VECTOR	WHAT	HOW
SQL Injection	SQL Injection is an attack targeted towards websites or services and rarely targets individuals. Malware on a WFH device may allow SQL code injection into a corporate website or database, allowing for privilege escalation and exploitation.	An infected WFH device may allow remote access for a black hat to inject false queries into a corporate parameter, with the added bonus of privilege escalation from the WFH user’s credentials. However, this is an extremely unlikely path of attack hence we need not worry about it.
Cross-Site Scripting	Cross-Site Scripting, similar to SQL Injection, may inject malicious reference code into a parameter. Corporate websites and databases are targeted to allow for insecure referencing of a user interface.	Similar attack methodology as SQL Injection. An infected device over the network may allow a cross-browser directory, compromising a corporate device. Teens accessing streaming websites with certain cookies enabled that run Javascript could allow for XSS attacks. Appliance sprawl in WFH corporate architecture can lead to XSS attacks due to a lack of patch management and application hardening.
Credential Stuffing	Credential Stuffing is an attack where a set of usernames and passwords is discovered on a platform, and those credentials are used to gain access to another platform. Credential Stuffing is highly effective for targeting users after a single data breach.	A teen who uses a parent’s username and password on a website with a data leak may inadvertently compromise the parent’s corporate login, as many remote workers reuse just a single or a couple of passwords for all platforms.
Brute Force Attack	A Brute Force attack is an attack that inputs random strings of characters into parameters to attempt to gain access. Brute Force attacks have low probabilities of being successful and are extremely resource intensive.	Although brute force attacks are not commonly used to target individuals, social engineering may be used on a teen to gain access into a home network, allowing the black hat to brute force attack the login to a corporate network or capture login elements and brute force attack offline to avoid detection. VPNs or firewalls struggle to stop brute force attacks as many brute force attacks are employed through a legitimate surface of an application or website.