Simple explanation
A vector is the path an attack travels in; an attack surface is everything an attacker could potentially target. Reducing attack surface (fewer open doors) and defending vectors (guarding the doors that must stay open) are two sides of the same coin.
Technical explanation
Message-based vectors: email, SMS (smishing), instant messaging — the most common phishing delivery paths. Image-based: malicious code embedded in image files, or images used to deliver payloads. File-based: malicious attachments or documents with embedded macros. Voice call: vishing — social engineering over the phone. Removable device: infected USB drives ("baiting" — leaving one in a parking lot). Vulnerable software: client-based (software installed and running locally, with local vulnerabilities) vs. agentless (cloud/web-based, vulnerabilities live server-side). Unsupported systems and applications: end-of-life software no longer receiving patches — a growing attack surface over time. Unsecure networks: wireless (weak/no encryption), wired (unauthorized physical access to a jack), Bluetooth (bluejacking/bluesnarfing). Open service ports: any listening port not required for business function is unnecessary attack surface. Default credentials: factory-set usernames/passwords never changed after deployment. Supply chain: MSPs (managed service providers), vendors, and suppliers all represent a path INTO your environment if THEIR security fails. Human vectors / social engineering: the vector isn't technical at all — it's convincing a person to act (see the next lesson for specific techniques).
Synonyms / related terms
| Term | Means | |---|---| | Smishing | SMS-based phishing | | Vishing | Voice-call-based phishing | | Bluesnarfing | Unauthorized access to data via Bluetooth | | Bluejacking | Sending unsolicited messages via Bluetooth |
Concept Check
"A vendor's compromised software update silently installs malware onto thousands of customer systems that trusted the vendor's signed update process. What vector was exploited?" Not phishing (no message was sent to a human), not an unsecure network — this is a supply chain vector: the trust relationship with a third party was the path in.
Interview-style Q&A
Q: Why treat "unsupported systems and applications" as an attack surface issue rather than just a maintenance issue? A: "Every day past end-of-life, the gap between known vulnerabilities and available patches only grows — the software becomes a permanently open door, since no future fix is coming. It's not a temporary risk like an unpatched-but-supported system; it's a standing one until the system is replaced."
Memory trick
"MIFV-USOD-HH" — Message, Image, File, Voice, [removable] device — Unsecure networks, Software (vulnerable/unsupported), Open ports, Default creds — Human, [supply-chain] partners. Read it as two halves: delivery vectors, then structural attack surface.