An internal auditor reviews the organization's cybersecurity risk assessment and finds it addresses only external hackers. The CISO objects: "We have firewalls and intrusion detection, external threats are covered." The auditor's response should be that the risk assessment is incomplete. Threat agents include insiders, nation-states, and automated botnets. Attack vectors span physical access, social engineering, and application-layer exploits. A mature security program identifies all threat categories, maps them to organizational assets, and implements layered controls.
AICPA Representative Tasks (verbatim). 1. Remembering & Understanding, Classify the different types of threat agents (e.g., internal or external, nation or non-nation state-sponsored, adversary, threat actors, attacker or hacker). 2. Remembering & Understanding, Identify types of attacks (e.g., physical, distributed denial of service, malware, social engineering, web application attacks, mobile device attacks). 3. Remembering & Understanding, Identify techniques used in a cyber attack (e.g., buffer overflow, mobile code, cross-site scripting, SQL injections, race conditions, covert channel, replay and return-oriented attack). 4.
Classification of Threat Agents
Common mistakes
- Treating all external threats as more dangerous than internal threats. Internal threats have legitimate access and knowledge of systems, making detection harder and impact often greater. Risk assessment must weight both origin categories appropriately.
- Confusing attack types with attack techniques. Social engineering is an attack type; phishing is a technique within that type. SQL injection is a technique; web application attack is the type. The exam tests precise terminology.
- Assuming cloud providers handle all security. Cloud security operates on shared responsibility. The provider secures infrastructure; the customer secures data, access, and application configurations. IaaS customers have extensive security obligations.
Bottom line
- Threat agents are classified by origin (internal/external), sponsorship (nation-state/non-state), intent (adversarial/accidental), and capability; insiders with privileged access pose the highest-impact risk.
- Attack types include physical attacks, DDoS, malware, social engineering, web application attacks, and mobile device attacks, each requiring distinct controls.
- Attack techniques exploit specific vulnerabilities: SQL injection targets databases, XSS targets browsers, buffer overflow targets memory, plus race conditions and replay attacks.
- The cyber kill chain progresses through reconnaissance, gaining access, privilege escalation, maintaining access (persistence), exploitation, and covering tracks.
Exam shortcut
Kill chain stage identification: if the scenario describes information gathering, it is reconnaissance. If credentials are compromised, it is gaining access. If admin rights are obtained, it is privilege escalation. If backdoors are installed, it is maintaining access. If data is stolen or systems damaged, it is exploitation. If logs are deleted, it is covering tracks. Injection attack differentiation: database mentioned → SQL injection. User browser mentioned → XSS.
The full lesson (about 3,211 words, 21 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.B1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.