Chapter Study Guide

Introduction to
Ethical Hacking

Everything you need to memorize — distilled into clear concepts, mnemonics, and visual anchors.

Info Security CIA Triad Key Terms Attack Components Threat Types Malware & Insiders Info Warfare Quick Recap
01

Information Security

🧠 Core Idea
Protect. Don't Over-Protect.

Security isn't just about locking everything down. The goal is an effective & efficient policy — too much security wastes resources and creates new loopholes. Too little leaves you exposed.

definition

System Security

Methods & processes for protecting information systems from unauthorized access, disclosure, usage, or modification.

definition

Information Security

Ensures the Confidentiality, Integrity, and Availability (CIA) of information — the three non-negotiable pillars.

💡 CIA = the "holy trinity" of InfoSec
triangle model

Security–Functionality–Usability

These three always trade off. More security = less usability/functionality. The goal is a balanced center where all three are strong enough.

💡 Think of it as a seesaw with 3 sides
pillar

Non-Repudiation

Guarantees that a sender cannot deny sending a message. Achieved via digital signatures & encryption.

💡 "I can prove you said it" — like a receipt
attacker mindset

Hack Value

The attractiveness or worth of a target to a hacker. High hack value = the target holds something desirable (data, money, prestige, disruption potential). Hackers evaluate hack value before investing time in an attack.

💡 A bank has higher hack value than a personal blog — think ROI for criminals
02

The CIA Triad

🧠 Mnemonic
Clean Information Always

Confidentiality · Integrity · Availability — the three guarantees every secure system must provide.

C

Confidentiality

Only authorized people can access information. Prevents unauthorized disclosure.

⚠ Risk: Identity theft, data leaks
🛡 Control: Encryption, Access Control, Authentication
I

Integrity

Data is accurate and hasn't been tampered with. Ensures trustworthiness.

⚠ Risk: Fraud, unreliable data
🛡 Control: Audit logs, Maker/Checker, QA
A

Availability

Systems and data are accessible when needed by authorized users.

⚠ Risk: Business disruption, lost revenue
🛡 Control: Backups, redundancy, continuity plans
03

Key Terms — Flashcards

Know these cold. They appear in every hacking exam.

Hack Value
How attractive a target is to a hacker. High value = high interest.
💡 "Is it worth hacking?"
Zero-Day Attack
Exploits a vulnerability before the developer knows about it or patches it.
💡 Day 0 = no defense exists yet
Vulnerability
A weakness or loophole in a system that can be exploited by an attacker.
💡 The "door" the attacker walks through
Exploit
A breach of security through a vulnerability, zero-day, or hacking technique.
💡 The "act" of using the vulnerability
Payload
The harmful part of malicious code that causes damage — backdoors, hijacking, etc.
💡 The "bomb" inside the attack
Bot / Botnet
Software controlling a device remotely. A botnet = network of infected "zombie" devices.
💡 Army of hijacked computers
Doxing
Publishing personal information about someone from public sources (social media, databases).
💡 "Dropping docs" on someone
Daisy Chaining
A sequence of attacks where the hacker uses info gained from one system to break into the next — like a chain of break-ins. Each step funds the next.
💡 Hack Server A → steal creds → use them to hack Server B → repeat

⬇ More concepts to know deeply:

malware type

Viruses & Worms

A virus is malicious code that attaches itself to other files to spread — it needs a host file to travel. A worm is self-replicating and spreads independently across networks without needing a host file.

💡 Virus = hitchhiker (needs a ride). Worm = walks on its own.
threat type

Insider Threat

A threat from someone already inside the organization — employee, contractor, or partner misusing their authorized access. Two types:

Intentional (Malicious) — deliberate sabotage or data theft.
Unintentional (Negligent) — accidental exposure, weak passwords, clicking phishing links.

💡 Hardest to detect — the attacker already has the keys
threat type

Botnets

A network of compromised "zombie" devices controlled remotely by a botmaster. Device owners are unaware. Used for:

DDoS attacks · Spam campaigns · Data theft · Cryptomining

💡 One hacker, thousands of unwilling soldiers
concept

Doxing — In Depth

Collecting and publishing personally identifiable information (PII) about a target from publicly available sources — mostly social media, public records, and databases. Used to harass, blackmail, or expose individuals.

💡 No hacking required — just open-source intelligence (OSINT)
concept

Daisy Chaining — In Depth

Sequential hacking attempts where each break-in enables the next. The attacker uses credentials or info harvested from System A to gain access to System B, C, and beyond — moving laterally through an organization.

💡 Like using one stolen key to find the next key in a chain
04

Attack Components

🧠 Mnemonic — Every attack needs all 3
Men Make Vulnerabilities

Motive · Method · Vulnerability — remove any one of these, and the attack fails.

🎯

Motive

The why. Goal driving the attacker — money, espionage, disruption, revenge.

🔧

Method

The how. Technique used — phishing, malware, SQL injection, social engineering.

🔓

Vulnerability

The where. The weakness or flaw that makes the attack possible.

modern threat

APT — Advanced Persistent Threat

Sophisticated, long-term attack where an attacker stays hidden inside a network for an extended period. Conducted by highly skilled attackers targeting strategic data.

💡 Think of it as a spy living inside your house for months
modern threat

Shrink-Wrap Exploits

Attacking known vulnerabilities in popular, off-the-shelf software that hasn't been patched. Targets unpatched OS, COTS software, and outdated apps.

💡 Exploiting "factory-default" weaknesses in popular software
05

Threat Categories

🧠 Mnemonic — 3 levels of threats
Networks Host Apps

Network Level · Host (OS) Level · Application Level — threats exist at every layer of the stack.

Level Targets Examples
🌐 Network Routers, switches, firewalls
Sniffing Spoofing MITM Session Hijacking DNS/ARP Poisoning Scanning
💻 Host (OS) Operating system, local env
Malware Password Attacks Privilege Escalation Backdoors Login Bypass Arbitrary Code Exec
📦 Application Web apps, software
SQL Injection Buffer Overflow Broken Auth Cryptography Failures XSS Misconfig
📱 Mobile Smartphones & apps
Phishing Spyware Data Leakage Network Spoofing Broken Crypto
☁️ Cloud Cloud infrastructure
Data Breaches Insecure APIs Misconfiguration Unauthorized Access
👤 Insider Employees, contractors
Intentional Abuse Negligent Leaks Privilege Misuse
🤖 Botnet Any internet-connected device
DDoS Attacks Spam Campaigns Data Theft Cryptomining
06

Information Warfare

Using information systems to gain a strategic advantage over an adversary.

🛡 Defensive

Protect your own systems

Actions taken to protect information systems from attacks and unauthorized access. Includes security controls, monitoring, and incident response.

💡 Think: goalkeeper, firewall, SIEM
⚔️ Offensive

Disrupt enemy systems

Proactive actions taken against adversaries to disrupt, manipulate, or destroy their information systems and operations.

💡 Think: penetration testing, cyberwarfare
07

Quick Recap — Before Your Exam

🗂 Everything in 15 bullets

  • InfoSec = Protecting data from unauthorized access, disclosure, use, modification
  • CIA Triad: Confidentiality (who sees it) · Integrity (is it accurate) · Availability (can you use it)
  • Non-Repudiation = you can't deny sending something (digital signatures prove it)
  • Security–Functionality–Usability triangle: improving one weakens the others — aim for center balance
  • Hack Value = how attractive a target is to an attacker (high value = more likely to be attacked)
  • Every attack has 3 parts: Motive + Method + Vulnerability
  • Zero-Day = unknown vulnerability, no patch exists yet — most dangerous kind
  • APT = attacker hides inside a system for months/years undetected
  • Shrink-Wrap Exploits = attacking known flaws in unpatched, off-the-shelf software
  • Virus = attaches to files to spread · Worm = spreads on its own, no host needed
  • Botnet = network of zombie devices controlled by one botmaster (DDoS, spam, theft)
  • Insider Threat = intentional (malicious) or unintentional (negligent) misuse by insiders
  • Daisy Chaining = sequential break-ins using credentials from each previous system
  • Threats live at every layer: Network · Host/OS · Application · Mobile · Cloud · Insider · Botnet
  • Information Warfare = Defensive (protect yours) vs Offensive (attack theirs)
🧠 Master Mnemonic — remember everything
Cat Is Always Nice, Men Make Vulnerabilities, Not Having Armor

CIA (Triad) · Non-repudiation · Motive-Method-Vulnerability (attack components) · Network-Host-App (threat levels)

08

Practice Questions

Q1 — CIA Triad Application

A hospital's patient records are altered by an insider who changes medication dosages in the system. Which pillar of the CIA Triad is primarily violated? Which control (from the cia-control rows) would most directly prevent this? Explain your reasoning.

Q2 — key terms

Zero-Day vs. Exploit

Explain the difference between a zero-day vulnerability and an exploit. Why are zero-days considered especially dangerous compared to known vulnerabilities? What does the "day 0" in the name signify?

Q3 — comparison

Virus vs. Worm

A new piece of malware spreads across an organization's network by copying itself to every reachable share drive without any user action. Is this a virus or a worm? Justify your classification using the hitchhiker analogy from the study guide.

Q4 — scenario

Attack Components

An attacker is motivated by financial gain. They target a bank's unpatched web server using a SQL injection technique. Map this scenario to the three attack components (Motive · Method · Vulnerability). Which component, if eliminated, would most effectively neutralize the attack?

Q5 — classification

Threat Categories

Classify each of the following threats by level (Network / Host / Application / Mobile / Cloud / Insider / Botnet):

a) An employee copies sensitive files to a personal USB drive.
b) An attacker floods a server with authentication requests.
c) Cross-site scripting on a web application.
d) Spyware installed on a company-issued smartphone.

Q6 — scenario

APT vs. Shrink-Wrap

Company A is infiltrated by an attacker who remains hidden for 11 months, slowly exfiltrating R&D data. Company B is breached via an unpatched vulnerability in a popular, off-the-shelf CRM application.

Which attack is the APT and which is the shrink-wrap exploit? What makes the APT particularly difficult to detect?

Q7 — information warfare

Offensive vs. Defensive

A nation-state's cybersecurity team monitors its own critical infrastructure for intrusions. At the same time, a separate unit conducts penetration testing against a rival state's power grid systems.

Which team is conducting defensive information warfare and which is conducting offensive? Is offensive information warfare ever considered legitimate? Briefly discuss.

Q8 — security triangle

The Balancing Act

A company implements mandatory 10-factor authentication and full disk re-encryption every 24 hours for all employees. Using the Security–Functionality–Usability triangle, explain what trade-off has been made and why an overly secure system can itself become a security risk.