A man-in-the-middle (MitM) attack happens when an attacker secretly positions themselves between two parties who believe they are talking directly, intercepting and sometimes altering the messages that pass between them. Neither side realizes a third party is reading, and possibly rewriting, everything in transit.
Common methods include ARP poisoning to redirect traffic on a local network, rogue Wi-Fi hotspots that lure devices into connecting, and SSL stripping that quietly downgrades an HTTPS session to plain HTTP. The strongest defense is TLS with proper certificate validation, which is exactly why attackers push victims toward unencrypted channels or forged certificates. A subtle trap for candidates: encryption alone does not stop MitM if certificate checks are skipped or a user clicks through a warning, because the attacker simply presents their own certificate.
How is a man-in-the-middle attack tested on the CISSP?
MitM attacks appear in Domain 4: Communication and Network Security, with design implications in Domain 3. You should understand how the attack works, which protocols and validation steps prevent it, and how to architect networks that shrink interception opportunities.
Related terms: Encryption, Public Key Infrastructure