UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.1 Free with a free account
The Modern Cyber Threat Landscape
Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.1 · lesson 78 of 11613 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: How Email Has Become One of the Primary Delivery Channels for Scams and Attacks →← How Malicious Software Serves as a Weapon in Larger Criminal OperationsNext lesson: How Email Has Become One of the Primary Delivery Channels for Scams and Attacks →
In this lesson
Recognize evolving threats, evaluate evidence, and organize a response.
- Explain how ransomware, supply chain attacks, AI, and deepfakes can overlap.
- Use CISA advisories and MITRE ATT&CK for different information needs.
- Interpret network, host, account, and email warning signs in context.
- Distinguish response activities and connect lessons learned with preparation.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,515 words). Read along, or search it.
Chapter 13
The Modern Cyber Threat Landscape
Cyber threats evolve as tools, trusted relationships, and criminal business models change. This lesson links the changing threat picture with evidence and organized response. We will compare ransomware, supply chain attacks, AI-enabled activity, and deepfakes. These labels can overlap within a single incident. Next, we will distinguish CISA advisories from the MITRE ATTACK knowledge base. They support different information needs and should be checked for current relevance. We will examine network, host, account, and email warning signs. Evidence needs context, rather than a simple rule that counts alarms. Finally, we will explain preparation, analysis, containment, eradication, recovery, and lessons learned. The six activities form a useful teaching model, while current NIST guidance organizes incident response differently. The practical goal is informed, proportionate action supported by preparation and continuous improvement.
Evolving Trends
Four Trends Describe Different Aspects of an Incident
The four trends describe different aspects of a threat. Ransomware denies access, while related data-extortion activity threatens publication. Supply chain attacks involve trusted suppliers or dependencies as routes toward other organizations. AI can assist deception, analysis, or other malicious work. Deepfakes fabricate or manipulate a person’s apparent voice, image, or video. A convincing message may increase the chance that someone trusts a false claim. A compromised dependency may then reach organizations using that product or service. Extortion can follow once access or information is obtained. This is a possible combined scenario, rather than a required attack sequence. The categories are not mutually exclusive, and affected organizations differ in their exposure. Describe the mechanism and outcome instead of forcing every incident into only one of the four boxes.
Ransomware and Suppliers
Operational Dependence and Trusted Relationships Create Exposure
Ransomware commonly encrypts files or otherwise denies access while criminals demand payment. Hospitals, schools, city governments, and other organizations can suffer serious interruption. Stolen-data threats can add pressure even when protected backups support recovery. A payment demand promises relief, but payment does not guarantee a safe outcome. Supply chain attacks involve a trusted vendor, contractor, software product, or dependency. A compromised update or service can expose multiple downstream customers. Trust in the supplier does not authenticate every change or guarantee security. However, a compromised source does not automatically mean every customer is breached. Actual impact depends on use, affected versions, access, and local defenses. An incident could combine supplier compromise, a harmful update, and a later ransom demand. The example explains how trusted relationships and operational dependence can interact, rather than predict every organization’s experience.
AI and Deepfakes
Convincing Content Can Weaken Familiar Trust Cues
AI-enabled activity can make deceptive content easier to produce and distribute. Messages may be more believable, personalized, or numerous. Good grammar therefore does not establish that a communication is genuine. AI can also assist analysis or probing, with capabilities and effectiveness varying. It does not make every attack fully autonomous or inevitably successful. A deepfake uses synthetic or manipulated media to imitate a person. Fabricated audio or video can make a payment request appear to come from a familiar authority. A realistic voice or face is different from verified identity and authorization. Check sensitive requests through an independently established channel. Synthetic media can also have lawful uses, so its creation is not automatically a crime. Assess the actual claim and requested action, instead of relying on apparent realism alone.
Reliable Information
CISA and MITRE ATT&CK Answer Different Questions
CISA publishes alerts and advisories describing threats and recommended defensive actions. A relevant notice may identify affected systems, observed behavior, and mitigations. Teams compare that scope with the products and services they actually use. MITRE ATTACK is a public knowledge base of observed adversary tactics and techniques. It supplies shared language for describing behavior and assessing defenses. These information sources complement each other rather than perform identical jobs. Threat intelligence organizes and interprets information to support security decisions. Check publication dates, updates, affected versions, and local relevance. An old advisory may still matter, while a new notice may not apply to your environment. ATTACK tactics describe adversary goals; techniques can recur or appear in different orders. Neither resource is a complete automatic threat detector or a substitute for an organization’s own assessment.
Network and Host Evidence
Unexpected Activity Needs Comparison with Normal Operations
An indicator of compromise is evidence that may suggest a system has been breached. Network warnings include unusual outbound traffic or unfamiliar destinations. A sudden increase in data leaving a network can deserve investigation. Compare the activity with expected work, approved services, and related evidence. An international server location alone does not establish malicious activity. Host warnings include unexpected programs or files, unfamiliar processes, or disabled protection. A legitimate installation or authorized policy change can explain some events. Other behavior may be highly specific evidence of compromise. Confidence depends on the indicator’s meaning, reliability, and context. Correlated evidence often strengthens an assessment, but no fixed count applies to every incident. Do not treat all alerts as proof, or dismiss a strong indicator simply because no second alarm has appeared.
Account and Email Evidence
Identity Activity Can Reveal an Incident or a Legitimate Change
Account warnings include unusual login times or locations and repeated authentication failures. Privilege changes that no one authorized deserve particular attention. Travel, work schedules, and approved administrative activity can explain some unusual patterns. Verify what actually happened and whether it was authorized. Email warnings include waves of similar phishing messages or unexpected forwarding rules. Replies to messages the account holder did not send can also indicate misuse. Receiving phishing shows attempted deception, rather than proving every recipient has already been compromised. Mailbox changes and related account activity help establish the scope of an incident. Capture relevant facts and report through established procedures. Avoid assuming guilt or innocence from one unusual event. An urgent, credible warning should not wait merely because someone believes several alarms are always required.
Response Activities
Preparation and Learning Connect the Response
The source’s teaching model connects six response activities. Preparation establishes plans, people, tools, and readiness. Detection and analysis examine evidence and determine incident scope. Containment limits immediate damage or spread. Eradication removes malicious activity and addresses causes. Recovery restores operations carefully, with validation and monitoring. Lessons learned feed improvements back into preparation and other activities. Real work can overlap, repeat, or begin before every fact is known. Current NIST guidance, finalized in April twenty twenty-five, organizes incident response around Detect, Respond, and Recover. Its broader preparation includes Govern, Identify, and Protect within Cybersecurity Framework two point zero. Continuous improvement informs all functions, so the six teaching activities should not be mistaken for NIST’s exact current labels.
Prepare and Analyze
Readiness Starts Early, and Analysis Continues
Preparation begins before an incident disrupts normal work. Plans establish responsibilities, decision authority, tools, and communication channels. Training helps people know what to report and whom to contact. Exercises and previous incidents can identify missing resources or unclear responsibilities. Detection and analysis then assess available evidence. Responders ask whether an incident occurred and what systems or people are affected. They examine severity, operational impact, and possible scope. A legitimate change should be distinguished from harmful activity whenever evidence permits. Analysis continues as new facts arrive, rather than end permanently at one stage boundary. A repeatable plan provides direction when time is limited and uncertainty remains. Preparation stays active through improvements, while established authority helps teams manage immediate risks without waiting for perfect knowledge.
Containment and Eradication
Limit the Harm, Then Address the Cause
Containment and eradication have different purposes. Containment limits immediate damage or prevents further spread. Restricting affected access or appropriately isolating a system can help. Those actions may stop symptoms without removing their cause. Eradication removes malicious activity and addresses underlying weaknesses. Examples include removing malware, repairing an exploited flaw, and revoking compromised credentials. A patch alone may not remove an attacker already present. The activities often need coordination rather than perfectly separate time slots. Containment can interrupt critical services, so responders consider safety and operational consequences. Relevant evidence should be preserved in line with the response plan and authorized procedures. The distinction lets teams limit harm promptly while completing the more thorough work needed for secure restoration.
Recover and Improve
Restoration and Learning Continue Beyond the Initial Disruption
Recovery restores affected systems and operations carefully. Responders validate the restoration and monitor for renewed harmful activity. A system appearing functional does not prove that every threat has disappeared. Lessons learned examine what happened, why it happened, and what the response revealed. Teams identify what worked and what failed. The result should become concrete improvements to plans, controls, tools, training, or communication. A missing reporting channel, for example, becomes a preparation task with an owner. Learning can occur during an incident as well as after it. That feedback makes response a continuing cycle rather than a one-time reaction. The organization’s current procedures and applicable obligations guide actual work. A framework helps organize decisions, while broader risk management connects readiness, response, restoration, and continuing improvement.
Review and Apply
Explain the Trend, the Evidence, and the Response Purpose
A single incident can carry several threat labels because the labels describe different mechanisms or outcomes. Deception, a trusted dependency, and extortion may occur together. CISA provides specific threat information and defensive guidance. MITRE ATTACK supplies a shared catalog of observed adversary behavior. An indicator’s specificity and context matter more than a mandatory number of alarms. Related evidence can strengthen confidence, while some unusual events have legitimate explanations. Containment limits immediate harm; eradication removes malicious activity and underlying causes. Recovery restores operations with validation and monitoring. Lessons learned strengthen preparation and other activities. Real work can overlap or repeat, and current NIST guidance uses its own broader organization. Keep information current, investigate credible warnings, and follow a prepared response process that supports informed action and continuous improvement.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About The Modern Cyber Threat Landscape
What are the main trends in today's cyber threat landscape?
What is the difference between CISA advisories and MITRE ATT&CK?
What are common indicators of compromise?
What are the steps of cybersecurity incident response?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →