Threat actors targeting an organisation need some means to gain access to that organisation's information or systems. Threat vectors are the means that threat actors use to obtain that access. ### Message-Based Threat Vectors **Email** is one of the most commonly exploited threat vectors. *Phishing messages, spam messages*, and other email-borne attacks are a simple way to gain access to an organisation's network. The benefit for the attacker is that they generally need to *succeed only one time* to launch a broader attack. Even if 99.9 percent of users ignore a phishing message, the attacker needs the login credentials of only a single user to begin their attack. Message-based attacks may also be carried out through other communications mechanisms , such as by sending text messages through SMS or IM applications. Voice calls may also be used to conduct vishing (voice phishing) attacks. ### Wired Networks Bold attackers may seek to gain direct access to an organisation's network by *physically entering the organisation's facilities*. One of the most common ways they do this is by entering public areas of a facility, such as a lobby, customer store, or other easily accessible location and sitting and working on their laptops, which are surreptitiously *connected to unsecured network jacks on the wall*. Alternatively, attackers who gain physical access to a facility may be able to find an unsecured computer terminal, network device, or other system. ### Wireless Networks Wireless networks offer an even easier path onto an organisation's network. Attackers don't need to gain physical access to the network or your facilities if they are able to sit in the parking lot and access your organisation's wireless network. *Unsecured or poorly secured wireless networks pose a significant security risk*. ### Systems Individual systems may also server as threat vectors depending on how they are configured and the software installed on them. The OS configuration may *expose open service ports that are not necessary to meet business needs* or that allow the *use of well known credentials that were never changed*. Software installed on a system may contain known or undetected vulnerabilities. Organisations may also use *legacy applications or systems that are no longer supported by their vendor*. ### Files and Images An attacker may create a *file that contains embedded malicious code* and then trick a user into opening that file activating the malware infection. These files may be sent by email, stored on a file server or placed in any other location where an unsuspecting user might be tempted to open it. ### Removable Devices Attackers also commonly use removable media, such as USB drives, to spread malware and launch their attacks. An attacker might distribute inexpensive USB sticks in parking lots, airports, or other public areas, hoping that someone will find the device and plug it into their computer, curious to see what it contains. As soon as that happens, the device triggers a malware infection that silently compromises the finder's computer and places it under the control of the attacker. ### Cloud Attackers routinely *scan popular cloud services for files with improper access controls, systems that have security flaws, or accidentally published API keys and passwords*. Organisations must include the cloud services that they use as an important component of their security program. ### Supply Chain Sophisticated attackers may attempt to interfere with an organisation's IT supply chain, including hardware, software, and service providers. Attackers may gain access to *hardware devices* at the *manufacturer or while the devices are in transit* from the manufacturer to the end user. Tampering with a device before the end user receives it allows attackers to *insert backdoors* that grant them control of the device once the customer installs it on their network. This type of third-party risk is *difficult to anticipate* and address. Supply chain attacks may also target software providers inserting vulnerabilities into software before it is released or deploying backdoors through official updates and patching mechanisms. Attackers who infiltrate [[Managed Service Providers]] (MSPs) may also be able to use their access to the MSP network to leverage access that the MSP has to its customers' systems. Other issues may also arise in the supply chain, particularly if a *vendor fails to continue to support a system* that the organisation depends on, fails to *provide required system integrations*, or *fails to provide adequate security for outsourced code development or data* *storage*.