Attack Vector Category Sorter

About this interactive

The attack surface is every way in, and the lesson splits those ways into four. Physical means the attacker reaches the equipment: plugging into a port, dropping a rigged USB stick, carrying removable media in. Digital means reaching in over a connection without being present: an open wireless network, a scanned-open port, malware or a booby-trapped file. Social engineering means working through a person: a phishing email, a pretext phone call, a message that impersonates a coworker — the target is the human, not the machine. Third party means coming in through an outside entity the organization trusts: a partner connection, a managed provider, a tampered supplier update. Ask what the attacker actually used — a wire, a connection, a person, or the trust of another organization — and the category follows.

What you'll learn

Sort each way into a network into the lesson's category of attack vector: physical, digital, social engineering, or through a third party
Explain why an attack surface reaches beyond the network perimeter, so defense in depth must account for all four categories

Aligned to

CompTIA Security+

2.2 Explain common threat vectors and attack surfaces.

CompTIA PenTest+

2.1 Given a scenario, apply information gathering techniques.

Key terms

Attack Surface: The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Threat Vector: A specific path or method by which a threat actor can gain unauthorized access to a system, such as physical access, network-based attacks, or social engineering.
Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Defense-in-Depth: Defense-in-Depth is a security architecture strategy that layers multiple independent controls across technical, physical, and administrative domains so that the failure of any single control does not result in a complete security breach.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →