Lesson 6 — Privilege Abuse, Account Risk, Social Engineering & Malware
Many Chapter 7 scenarios are “access problems,” but the cause determines the correct classification and control.
Three high-risk privilege patterns
Excessive privilege
The user was granted more access than the job requires.
Control direction: least privilege, granular roles/query controls, periodic review.
Legitimate-privilege abuse
The user has valid access but uses it for an unauthorized purpose, context, volume, time, location, or endpoint.
Example: a salesperson can view individual customers but exports the entire population at midnight.
Control direction: contextual/bulk-access controls, monitoring, endpoint/query restrictions.
Unauthorized privilege elevation
A user/attacker exploits a weakness to gain higher privileges than assigned.
Control direction: patch/vulnerability remediation, IDS/IPS, granular database controls, monitoring.
Service account vs shared account
- Service account — non-human process/batch identity for a specific task; often powerful and therefore tightly constrained.
- Shared account — generic human identity used by multiple people; undermines individual accountability and traceability.
A service account becomes abusive when its credentials are distributed to humans or used outside the approved task.
Platform/data attack recognition
- SQL injection — unsafe input/query handling lets attacker-supplied statements execute as legitimate database commands.
- Default password/backdoor exposure — known credentials or bypass paths create direct vulnerabilities.
- Backup abuse — backup copies require protection comparable to the data they contain.
Social engineering and malware — recognition depth
- Social engineering manipulates people into bypassing judgment.
- Phishing uses deceptive communications to obtain credentials/data or deliver malicious content.
- Malware is the broad malicious-software category.
- Spyware secretly monitors/collects information.
- Trojan hides malicious behavior inside apparently legitimate software.
- Virus relies on a host file/program and execution/sharing.
- Worm self-replicates/spreads without the same host-file dependency.
- Bot/zombie is a compromised remotely controlled machine; many can form a botnet.
- Key logger captures keystrokes, often credentials.
The management lesson is layered control: training alone is insufficient; technical tools alone are insufficient.
Exam discriminator
Ask: too much granted, right access misused, or rights escalated?
Source anchor: pp. 228–235.