Week 8.0 Threats, Vulnerabilities, Risk & Social Engineering

Overview

This module will give students a thorough understanding of how vulnerabilities, threats, and risks interact within the cybersecurity landscape. Students begin by exploring the relationship between Vulnerabilities, Threats, and Risks, learning how weaknesses in systems can be exploited by threat actors and how organizations assess risk to prioritize defensive strategies.

The course then examines different Attributes of Threat Actors, including their skill levels, resources, targets, and methods of attack. Learners study the Motivations of Threat Actors, ranging from financial gain and political influence to espionage, reputation building, and personal grievances.

Understanding the human element is crucial, so the module delves into the major categories of adversaries. This includes Hackers and Hacktivists, who may act out of curiosity, ideology, or a desire to expose wrongdoing. Students also explore Nation-State Actors, the most advanced and well-resourced attackers, who focus on espionage, sabotage, and strategic disruption. The module covers Organized Crime, which leverages cyberattacks for extortion, fraud, and large-scale financial operations. Learners also investigate Internal Threat Actors, including employees or contractors who may pose risks intentionally or accidentally.

To support proactive defense, the course introduces Threat Intelligence Sources, including open-source intelligence (OSINT), dark web monitoring, commercial threat feeds, industry-sharing groups, and government advisories. Students learn how these sources help identify emerging attack patterns and strengthen organizational preparedness.

The module then shifts to understanding the technical environment attackers exploit. Learners explore Attack Surface and Threat Vectors, including the entry points and pathways that adversaries use to infiltrate systems. This includes Vulnerable Software Vectors, where bugs or misconfigurations in applications can be exploited. Network Vectors are covered as well, focusing on attacks delivered through insecure protocols, exposed services, and unprotected network infrastructure.

Students also learn about Supply Chain Vectors, where attackers target third-party vendors, hardware manufacturers, or service providers to compromise a larger target. This highlights the importance of vendor security, code integrity, and dependency management.

Finally, the module examines Social Engineering, the manipulation of human behavior to bypass technical controls. Learners study phishing, pretexting, baiting, and impersonation, gaining insight into how attackers exploit trust, curiosity, urgency, or fear to gain unauthorized access.

By the end of this module, students will have a strong understanding of the threat landscape, the types of attackers they may face, the vectors used to deliver attacks, and the intelligence sources that help organizations anticipate and mitigate cyber risks.