Cybersecurity Attack and Defense Landscape: Legal Boundaries and Prerequisite Knowledge Review

The global cybersecurity threat landscape in 2024 has reached an unprecedented level of complexity, driven by the dual forces of rapidly evolving attack techniques and the expanding digital attack surface across enterprise, critical infrastructure, and consumer ecosystems. According to the 2024 Verizon Data Breach Investigations Report (DBIR), which analyzed over 32,000 confirmed breach incidents across 100+ countries, 82% of breaches involved a human element (phishing, social engineering, or misconfiguration), while 60% exploited unpatched vulnerabilities in public-facing systems[^1]. IBM’s 2024 Cost of a Data Breach Report further quantifies the impact: the average total cost of a data breach now stands at $4.88 million, with organizations taking an average of 277 days to identify and contain a breach[^2]. For intermediate cybersecurity practitioners, these statistics underscore a critical reality: offensive and defensive operations are no longer isolated technical exercises, but are tightly bound to legal, regulatory, and ethical frameworks that govern every stage of the testing lifecycle.

1.1 Evolving Global Threat Landscape and Common Attack Vectors

The modern threat ecosystem is defined by the convergence of opportunistic cybercrime, state-sponsored advanced persistent threat (APT) groups, and insider risks, all amplified by the commoditization of attack tools and the rise of generative AI. To contextualize the technical and legal requirements covered later in this chapter, we first break down the most prevalent attack vectors observed in 2023-2024, organized by attack surface layer.

1.1.1 Network Layer Attacks

Network layer attacks target the underlying infrastructure that enables connectivity, including routers, switches, firewalls, and IoT/OT devices. In 2024, the most high-profile network layer incident was the exploitation of CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that allowed unauthenticated attackers to reset administrator accounts and gain full control of on-premises Confluence instances. Over 5,000 public-facing Confluence servers were compromised within 72 hours of the vulnerability’s public disclosure, with many attacks leading to downstream ransomware deployments.

A persistent network layer threat is TCP/IP protocol exploitation. For example, IP fragmentation attacks leverage inconsistent handling of fragmented packets across network devices to bypass IDS/IPS systems, while TCP sequence number prediction attacks enable session hijacking on unencrypted legacy protocols like Telnet and FTP. The 2023 attack on a U.S. water treatment plant in Florida, where attackers hijacked an unencrypted Modbus TCP session to alter chemical levels in the water supply, highlights the life-safety risks of unpatched network layer vulnerabilities in OT environments.

```mermaid pie title 2024 Global Breach Attack Vector Distribution (Source: Verizon DBIR 2024) "Human Factor (Phishing/Social Engineering)" : 82 "Vulnerability Exploitation (Unpatched Systems)" : 60 "Credential Compromise (Weak Passwords/Credential Stuffing)" : 45 "Supply Chain Attacks" : 23 "Insider Threats" : 18 ```

1.1.2 Application Layer Attacks

Application layer attacks target software vulnerabilities in web applications, APIs, and desktop/mobile applications, and remain the most common entry point for breaches. The 2024 MOVEit Transfer mass exploitation event is a defining case study: a critical SQL injection vulnerability (CVE-2023-34362) in the managed file transfer software was exploited by the Cl0p ransomware gang to steal data from over 2,500 organizations, including major banks, government agencies, and healthcare providers, affecting more than 60 million individuals. The total estimated financial impact of the MOVEit breach exceeds $10 billion, making it the largest data breach event in history.

API security has emerged as a top concern in 2024, with Gartner predicting that by 2025, 30% of all enterprise breaches will involve API vulnerabilities. Broken object level authorization (BOLA), broken authentication, and excessive data exposure in REST/GraphQL APIs are the most commonly exploited flaws, as demonstrated by the 2024 breach of a major ride-sharing platform where attackers exploited an insecure API endpoint to access location data for over 15 million users.

> 📌 实践案例：2024年某电商平台SQL注入漏洞利用过程 > 渗透测试人员在获得授权后，对目标平台的商品搜索接口进行测试，发现输入`' OR SLEEP(5)-- -`时，响应时间延长5秒，证明存在时间盲注漏洞。利用Python脚本自动化测试后，成功获取了后台数据库的管理员权限，并下载了包含120万用户个人信息的数据库。该案例展示了应用层漏洞的高风险性，也凸显了授权测试的必要性：未经授权的同类行为将构成《刑法》第285条规定的“非法获取计算机信息系统数据罪”，最高可处7年有期徒刑。

1.1.3 Host and Endpoint Attacks

Host layer attacks target operating systems, firmware, and endpoint devices, with privilege escalation and lateral movement as core objectives. The 2023 exploitation of CVE-2023-23397, a critical Windows SmartScreen security feature bypass vulnerability, allowed attackers to execute arbitrary code on unpatched Windows 11 and Windows Server 2022 systems without user interaction, simply by sending a crafted .url file to the target via email or messaging. The vulnerability was actively exploited by the Storm-0978 ransomware group to target government and energy sector organizations in Eastern Europe.

Linux host attacks frequently leverage kernel vulnerabilities such as Dirty COW (CVE-2016-5195), a race condition in the copy-on-write mechanism that allows unprivileged users to write to read-only memory, enabling root privilege escalation. Despite being disclosed in 2016, Dirty COW remains a top exploited vulnerability in 2024, with over 30% of unpatched Ubuntu and CentOS systems still vulnerable to public exploit code.

1.1.4 Human and Supply Chain Attacks

Human layer attacks exploit cognitive biases and lack of security awareness, with phishing remaining the most common initial access vector. The 2024 rise of AI-generated phishing emails has increased the effectiveness of these attacks by 70% according to SlashNext’s 2024 Phishing Report, as generative AI tools enable attackers to create perfectly grammatically correct, context-aware phishing messages that bypass traditional email filters.

Supply chain attacks exploit trust relationships between organizations and their third-party vendors, as demonstrated by the 2024 XZ Utils backdoor incident. Attackers spent two years infiltrating the open-source XZ Utils project, eventually gaining maintainer access and inserting a backdoor into versions 5.4.0 and 5.4.1 of the library, which is included in nearly all major Linux distributions. The backdoor allowed remote attackers to execute arbitrary code via SSH authentication bypass, with a CVSS score of 10.0. The incident highlights the critical need for software supply chain security controls, now mandated by regulations including the EU NIS 2 Directive and U.S. Executive Order 14028.

1.2 Legal and Ethical Boundaries for Offensive Security Operations

Offensive security operations, including penetration testing, vulnerability research, and bug bounty activities, are heavily regulated across jurisdictions. Failure to comply with legal requirements can result in criminal charges, civil liability, and permanent damage to professional reputation. This section outlines the core legal and ethical requirements that govern all offensive security activities.

1.2.1 Global Regulatory Framework for Offensive Security

The global regulatory environment for offensive security is fragmented, with regional laws varying significantly in scope and enforcement strictness. Three core regulatory frameworks form the foundation of global requirements: 1. NIST SP 800-115 (U.S.): The National Institute of Standards and Technology’s Technical Guide to Information Security Testing and Assessment is the de facto standard for penetration testing in the U.S. federal government and is widely adopted by private sector organizations. It mandates that all testing activities be prec