
Banking Fraud: Impersonating financial institutions
Government Impersonation: Fake calls from government agencies

Removable Device Threat Vectors

Removable devices provide direct access to systems and can bypass network-based security controls.

Removable Device Risks:

USB Malware: Malicious software on USB drives
BadUSB Attacks: USB devices that impersonate keyboards or other devices
Data Exfiltration: Unauthorized copying of sensitive data
Malware Distribution: Spreading infections across multiple systems
Physical Access: Bypassing network security controls
Lost or Stolen Devices: Unauthorized access to device contents

Vulnerable Software

Software vulnerabilities provide attackers with direct access to systems through exploitation of coding errors or design flaws.

Client-Based vs. Agentless

Client-Based Vulnerabilities:

Desktop Applications: Vulnerabilities in installed software
Web Browsers: Browser-based exploits and vulnerabilities
Email Clients: Vulnerabilities in email software
Media Players: Exploits in audio/video software
Office Applications: Vulnerabilities in productivity software
Security Software: Exploits in antivirus and security tools

Agentless Vulnerabilities:

Web Applications: Server-side vulnerabilities in web apps
Network Services: Vulnerabilities in network protocols and services
Database Systems: Vulnerabilities in database software
Operating Systems: Core system vulnerabilities
Firmware: Low-level software vulnerabilities
Virtualization: Hypervisor and VM vulnerabilities

Unsupported Systems and Applications

Unsupported systems and applications pose significant security risks due to lack of security updates and patches.

Unsupported System Risks:

No Security Patches: Known vulnerabilities remain unpatched
End-of-Life Software: No vendor support or updates
Legacy Systems: Outdated technology with known vulnerabilities
Compliance Issues: Violation of regulatory requirements
Integration Problems: Difficult to integrate with modern security tools
Skill Shortages: Limited expertise in maintaining legacy systems

Unsecure Networks

Network security vulnerabilities provide attackers with pathways to access systems and data through network-based attacks.

Wireless Networks

Wireless Security Risks:

Weak Encryption: WEP, WPA, or other weak protocols
Default Credentials: Unchanged default passwords
Rogue Access Points: Unauthorized wireless networks
Evil Twin Attacks: Fake access points mimicking legitimate ones
Man-in-the-Middle: Intercepting wireless communications
Signal Interception: Capturing wireless traffic

Wired Networks

Wired Network Risks:

Physical Access: Unauthorized access to network infrastructure
Network Tapping: Intercepting network communications
Switch Vulnerabilities: Exploiting network switch weaknesses
ARP Spoofing: Manipulating network address resolution
VLAN Hopping: Accessing restricted network segments
Network Sniffing: Capturing unencrypted network traffic

Bluetooth

Bluetooth Security Risks:

Bluejacking: Sending unsolicited messages to Bluetooth devices
Bluesnarfing: Unauthorized access to Bluetooth device data
Bluebugging: Taking control of Bluetooth devices
Pairing Vulnerabilities: Weak or compromised pairing processes
Signal Interception: Capturing Bluetooth communications
Device Impersonation: Fake Bluetooth devices

Open Service Ports

Open service ports provide direct access to network services and can be exploited if the services are vulnerable or misconfigured.

Open Port Risks:

Service Exploitation: Direct access to vulnerable services
Port Scanning: Discovery of available services and vulnerabilities
Banner Grabbing: Information disclosure about running services
Service Enumeration: Detailed information about service capabilities
Privilege Escalation: Exploiting service vulnerabilities for higher privileges
Lateral Movement: Using open ports to move through networks

Default Credentials

Default credentials are a common security weakness that provides attackers with easy access to systems and devices.

Default Credential Risks:

Easy Access: Well-known default usernames and passwords
Wide Availability: Default credentials published in documentation
Automated Attacks: Scripts that try common default credentials
Device Compromise: Access to network devices and appliances
System Takeover: Complete control of systems with default access
Network Infiltration: Using default credentials to access networks

Supply Chain

Supply chain attacks exploit trust relationships with third-party vendors, suppliers, and service providers to gain access to target organizations.

Managed Service Providers (MSPs)

MSP Security Risks:

Privileged Access: MSPs often have high-level system access
Multiple Clients: Compromise of one MSP affects multiple organizations
Trust Relationships: Organizations trust MSPs with sensitive data
Remote Access: MSPs often require remote access to client systems
Shared Infrastructure: Common systems and tools across clients
Limited Oversight: Clients may have limited visibility into MSP security

Vendors

Vendor Security Risks:

Software Vulnerabilities: Vulnerabilities in vendor-provided software
Malicious Code: Intentionally malicious code in vendor products
Supply Chain Compromise: Vendors compromised by attackers
Update Mechanisms: Malicious updates or compromised update servers
Third-Party Dependencies: Vulnerabilities in vendor dependencies
Insider Threats: Malicious insiders within vendor organizations

Suppliers

Supplier Security Risks:

Hardware Tampering: Malicious modifications to hardware components
Firmware Compromise: Malicious firmware in hardware devices
Component Substitution: Replacement of legitimate components with malicious ones
Manufacturing Compromise: Malicious modifications during manufacturing
Logistics Attacks: Compromise during shipping and delivery
Documentation Tampering: Modified specifications or documentation

Human Vectors/Social Engineering

Social engineering attacks exploit human psychology and trust to manipulate individuals into performing actions that compromise security.

Phishing

Phishing Attack Types:

Email Phishing: Fraudulent emails designed to steal information
Spear Phishing: Targeted attacks against specific individuals
Whaling: Attacks targeting high-value executives
Clone Phishing: Duplicating legitimate emails with malicious content
Deceptive Phishing: Impersonating legitimate organizations
Search Engine Phishing: Malicious websites appearing in search results

Vishing

Vishing Techniques:

Caller ID Spoofing: Falsifying caller identification
Urgency Tactics: Creating false urgency to prompt immediate action
Authority Impersonation: Pretending to be from legitimate organizations
Information Gathering: Collecting personal or financial information
Technical Support Scams: Impersonating technical support personnel
Banking Fraud: Impersonating financial institutions

Smishing

Smishing Attack Methods:

Malicious Links: SMS containing links to malicious websites
Premium Rate Scams: Messages that charge premium rates
Two-Factor Authentication Bypass: Intercepting 2FA codes
Social Engineering: Urgent messages prompting immediate action
Malware Distribution: Links to malicious mobile applications
Account Verification Scams: Fake account verification requests

Misinformation/Disinformation

Information Manipulation:

False Information: Deliberately spreading incorrect information
Deepfakes: AI-generated fake audio, video, or images
Fake News: Fabricated news stories and reports
Conspiracy Theories: Spreading unfounded conspiracy theories
Social Media Manipulation: Using social platforms to spread false information
Influence Operations: Coordinated campaigns to influence public opinion

Impersonation

Impersonation Techniques:

Identity Theft: Using stolen personal information
Account Takeover: Gaining control of legitimate accounts
Social Media Impersonation: Creating fake social media profiles
Email Spoofing: Falsifying email sender information
Website Impersonation: Creating fake websites mimicking legitimate ones
Document Forgery: Creating fake documents and credentials

Business Email Compromise

BEC Attack Methods:

Executive Impersonation: Pretending to be high-level executives
Vendor Impersonation: Impersonating legitimate business partners
Account Compromise: Gaining access to legitimate email accounts
Domain Spoofing: Using similar domain names
Wire Transfer Fraud: Requesting fraudulent wire transfers
Gift Card Scams: Requesting gift card purchases

Pretexting

Pretexting Scenarios:

False Identity: Creating fake identities and backgrounds
Authority Claims: Pretending to have legitimate authority
Emergency Situations: Creating false emergency scenarios
Technical Support: Impersonating technical support personnel
Survey or Research: Pretending to conduct legitimate research
Compliance Requirements: Claiming to need information for compliance

Watering Hole

Watering Hole Attacks:

Target Website Compromise: Infecting websites frequented by targets
Supply Chain Compromise: Compromising trusted third-party sites
Drive-by Downloads: Automatic malware installation
Exploit Kits: Automated exploitation of browser vulnerabilities
Strategic Targeting: Focusing on specific industries or groups
Persistent Access: Maintaining long-term access to compromised sites

Brand Impersonation

Brand Impersonation Methods:

Domain Spoofing: Using similar domain names
Logo Theft: Using legitimate company logos and branding
Website Cloning: Creating fake websites mimicking legitimate ones
Social Media Impersonation: Fake social media accounts
Email Spoofing: Falsifying email sender information
Document Forgery: Creating fake official documents

Typosquatting

Typosquatting Techniques:

Common Typos: Registering domains with common spelling errors
Character Substitution: Replacing characters with similar-looking ones
Domain Extensions: Using different top-level domains
Hyphenation: Adding or removing hyphens in domain names
Phonetic Similarity: Using domains that sound similar
International Characters: Using similar-looking international characters

Attack Surface Management

Best Practices:

Regular Assessment: Continuously identify and assess attack surfaces
Vulnerability Management: Implement comprehensive vulnerability scanning
Security Awareness: Train users to recognize and report threats
Defense in Depth: Implement multiple layers of security controls
Incident Response: Develop and test incident response procedures
Threat Intelligence: Use threat intelligence to inform security decisions

Exam Preparation Tips

Key Exam Points:

Understand the different types of threat vectors and attack surfaces
Know the characteristics and risks of each attack vector
Understand how social engineering techniques work
Know the differences between various attack methods
Understand supply chain security risks
Be able to identify appropriate defenses for each threat vector

Real-World Applications

Understanding threat vectors and attack surfaces is essential for developing comprehensive security strategies. Organizations should regularly assess their attack surfaces, implement appropriate defenses, and educate users about common attack methods.

By understanding the various pathways attackers use to compromise systems, security professionals can implement targeted defenses, reduce attack surfaces, and improve overall security posture.

Summary

Threat vectors and attack surfaces represent the various pathways and entry points that attackers use to compromise systems and networks. From message-based attacks and social engineering to supply chain compromises and vulnerable software, understanding these attack vectors is crucial for implementing effective security controls. By identifying and addressing these threat vectors, organizations can reduce their attack surface and improve their overall security posture.