Unsecure networks, supply chain, and the software you did not write

Objective 2.2 in this course covers threat vectors and attack surfaces. The previous lesson took the human-facing vectors; this one takes the rest of CompTIA's scope note for it — unsecure networks, supply chain and vulnerable software — and the idea of attack surface itself.

Why this matters

These are the vectors that do not need anyone to be fooled. A default password on an internet-facing appliance, an open management port, a compromised update from a supplier: none of them require a user to make a mistake, which means awareness training does nothing about them.

Supply chain in particular has moved from a footnote to a first-class concern, and SY0-701 tests it in both Domain 2 (as a vector) and Domain 5 (as third-party risk management). Recognising the same idea in both places is worth real marks.

The lesson

Unsecure wireless, wired and Bluetooth, and what each exposes

Wireless. The exposures are: open or WEP/WPA-personal networks where the key is shared and effectively public; rogue access points, which are unauthorised APs plugged into your network, often by an employee wanting better coverage; and evil twin attacks, where an attacker broadcasts an SSID matching yours so clients associate with them instead. The evil twin gives the attacker an on-path position — every unencrypted request is theirs to read and modify. Deauthentication attacks force clients off the real AP to speed that up. WPA3, 802.1X authentication and rogue AP detection are the answers (Domain 4).

Wired. The assumption that a network port in the building is trustworthy is the exposure. An unused port in a meeting room or reception is a path onto the internal network for anyone who can sit down. MAC spoofing defeats naive filtering. The controls are port security, disabling unused ports, and 802.1X on wired ports too — which organisations far less often do.

Bluetooth. Short range, but the range is longer than people assume and the pairing model is the weakness. CompTIA names bluejacking (sending unsolicited messages) and bluesnarfing (stealing data from the device). Older or badly implemented stacks allow pairing without meaningful confirmation. The control is to turn it off where not needed, keep devices non-discoverable, and patch — and to remember Bluetooth peripherals are a physical vector too, since a wireless keyboard receiver is an input device on the machine.

Open service ports, default credentials and unsupported systems

These three account for an enormous share of real compromises and they are CompTIA's named unsecure-network conditions.

Open service ports. Every listening service is an entry point. The question is not whether the service is vulnerable today but whether it needs to be reachable at all. Management interfaces — SSH, RDP, database ports, hypervisor and appliance admin panels — exposed to the internet are the classic finding. The control is to close, filter or restrict by source, and to know what is listening in the first place, which requires the asset inventory from Domain 4.

Default credentials. Shipped usernames and passwords, published in the vendor's own manual. They persist on printers, cameras, network appliances, management consoles, IoT devices and database installs. Changing them is part of the secure baseline in Domain 4, and "the device still had the vendor default" is a scenario the exam uses regularly.

Unsupported systems and applications. Software past end-of-support receives no patches, so every newly discovered vulnerability in it is permanent. This is not a vulnerability so much as a guarantee of future ones. When it cannot be replaced — the usual reason being a business application that will not run on anything newer — the answer is the compensating control pattern from Domain 1: isolate, restrict, monitor, and record the accepted risk with a review date.

Managed service providers, vendors and suppliers as an attack surface

Supply chain attacks compromise you through someone you trust. CompTIA splits it three ways:

• Managed service providers (MSPs) — an MSP typically has privileged, remote access to many clients' estates. Compromising one yields all of them. This is the highest-leverage target in the category.
• Vendors — including hardware vendors, whose devices can arrive with malicious or simply insecure firmware, and whose update channels are a path in.
• Suppliers — the wider set of organisations you depend on, including logistics and outsourced business functions.

The attack patterns to recognise: a compromised software update, where the vendor's build or signing process is subverted and the malicious version is correctly signed and delivered through the normal channel; a compromised dependency, where an open-source library many products use is backdoored upstream; and abuse of legitimate remote access granted to a third party.

What makes these hard is that every conventional control says yes. The update is signed. The traffic comes from an allowed vendor address. The MSP's account is supposed to have admin. That is why the controls are contractual and structural — vendor assessment, right-to-audit clauses, limiting third-party access to what they need and when, monitoring what vendors do rather than just whether they are authorised. Domain 5 covers the assessment side in detail.

Client-based versus agentless software, and the update channel as a vector

CompTIA distinguishes client-based software vulnerabilities — an agent installed on endpoints, which is itself code running with privilege on every machine you own — from agentless approaches, where the server reaches out and nothing extra is installed.

The trade-off is examinable:

• A client/agent gives richer data, works off-network, and can act locally. The cost is that it is an installed privileged component on every host: its vulnerabilities are your vulnerabilities everywhere at once, and its update channel is an enormous target. Several significant incidents have come from exactly this — a security or management agent being the thing that was compromised.
• Agentless avoids that, at the cost of needing credentials and network reach, giving less depth, and missing devices that are off the network.

The update channel point generalises: any mechanism that installs signed code on your machines automatically is, by design, a privileged remote execution path. Judge one by asking who controls the signing key, what happens if the vendor is compromised, and whether you can stage updates rather than taking them instantly everywhere.

Attack surface as a number you can reduce, and how to state it

Attack surface is the sum of the points where an untrusted party could attempt to interact with a system. It is usefully thought of in three parts:

• Network surface — listening ports, exposed services, reachable endpoints.
• Software surface — installed packages, libraries, browser extensions, enabled features, running services.
• Human surface — the people who can be contacted and what they are permitted to do.

The reason to think of it as a quantity is that it makes the controls obvious, and they are the mitigation techniques you meet two lessons from now: remove software you do not use, disable services and protocols you do not need, close ports, restrict who can reach what, and reduce the number of people with privileged rights.

A good way to state it, and a good habit for the exam's scenario questions: for each thing an attacker could touch, either it is needed and defended, or it is not needed and should be gone. Most real findings are the second kind — the service nobody uses, the account nobody closed, the port opened for a project that finished two years ago.

What to take into the exam

• An evil twin is an attacker's AP imitating yours; a rogue AP is an unauthorised one on your network. They are different findings.
• Open management ports, default credentials and unsupported software are the three conditions that need no user mistake at all.
• A supply chain attack passes every conventional control because it arrives correctly signed through the normal channel — so the answers are contractual and structural.
• An MSP compromise is high leverage because one breach reaches every client.
• Agents give depth at the cost of privileged code everywhere; agentless avoids that and sees less.
• Attack surface reduction is "needed and defended, or gone".