Attacks and their primary defense
| Attack | What it does | Primary defense |
|---|---|---|
| Phishing | Tricks users into revealing credentials/clicking malware | User training, email filtering, MFA |
| Ransomware | Encrypts data and demands payment | Offline backups, patching, EDR |
| Malware (virus/worm/trojan) | Malicious code that infects/spreads/hides | EDR/anti-malware, least privilege |
| MITM | Intercepts traffic between two parties | TLS, VPN, certificate validation |
| DDoS | Floods a service to take it offline | CDN/scrubbing, rate limiting |
| SQL injection | Injects SQL via input to read/alter the DB | Parameterized queries, input validation |
| XSS | Injects script that runs in a victim's browser | Output encoding, CSP |
| CSRF | Forces a logged-in user's browser to act | Anti-CSRF tokens, SameSite cookies |
| Brute force / credential stuffing | Guesses or replays passwords at scale | MFA, lockout, rate limiting |
| Social engineering | Manipulates people to bypass controls | Training, verification procedures |
Why defense in depth matters
The principle
No single control stops everything — especially zero-days. Layer people (training), process (patching, least privilege) and technology (MFA, EDR, WAF, backups) so one failure isn't fatal.
Exam traps
- Confusing XSS and CSRF. XSS runs attacker script in the browser; CSRF abuses an existing authenticated session.
- Worm vs virus. A worm self-propagates; a virus needs a host/user action.
- Backups as anti-ransomware. Only if they're offline/immutable and tested.
Test yourself
4 quick questions — tap an answer to check it instantly. Nothing is sent anywhere.
1. Parameterized queries primarily defend against…
Answer: B. Parameterized queries stop SQL injection by separating code from data.
2. Which malware self-propagates without user action?
Answer: B. A worm self-propagates; a virus needs a host or user action.
3. The main defense against phishing is…
Answer: B. Phishing is a human attack — training, MFA and email filtering are key.
4. CSRF is best mitigated with…
Answer: B. Anti-CSRF tokens and SameSite cookies stop forged cross-site requests.
Sources
- CompTIA Network+ / Security+ exam objectives.
- Relevant RFCs and vendor documentation.
Reference summary only. Not security advice for a specific system.