Course:
GRC Masterclass
Human Threats:
Natural Threats:
Technological Threats:
Physical Threats:
Phishing is an attack vector that directly targets users through email, text, and social messages. Attackers use phishing to pose as a legitimate sender and dupe victims into clicking malicious links and attachments or sending them to spoofed websites. This enables them to steal user data, passwords, credit card data, and account numbers.
Ransomware involves attackers blocking or locking access to data then demanding a fee to restore access. Hackers typically take control of users’ devices and threaten to corrupt, delete, or publish their information unless they pay the ransom fee.
Each ransom attack has to be handled differently. For example, while it’s always a good idea to contact authorities, in some cases, you may be able to find a decryption key on your own, or your cybersecurity insurance policy may provide you with a financial parachute.
A denial-of-service (DoS) attack involves attackers flooding a server with internet traffic to prevent access to websites and services. Some attacks are financially motivated, while others are launched by disgruntled employees.
Viruses are one of the most common forms of malware. They quickly spread through computer systems to affect performance, corrupt files, and prevent users from accessing the device. Attackers embed malicious code within clean code, often inside an executable file, and wait for users to execute it.
To prevent viruses from spreading, it’s important to educate employees regarding which kind of files they should and should not download on their computers but while connected to your network. For example, some companies choose to discourage employees from downloading files with .exe extensions.
Trojan horses appear as legitimate software, which ensures they are frequently accepted onto users’ devices. Trojans create backdoors that allow other malware to access the device. Because Trojans can be very hard to distinguish from legitimate software, it’s sometimes best to prevent employees from installing any kind of software on their computers without guidance.
Spyware hides on a computer to track user activity and collect information without their knowledge. This allows attackers to collect sensitive data, such as credit card information, login credentials, and passwords. Spyware can also be used to identify the kinds of files that hackers hunt for while committing corporate espionage. By using automation to pinpoint their cyber bounty, attackers can streamline the process of breaching your network, only targeting the segments where they’ve located valuable information.
7. Adware
Adware results in unwanted adverts appearing on the user’s screen, typically when they attempt to use a web browser. Adware is often attached to other applications or software, enabling it to install onto a device when users install the legitimate program. Adware is especially insipid because many employees don’t realize how serious it is, seeing it as a mere annoyance as opposed to a real threat. But clicking on the wrong adware can introduce damaging malware to your system.
A botnet is a network of devices that have been hijacked by a cyber-criminal, who uses it to launch mass attacks, commit data theft, spread malware, and crash servers. One of the most common uses of botnets is to execute a distributed denial-of-service (DDoS) attack, where each computer in the botnet makes false requests to a server, overwhelming it and preventing legitimate requests from going through.
9. SQL injection
Structured Query Language (SQL) injection is used to exploit vulnerabilities in an application’s database. An attack requires the form to allow user-generated SQL to query the database directly. Cyber criminals launch an attack by inserting code into form fields to exploit vulnerabilities in code patterns. If the vulnerability is shared across the application, it can affect every website that uses the same code.
A MITM attack happens when attackers exploit weak web-based protocols to steal data. It enables them to snoop on conversations, steal data being shared between people, impersonate employees, launch bots that generate messages, and even spoof entire communications systems.
https://www.breachsense.com/blog/equifax-data-breach/
https://medium.com/thedeephub/complete-case-study-target-data-breach-2-ba4bb365a82e
