An external attacker uses a stolen vendor password to enter a maintenance portal and copy customer records. The attacker, stolen credential, portal, and disclosure describe different parts of the same incident.
The vocabulary separates those parts.
- Threat agent: A human, environmental, or other source of potential harm. The term includes deliberate threat actors and sources of unintentional harm, such as negligent employees.
- Threat actor: A person or group capable of causing harm through deliberate action. Accidental human error is an unintentional threat cause, without a malicious motive.
- Threat: A circumstance or event that could harm information or systems, such as unauthorized access through a vendor connection.
- Vulnerability: An exploitable weakness, such as an exposed maintenance account protected only by a reusable password.
- Attack vector: The route or means used to reach a target, such as the vendor portal, a deceptive attachment, or a physical connection.
- Attack: A deliberate attempt to compromise a system or its information. An attempt can fail without producing the intended harm.
Common mistakes
- Account confused with actor. An external attacker using an employee login does not become an internal employee threat.
- Propagation confused with payload. A worm can deliver ransomware; replication method and extortion behavior answer different classification questions.
- Storage confused with execution. Database-stored text that executes in a browser supports stored XSS, without establishing SQL injection.
Bottom line
- Threat agents include deliberate threat actors and unintentional sources; threats, vulnerabilities, attack vectors, attacks, and impacts describe different event components.
- Origin, deliberate motives, sponsorship, capabilities, and unintentional causes require separate supporting facts.
- Attack families and malware types can overlap because they describe different mechanisms and effects.
- Untrusted input executed as database commands indicates SQL injection; attacker-controlled content executed in another user's browser indicates XSS.
Exam shortcut
Start with the requested classification: actor, attack family, technique, stage, exposed asset, or control. Avoid selecting a correct term from the wrong category. Locate where untrusted content executes before choosing an injection answer. Use the processing trace, not the location where text was stored. For repeated transactions, inspect the cause: captured-message reuse or a gap between checking and updating shared state.
The full lesson (about 5,728 words, 38 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.B1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.