2.2 Threat Vectors: Social Engineering, Ransomware & Application Vulnerabilities

🎯 Essential Technical Takeaways

• Business Email Compromise (BEC) is prevented through mandatory out-of-band phone verification (callback) before releasing wire transfers.
• Ransomware resilience requires immutable Write-Once-Read-Many (WORM) backups air-gapped from domain administrator credentials.
• SQL injection is prevented by using parameterized queries (prepared statements) rather than dynamic string concatenation.
• Automated vulnerability scanning passively detects potential flaws; authorized penetration testing actively exploits vulnerabilities.

Organizations face sophisticated external and internal threat vectors. Social engineering bypasses technical controls by exploiting human psychology. In Business Email Compromise (BEC), attackers spoof executive identities to trick finance personnel into wiring funds. Because technical email filters (SPF, DKIM, DMARC) can be bypassed if an executive account is compromised, the primary internal control is a mandatory out-of-band verbal callback policy before funds are disbursed.

Ransomware represents an existential threat to business continuity. Modern ransomware operators target online backups, deleting volume shadow copies and cloud sync repositories prior to encrypting primary storage. To ensure survival, organizations must implement the 3-2-1 backup architecture with 'immutable' storage: backups written to Write-Once-Read-Many (WORM) media that cannot be overwritten or deleted even by domain administrators, combined with offline air-gapping.

Application security requires continuous defense against the OWASP Top 10 vulnerabilities. SQL injection occurs when untrusted input is concatenated into database queries; the definitive remediation is Parameterized Queries (prepared statements), which treat input strictly as data parameters rather than executable SQL code. Cross-Site Scripting (XSS) is mitigated through context-aware output encoding and setting the HttpOnly cookie flag. Regular vulnerability scanning identifies unpatched software, while annual penetration testing actively tests defense depth.

⚠️ CPA Evolution Exam Traps & Control Pitfalls

• Relying on client-side JavaScript validation to prevent SQL injection or cross-site scripting.
• Assuming online cloud-synced backups are safe from ransomware (attackers actively compromise and delete online backups).
• Treating vulnerability scans and penetration tests as interchangeable terms.