// networking basics — module 12

Module 12 — Threats, Vulnerabilities & the Frameworks That Organize Them

Soren Brumbach · 2026-07-19 · 8 min read

Thesis: Finally, the shared mental map: how the field names, scores, and organizes attacks. This vocabulary is literally the meeting point of red and blue — it's how they talk to each other, and it's how you'll structure your own thinking in either role. Frameworks are how the whole industry shares knowledge.

Prerequisite: Module 11 — Logging, Telemetry & Evidence and everything before it. This module organizes concepts you've already met into the maps professionals actually use.

12.1 Why frameworks exist

You've now met a lot of individual attacks and defenses. Frameworks are how the industry turns that sprawl into a shared language and a shared map, so that thousands of people can describe, compare, and coordinate against attacks consistently. When a red teamer says "we used technique T1055 for privilege escalation" and a blue teamer replies "we have a detection for that," they're speaking a common framework — and that shared vocabulary is what "purple team" runs on. This module hands you those maps so that the track-specific material you learn after the split has somewhere to attach.

12.2 Vulnerabilities, tracked: CVE and CVSS

The industry needs a way to refer to a specific vulnerability unambiguously and to say how bad it is. Two systems do this:

CVE (Common Vulnerabilities and Exposures) — a global catalog of publicly known vulnerabilities, each assigned a unique ID like CVE-2021-44228 (year + number). It's just a name everyone agrees on, so "the Log4j vulnerability" and a precise identifier point to the same thing worldwide. When you read a vendor advisory (as far back as Module 0's lab), the CVE ID is how it's referenced.
CVSS (Common Vulnerability Scoring System) — a severity score from 0.0 to 10.0, derived from factors like how easy the vuln is to exploit, whether it needs authentication, and its impact on confidentiality/integrity/availability (Module 0's triad, quantified). Rough bands: 0–3.9 Low, 4–6.9 Medium, 7–8.9 High, 9–10 Critical.

The skill is reading an advisory and judging "how bad is this, really, for us?" — and understanding that CVSS is severity, not priority. A Critical CVSS on a service you don't run matters less than a Medium on your internet-facing crown jewel. Context (is it exploitable in your environment, is it exposed, is there a patch) turns a score into a decision.

12.3 The attacker lifecycle

Real intrusions aren't one action — they move through stages. Different frameworks name them slightly differently, but the shape is remarkably consistent. Learn this arc; it organizes everything you've studied:

  Reconnaissance      — study the target (Modules 2–5: scanning, DNS, sniffing)
        │
  Initial Access      — get the first foothold (phishing, exploiting a service)
        │
  Execution           — run code on the target
        │
  Persistence         — survive reboots/logouts (Module 8: services, cron, run keys)
        │
  Privilege Escalation— gain higher rights (Module 8/9: setuid, tokens, admin)
        │
  Lateral Movement    — spread to other hosts (Module 9: creds, tickets; SMB/RDP)
        │
  Collection          — gather the target data
        │
  Exfiltration        — get the data out (Module 4: DNS tunneling, covert channels)
        │
  Impact              — the objective: ransomware, destruction, theft

Notice that every stage lands on a foundation you've already built. That's the point of the whole course — the attacker lifecycle is your curriculum, weaponized. A defender reads the same arc backwards: each stage is a chance to detect and disrupt (the telemetry of Module 11 is how).

12.4 The Cyber Kill Chain

The Cyber Kill Chain (from Lockheed Martin) is a classic, influential staged model of an intrusion: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. It's a slightly different cut of the same arc as §12.3, and its enduring idea is that an attack is a chain — break any link and you disrupt the whole attack. That "defenders only need to break one link; attackers need every link" framing is why it's still taught. Know it exists and know its shape.

12.5 MITRE ATT&CK — the shared knowledge base

MITRE ATT&CK is the detailed, community-maintained knowledge base of real-world attacker behavior, and it's the common language both tracks actually use day to day. Its structure:

Tactics — the attacker's why, the goal of a step (e.g., "Persistence," "Privilege Escalation," "Exfiltration"). These are essentially the lifecycle stages of §12.3, as columns.
Techniques — the how, specific methods to achieve a tactic, each with an ID like T1566 (Phishing) or T1055 (Process Injection). Many have sub-techniques.
Procedures — how a specific real-world group has actually used a technique.

   TACTIC (why)      →   TECHNIQUE (how)           →  PROCEDURE (who did it, exactly)
   Persistence           T1547 Boot/Logon Autostart    "Group X uses registry Run keys"
   Priv. Escalation      T1055 Process Injection        ...

Why it's the meeting point: red teams use ATT&CK to plan realistic operations and to describe findings ("we achieved persistence via T1547"); blue teams use the same IDs to map their detection coverage ("do we detect T1547? here's the gap"). One vocabulary, both sides — browse the ATT&CK website early and often; it's the map the industry navigates by.

12.6 Common threat categories

A quick taxonomy of what you're defending against, so the names are familiar (deep technique study belongs to the tracks — here you learn the map):

Malware — malicious software, by behavior: virus (attaches to files, needs a host), worm (self-spreads across networks, no host needed), trojan (disguised as legitimate), ransomware (encrypts data for extortion — an availability + impact attack), rootkit, spyware.
Phishing / social engineering — attacking the human rather than the machine: tricking someone into revealing credentials or running something. Still the number-one initial-access vector, because people are easier to exploit than patched software.
Web attacks — against applications (Module 6): injection, broken authentication, session hijacking.
Network attacks — against the wire (Modules 2–5): sniffing, spoofing, man-in-the-middle, denial of service.
Misconfiguration — not a "hack" at all, but the most common real weakness: default passwords, exposed services, over-broad permissions, unpatched systems. Boring, and responsible for an enormous share of breaches.

12.7 The vulnerability lifecycle and zero-days

Vulnerabilities have a life story, and where you are in it determines your risk:

  Discovery ──► Disclosure ──► Patch released ──► Patch applied
      │              │               │                  │
      └── if attackers find it first and there's no patch yet:
                     that's a ZERO-DAY — maximum danger, no defense available

Disclosure can be responsible (told to the vendor privately, fixed before public release) or not.
A zero-day is a vulnerability being exploited before a patch exists — "zero days" of warning for defenders. The scariest kind, because the normal defense (patch) isn't available yet.
The danger window is the gap between a vulnerability becoming known/exploited and the patch being applied (not just released — unpatched systems are the norm, which is why so many breaches use old, long-patched CVEs). Patch management is unglamorous and decisive.

12.8 Defense concepts to carry forward

A few framing ideas that bridge into either track:

Detection vs. prevention — prevention stops an attack (a firewall blocks it); detection notices one that got through (an alert fires). You need both, because prevention always eventually fails (defense in depth, Module 0).
Indicators of Compromise (IOCs) — observable evidence that an attack happened: a malicious IP, a file hash, a suspicious domain. The concrete things defenders hunt for and share.
You manage risk; you don't achieve perfect security. The honest, load-bearing truth from Module 0, restated at the end: security is about reducing risk to an acceptable level, not eliminating it. Every control is a trade-off, and "unbreakable" isn't on the menu.

12.9 → Red/Blue

The frameworks in this module are literally the coordination layer between the tracks. Red teams use CVE/CVSS to choose and justify targets, the attacker lifecycle and kill chain to structure an operation, and ATT&CK to plan and report ("here's the chain of techniques we ran"). Blue teams use CVSS (in context) to prioritize patching, the kill chain to find where to break attacks, ATT&CK to map and close detection gaps, and IOCs to hunt. Purple team is simply the two sitting at one table speaking this shared language — red demonstrates a technique by ID, blue builds the detection for that ID, repeat. Learning the map now means both futures are legible.

Lab 12

Mostly reading and mapping — the skill is fluency with the shared language.

Read a CVE end to end. Look up a recent high-severity CVE (the NVD site, or search a known one like Log4Shell / CVE-2021-44228). Read its CVSS score and description, and explain the risk in plain terms: what's the asset, the vulnerability, the impact (Module 0 vocabulary), and — the real question — would it matter in an environment that ran the affected software?
Explore ATT&CK. On the MITRE ATT&CK website, pick one tactic (e.g., Persistence) and read two techniques under it. For each, note how an attacker uses it and how you'd detect it (many technique pages list detections). Connect at least one to something you learned earlier (e.g., a Module 8 persistence mechanism).
Map a breach to the lifecycle. Invent (or read about) a simple breach and map it onto the attacker-lifecycle stages of §12.3: what was recon, what was initial access, how did they persist, escalate, move, and exfiltrate? Notice which earlier module each stage draws on.
Nail the vocabulary. Explain, in one sentence each and without notes, the difference between a vulnerability, an exploit, and a zero-day (a callback all the way to Module 0). Then explain why an old CVE can still cause breaches.

✅ Mastery Check — do not proceed until true

Answer out loud, without notes:

What is a CVE and what is CVSS? Why is CVSS severity not the same as priority?
Recite the attacker lifecycle stages in order, and name an earlier module each one draws on.
What is the Cyber Kill Chain's core insight about "breaking one link"?
Explain MITRE ATT&CK: what are tactics, techniques, and procedures, and why is it the shared language of red and blue?
Define virus, worm, trojan, and ransomware, and say why phishing and misconfiguration are so prevalent.
What is a zero-day, and why is the gap before a patch is applied so dangerous?
Detection vs. prevention, and what an IOC is. Why do we say you manage risk rather than eliminate it?

And perform cold:

Read a real CVE, state its CVSS band, and judge its real-world risk in context.
Map a hypothetical intrusion onto the attacker lifecycle, naming the technique-level idea at each stage.

When all of that is effortless: Capstone — You're Ready to Choose a Track