Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. In 2013, Apple, Facebook, Microsoft and Twitter were compromised through an iOS developer forum their engineers frequented, booby-trapped with a Java exploit. No email targeted the employees. What is this technique called?
A watering hole attack
The phrase borrows the image of a predator waiting by a watering hole, a place prey must pass. It appeared in the security literature around 2012 and describes an indirect compromise, especially effective against targets that are well defended head on: government bodies, defense contractors, research institutes, large technology firms. The attacker gives up on forcing the target and instead compromises a site its staff visit, a professional forum, an industry association, a standards body, and plants malicious code or a browser exploit there. The shift is the one that matters for assessing a risk: the security level protecting a company is no longer its own, it is that of the weakest site its people browse. The 2013 case proves the point precisely because the four victims were among the best defended organizations in the world and no direct attempt was needed.
Glossary entry →2. An employee types "reuassurance-corp.com" instead of "reassurance-corp.com". The domain shows a perfect copy of the internal portal and harvests the credentials. What does this technique rely on?
Registering slightly altered variants of a legitimate domain name
Typosquatting, also called URL hijacking, means registering slightly altered variants of a known domain name to catch mistyped traffic or impersonate the legitimate site. The variants exploited follow the way people actually slip: near misses on the keyboard, substitution of visually similar characters known as homoglyphs, such as a zero for the letter o, a missing or extra hyphen, and combo-squatting which bolts a generic word onto the real domain, along the lines of bank-secure or paypal-login. Born in the 1990s as opportunistic domain trading to catch distracted visitors, it has become a phishing vector in its own right. What separates it from the other three answers matters to an underwriter: it requires no compromise of any company system, not its DNS, not its certificate authority, not its servers. The attacker penetrated nothing, they bought a domain name, which makes the technique cheap, hard to prevent technically, and slow to detect.
Glossary entry →3. An attacker gets in through SQL injection on a web server, with no particular rights, then exploits a kernel flaw unpatched for eighteen months to obtain root. What is this step called, and of what kind is it?
Privilege escalation, of the vertical kind
Privilege escalation is an almost invariable step in an attacker's progress after the initial intrusion, and the distinction between its two forms is worth holding: it is vertical when the attacker moves from a standard account to an administrator account or system rights, horizontal when they take over the rights of another user at the same level. Here, going from an unprivileged foothold to root is vertical by definition. The usual vectors are known and ordinary: unpatched kernel vulnerabilities, badly configured sudo policies, poorly revoked access tokens, misconfigured SUID binaries, passwords left in scripts or environment variables. What matters to an underwriter is the delay: eighteen months without a kernel patch is a maintenance practice, therefore something observable at underwriting rather than after the loss. And once root is obtained, the attacker reads the configuration files holding the database credentials, which makes this step the pivot between an intrusion and an exfiltration.
Glossary entry →4. In 2010, Stuxnet installed itself at the Windows kernel level using a stolen signed driver, then targeted the Siemens controllers of Iranian centrifuges. Why is a kernel rootkit invisible to the machine's own security tools?
Because it runs at the same trust level as the system, therefore beneath the tools running on top of it
The word rootkit joins root, the supreme administrator account on Unix systems, and kit, a set of tools. It appears in the early 1990s for collections of programs letting an attacker who already holds root hide their presence by altering system commands. Its sophistication advanced in layers: user space rootkits, which hijack system libraries, gave way to kernel rootkits, operating at the same trust level as the core of the operating system. That is where the invisibility comes from, and the reasoning is purely logical: a detection tool runs above the kernel and asks it what it sees, so code sitting inside the kernel decides what the tool will see. Stuxnet, attributed to American and Israeli services, crossed that barrier with a stolen signed driver, that is, by borrowing a legitimate third party's trust rather than breaking a mechanism. Its discovery redrew the line between cyberattack and act of war, and it fed the war exclusion debates in cyber policies throughout the following decade.
Glossary entry →5. In December 2015, attackers entered Ukrainian electricity distributors by spear phishing, then remotely tripped circuit breakers, cutting power to 230,000 homes. What did this event establish for the first time?
That a cyberattack could cause a real power outage
A SCADA system, for Supervisory Control and Data Acquisition, monitors and commands physical processes in real time: power grids, chemical plants, water treatment works, pipelines, rail systems. It combines programmable logic controllers, human machine interfaces and data collection servers wired to sensors and actuators. Its security is a distinct problem from ordinary information systems security for a structural reason: these systems have lifespans counted in decades, which often makes them impossible to patch without stopping the process they control. The December 2015 attack, attributed to the Sandworm group, is the first confirmed cyberattack to have caused a real power outage, and that is what makes it a date. It demonstrates the convergence of cyber and physical, that is, the point at which a computer intrusion stops producing a data loss and starts producing physical damage and an interruption of service, engaging covers that nothing had brought together until then.
Glossary entry →6. In May 2017, Marcus Hutchins stopped the worldwide WannaCry epidemic within hours. What exactly did he do?
He registered an unregistered domain name the ransomware queried at startup
A kill switch is any device for shutting a system down in an emergency, and the term comes from industrial engineering, where it names a machine's emergency stop. In cybersecurity it owes its fame to the WannaCry crisis of May 2017: Marcus Hutchins, then twenty-two, discovered by chance that the ransomware queried an unregistered domain name at startup, and that registering it himself forced the program to switch itself off. A worldwide epidemic stopped within hours for the price of a domain name. That kill switch was unintentional, probably built in by the authors as an anti-sandbox check meant to spot analysis environments, and that is what makes the episode instructive: a design decision taken for an unrelated reason determined the scale of a global loss. The same word now names the emergency stop of an autonomous model, where it raises a different question, since an algorithmic execution model can have fired thousands of orders before the operator reaches the button.
Glossary entry →7. In 2017, researchers at Tel Aviv University extracted a 4096-bit RSA key in an hour, using a microphone placed a few centimeters from a laptop. What do attacks of this kind target?
The physical or timing side effects of its execution
Side-channel attacks bypass the mathematical strength of a cryptographic algorithm by looking not at its logic but at what its execution leaks: computation time, power draw, electromagnetic emissions, sound. A 4096-bit key stays out of reach of a frontal attack, and that is exactly the side-channel's reasoning: you do not attack the mathematical problem, you listen to the machine solving it. The term appears in academic work in the 1990s, though the principle is older, the TEMPEST program, classified by the NSA since the 1950s, dealing with reconstructing information from equipment emissions. Paul Kocher formalized the timing attack against RSA in 1996, then differential power analysis against DES with Jaffe and Jun in 1998. The 2017 acoustic demonstration stayed academic, but it led to rewriting the targeted library so its operations run in constant time, which is the countermeasure in principle: remove the correlation between the secret and the observable effect.
Glossary entry →8. A treasurer receives a transfer instruction signed by the finance director, plus a second confirmation email. Both were intercepted and altered in transit. The cyber policy routes the loss to a separate cover with a lower cap. Which one?
Funds transfer fraud cover
In a man-in-the-middle attack, the attacker sits between two parties who believe they are talking directly, to listen in or alter what passes. The classic vectors are ARP spoofing on a local network, DNS poisoning, rogue wireless access points and, in some settings, compromised TLS certificates. End to end encryption and certificate pinning are the countermeasures in principle. The case here is instructive for how it ends rather than for its technique: dual confirmation, a procedure designed to stop exactly this fraud, protects nothing when both messages travel the compromised channel. A verification only adds security if it runs over an independent channel. And the insurance consequence is the one an underwriter should see coming: the loss is characterized as funds transfer fraud, and therefore attaches to a separate cover whose cap is usually far below the policy's overall limit. The characterization decides the amount, before any argument about the loss itself.
Glossary entry →9. On February 20, 2024, an international police operation seized 34 LockBit servers and recovered over 7,000 decryption keys. What direct effect did it have for insured victims?
Victims who had not paid could recover their data free of charge
Operation Cronos was coordinated by the UK National Crime Agency and Europol, with ten participating countries including the United States, France, Germany, Australia, Japan and Canada, and its results were made public on February 20, 2024. It seized thirty-four servers hosting LockBit's command and control infrastructure, its data leak sites and its affiliate management panels, took over two hundred cryptocurrency wallets, made two arrests in Poland and Ukraine, and brought five indictments in the United States and the United Kingdom. The seized servers yielded the identities of a hundred and ninety-four active affiliates and more than seven thousand decryption keys, published by the FBI and the NCA in a public tool. Past victims who had not yet paid could therefore recover their data without paying anything, a rare case of a takedown directly benefiting insureds, and a reminder that a cyber loss is not always final at the moment it is notified.
Glossary entry →