Mối đe dọa an ninh mạng (Network Security Threat) là gì?
Là bất kỳ nguy cơ tiềm ẩn nào có thể khai thác lỗ hổng (vulnerability) của hệ thống mạng, thiết bị, ứng dụng hoặc con người để **xâm hại Tính bảo mật (Confidentiality), Tính toàn vẹn (Integrity), Tính sẵn sàng (Availability)** của dữ liệu và dịch vụ mạng. Mối đe dọa = Threat Actor (Kẻ tấn công) + Vector (Vector tấn công) + Vulnerability (Lỗ hổng) + Impact (Tác động).
1. Phân loại mối đe dọa theo nguồn gốc
| Loại | Đặc điểm | Ví dụ |
|---|
| External Threats (Đe dọa bên ngoài) | Kẻ tấn công từ Internet. Không có quyền truy cập ban đầu. | Hacker, APT Group, Cybercriminal, Hacktivist, Script Kiddie, Botnet, DDoS-for-hire. |
| Internal Threats (Đe dọa nội bộ) | Người có quyền truy cập hợp pháp (nhân viên, contractor, partner). | Malicious Insider (đánh cắp data, sabotage), Negligent Insider (click phishing, misconfig), Compromised Insider (credential bị đánh cắp). |
| Supply Chain / Third-party | Khai thác mối quan hệ tin cậy với vendor/provider. | SolarWinds, Kaseya, Log4j, Dependency confusion, Malicious package (npm/PyPI), MSP compromise. |
2. Top 10 Mối đe dọa hàng đầu hiện nay (2024 - Theo ENISA, Verizon DBIR, MITRE, OWASP)
- Ransomware / Extortion: Mã hóa dữ liệu + Đe dọa công bố (Double/Triple Extortion). RaaS (Ransomware-as-a-Service). Target: Enterprise, Hospital, Gov, Education. Vector: Phishing, VPN vuln, RDP exposed, Supply chain.
- Phishing & Social Engineering: Email, Smishing (SMS), Vishing (Voice), Quishing (QR), Spear Phishing, Whaling (C-level), BEC (Business Email Compromise). AI-generated content (Deepfake voice/video, perfect grammar).
- Vulnerability Exploitation (Zero-day / N-day): Internet-facing assets (VPN, FW, Exchange, Proxy, CMS, IoT/OT). CVE-2023-20198 (Cisco), CVE-2023-34362 (MOVEit), CitrixBleed, Ivanti, FortiOS, Palo Alto, VPN. Exploit trong 24-48h sau PoC public.
- Credential Theft & Abuse: Infostealer (RedLine, Vidar, Raccoon, Lumma) → Logs bán trên Genesis/Russian Market. Credential Stuffing, Password Spraying, MFA Fatigue (Push bombing), Session Hijacking (Pass-the-cookie).
- DDoS (Distributed Denial of Service): Volumetric (UDP/TCP flood, Amplification - DNS, NTP, CLDAP, Memcached), Protocol (SYN flood), Application Layer (HTTP/2 Rapid Reset, Slowloris). IoT Botnet (Mirai variants, Mozi, GoBrut). Ransom DDoS (RDDoS).
- Malware (Loader, RAT, C2, Wiper): Cobalt Strike (Beacon), Sliver, Brute Ratel, Mythic, Meterpreter. Living off the Land (LOLBins: PowerShell, WMI, Certutil, MSHTA, Rundll32). Fileless malware.
- Cloud & Identity Attacks: IAM Misconfig (Public S3, Overpermissioned Role), Cloud Credential Theft (Metadata service IMDSv1), Container Escape, Kubernetes RBAC abuse, SaaS App OAuth consent grant (Illicit Consent Grant), Identity Provider (IdP) attack (Okta, Entra ID).
- Data Breach / Exfiltration: Kết quả của các tấn công trên. Target: PII, PHI, IP, Financial, Credentials. Exfil qua DNS, HTTPS, Cloud Storage, Email, Physical media.
- Insider Threat (Data Theft / Sabotage): Departing employee, Disgruntled admin, Espionage. DLP bypass (Encryption, Steganography, Cloud sync, Personal email, USB).
- AI/ML Powered Attacks: Automated vulnerability discovery, Polymorphic malware generation, Advanced Social Engineering (Deepfake, Voice clone), Adversarial ML (Data poisoning, Model evasion), Prompt Injection (LLM apps).
3. Phân loại theo kỹ thuật (Technique-based - MITRE ATT&CK Tactics)
- Initial Access: Phishing, Exploit Public-Facing App, Valid Accounts, Drive-by Compromise, Supply Chain, Removable Media.
- Execution: Command & Scripting Interpreter (PowerShell, Bash, Python), Native API, Scheduled Task, Service Execution, User Execution.
- Persistence: Registry Run Keys, Scheduled Task, Service, Boot/Logon Autostart, Web Shell, Account Manipulation, Cloud Account.
- Privilege Escalation: Exploitation for Privilege Escalation, Access Token Manipulation, Bypass UAC, Abuse Elevation Control Mechanism, Cloud Instance Metadata API.
- Defense Evasion: Obfuscation, Process Injection, Masquerading, Disable Security Tools, Modify Registry, Rootkit, Code Signing, Traffic Signaling.
- Credential Access: OS Credential Dumping (LSASS), Network Sniffing, Keylogging, Credential from Password Stores, Forced Authentication, Kerberoasting, AS-REP Roasting.
- Discovery: Network Service Scanning, System Network Config, Remote System Discovery, AD Recon, Cloud Service Discovery, Permission Groups Discovery.
- Lateral Movement: Remote Services (SMB/WinRM/RDP/SSH), Pass the Hash/Ticket, Alternate Authentication Material, Exploitation of Remote Services, Internal Spearphishing.
- Collection: Data from Local System, Network Shared Drive, Email, Cloud Storage, Clipboard, Audio/Video Capture.
- Command & Control (C2): Application Layer Protocol (HTTP/HTTPS/DNS/QUIC), Proxy, Web Service, Dynamic Resolution, Encrypted Channel, Non-Standard Port, Traffic Signaling.
- Exfiltration: Exfiltration Over C2 Channel, Web Service, Cloud Storage, Physical Medium, Alternative Protocol.
- Impact: Data Encrypted (Ransomware), Data Destruction, Service Stop, Resource Hijacking (Cryptomining), Defacement, Firmware Corruption, Account Access Removal.
4. Mô hình Kill Chain (Cyber Kill Chain - Lockheed Martin) & MITRE ATT&CK
Giúp hiểu vòng đời tấn công để đặt phòng thủ (Detection/Prevention) tại từng giai đoạn:
- Reconnaissance (Thu thập thông tin)
- Weaponization (Tạo vũ khí - Malware, Exploit, Phishing kit)
- Delivery (Phân phối - Email, Web, USB, Supply Chain)
- Exploitation (Khai thác lỗ hổng)
- Installation (Cài đặt Malware/Backdoor/Persistence)
- Command & Control (C2 - Kết nối điều khiển)
- Actions on Objectives (Đạt mục tiêu - Encrypt, Steal, Destroy, Disrupt)
5. Chiến lược phòng chống (Defense Strategy - Defense in Depth)
| Lớp bảo vệ | Giải pháp / Hành động |
|---|
| Perimeter / Network | NGFW (App-ID, IPS, SSL Decrypt, Threat Prevention), DDoS Protection (Cloud/On-prem), Network Segmentation (VLAN, Micro-seg), ZTNA/VPN, DNS Security (Protective DNS), Network Detection & Response (NDR). |
| Endpoint | EDR/XDR (Behavioral, ML), Application Control (AppLocker, WDAC), Hardening (CIS Benchmark, Attack Surface Reduction Rules), Patch Management (Automated), USB Control. |
| Identity & Access | Zero Trust (Never Trust, Always Verify), MFA Phishing-resistant (FIDO2/WebAuthn), PAM/JIT, Identity Governance (IGA), Conditional Access, Passwordless. |
| Application & Data | DevSecOps (SAST/DAST/SCA/Container Scan), WAF/API Gateway, DLP (Network/Endpoint/Cloud), Encryption (TLS 1.3, At-rest), Database Activity Monitoring, Backup Immutable (3-2-1). |
| Cloud & Infrastructure | CSPM/CNAPP (Wiz, Orca, Prisma, Defender for Cloud), IaC Scanning, CI/CD Pipeline Security, Kubernetes Security (PSP/Kyverno/Gatekeeper, Falco), Serverless Security. |
| Operations & Intelligence | SOC 24/7 (SIEM + SOAR), Threat Intelligence (TI Feeds, TIP), Threat Hunting (Hypothesis-driven), Purple Teaming, Incident Response Plan (Tested), Digital Forensics Readiness. |
| Governance & People | Security Awareness Training (Phishing Sim), Policy/Standard/Procedure, Risk Management (NIST CSF, ISO 27001), Third-Party Risk Management (TPRM), Compliance Automation, Security Culture, Executive Reporting. |
6. Phân biệt Threat (Đe dọa), Vulnerability (Lỗ hổng), Risk (Rủi ro)
- Threat: Kẻ tấn công / Tự nhiên / Tai nạn có ý định/khả năng gây hại.
- Vulnerability: điểm yếu trong hệ thống (Code bug, Misconfig, Missing patch, Weak process, Human error).
- Risk: Xác suất Threat khai thác Vulnerability × Tác động (Impact). Risk = Likelihood × Impact.
Kết luận: Cảnh quan đe dọa thay đổi nhanh, tự động hóa, AI-driven, nhắm vào Identity & Cloud. Phòng thủ hiệu quả cần **Visibility toàn diện, Zero Trust Architecture, Automation (SOAR), Threat Intelligence driven, Continuous Validation (Breach & Attack Simulation), Culture bảo mật mạnh**. Không có "bóng ma thuật" (Silver bullet) - chỉ có quá trình quản trị rủi ro liên tục.
