Cybersecurity Concepts

Cybersecurity

The practice of protecting an organization's IT infrastructure and critical data from bad actors by deploying a variety of technologies, internal control processes, and best practices to mitigate the business impact of these attacks

Cyberattack

Any kind of malicious activity that targets computer information systems, infrastructures, computer networks, or personal computer devices, and attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.

APTs (advanced persistent threats)

These are individuals, or groups of individuals known as hacking rings, that target people or organizations to gain access to systems, networks, and data.

Adversary

These are actors with interests in conflict with the organization. They are incentivized to perform malicious actions against the organization's cyber resources such as intercepting purchases, theft of data, tampering with hardware prior to installation, social engineering attacks, and more.

Government-sponsored Actors

These threat actors are funded, directed, or sponsored by nations. They've been known to steal and exfiltrate intellectual property, sensitive information, and even funds to further their nations' espionage causes.

Hacktivists

These are usually groups of hackers that operate to promote certain social causes or political agendas.

Insiders

Employees that either organically developed into a person with malicious intentions or intentionally infiltrated an organization to achieve nefarious objectives.

External Threats

Threats that occur from outside of the organization, entity, or individual that is the target of the cyberattack.

Network-Based Attacks

These attacks target the infrastructure of a network, including switches, routers, servers, and cabling, with the intent to gain unauthorized access or disrupt operations for users.

Backdoors and Trapdoors

These are methods to bypass security access procedures by creating an entry and exit point to a network that is undocumented. Trapdoors are often installed by system owners so they can bypass security measures to gain quick access, whereas backdoors may be intentionally installed or unintentionally left available due to product defects.

Covert Channels

These are mechanisms used to transmit data using methods not originally intended for data transmission by the system designers. These channels violate the entity's security policy but do not exceed the entity's access authorization, so they can communicate data in small parts.

Storage Channels

Data is transmitted by modifying a storage location, allowing another party with lower security permission to access the data.

Timing Channels

The delay (or gap) in transmitting data packets is used to hide a transmission.

Buffer Overflows

Attackers overload a program's buffer, the temporary storage, with more input than it is designed to hold. This may cause the program to overwrite the memory of an application or crash. The attacker can then inject malicious code or take control of a system.

DOS (Denial-of-Service)

An attacker floods a system's network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle. This excess volume consumes the network's resources so that it cannot respond to service requests, leaving it vulnerable to network protocol or application exploitation.

DDOS (Distributed Denial-of-Service Attacks)

These occur when multiple attackers or compromised devices are working in unison to flood an organization's network with traffic. These attacks manipulate the operation of network equipment and services in such a way that they may be more powerful than a traditional DoS attack.

MITM (Man-in-the-Middle Attacks)

The attacker acts as an intermediary between two parties intercepting communications, acting as a legitimate entity within a typical secure session. As information is passed between the two parties, the attacker can read or redirect traffic.

Port Scanning Attacks

Scanning networks for open ports is frequently done by attackers to find vulnerabilities that can be exploited so that they can gain unauthorized access to a company's network.

Ransomware Attacks

These are attacks that typically come in the form of malware that locks a user or a company's operating systems, applications, and the ability to access data unless a ransom is paid.

Reverse Shell Attacks

Also referred to as connect-back shells. A victim initiates communication with an attacker from behind a company's firewall so that the attacker can bypass the firewall and any other network safeguards and remotely control the victim's machine. Since the original contact is not established from outside of the company's network, normal filtering and firewall protection are bypassed.

Replay Attacks (Eavesdropping)

These are a type of MITM attack in which a cybercriminal eavesdrops on a secure network communication, intercepts it, and then replays the message at a later time to the intended target to gain access to the network and the data that is behind the firewall.

Return-Oriented Attacks

Also known as return-oriented programming attacks, these use a sophisticated technique that utilizes pieces of legitimate original system code (each a gadget) in a sequence to perform operations useful to the attacker. Each gadget ends with a "return" instruction, causing the next gadget to execute and carry out complex operations.

Spoofing

The act of impersonating someone or something to obtain unauthorized system access by using falsified credentials or imitating a legitimate person or entity by using fake IP addresses, domains, or email addresses.

ARS (Address Resolution Spoofing)

This spoofing attack involves a fraudulent act of falsifying the mapping of media access control (MAC) addresses on a network to IP addresses. All devices on a network have MAC addresses that map to IP addresses. The attacker links its MAC address with the target's IP addresses so that devices can communicate with each other point to point (IP address to IP address). Fraudsters can channel messages to alternate destinations.

DNS Spoofing

A spoofing attack that involves a perpetrator modifying the domain-name-to-IP-address mapping. A company's DNS server translates domain names to IP addresses.

Hyperlink Spoofing

The alteration of hyperlink URLs that redirect the victim away from their intended destination and send them to a nefarious location.

Application-Based Attacks

These forms of attacks target specific software or applications (desktop or web) such as databases or websites to gain unauthorized access or disrupt functionality.

SQL Injection

An application attack in which an attacker injects malicious SQL code into existing SQL code on a company's website to gain unauthorized access to a company's data.

XSS (Cross-Site Scripting)

Similar to an SQL injection, but these attacks inject code to a company's website that attacks users visiting the company's website. When a user visits the site, the user's browser executes the malicious code and performs the attack, which may compromise the user's data, such as usernames, passwords, and other sensitive information.

Race Condition

An attacker exploits a system or application that relies on a specific sequence of operations. By forcing the application to perform two or more operations out of order or simultaneously, an attacker may gain unauthorized access or execute a fraudulent act.

Mobile Code

Any software program designed to move from computer to computer to infect other applications by altering them in some way to include a version of the code.

Overwrite Virus

These viruses delete or overwrite information in the infected file. Typically, removal of the virus requires deletion of the file.

Multi-Partite Virus

This type of virus uses a mixture of infection methods to infect files, trying different ways to infect a file if others fail.

Parasitic Virus

These viruses launch when an application that has the virus launches and the same rights held by the program being launched are given to the virus.

Polymorphic Virus

This form of virus mutates by changing its structure so that it can avoid detection.

Resident Virus

These viruses install a copy of themselves on a computer's memory.

Dictionary Attack

This is a method of breaking into a password-protected system by systematically entering every word in the dictionary as a password.

Host-Based Attacks

These attacks target a single host such as a laptop, mobile device, or a server to disrupt functionality or obtain unauthorized access.

Brute Force Attacks

These are password-cracking schemes in which attackers use an automated program that attempts to guess a password.

Keystroke Logging

Keystroke logging is a scheme involving tracking the sequence of keys pressed by a user on a keyboard to collect confidential data such as usernames, passwords, and personal information. These are often delivered as Trojan horses.

Malware

Malware is software or firmware intended to perform an unauthorized process that has an adverse impact on the confidentiality, integrity, or availability of an information system. Common examples are viruses, worms, Trojan horses, adware, spyware, and other code-based programs that infect a host.

Rogue Mobile Apps

These attacks involve the use of a malicious app that appears legitimate. A fraudulent party creates a mobile application that is installed by a victim unsuspectingly and that app then steals information, gives the attacker unauthorized access, or executes some other malicious act.

Social Engineering Attacks

These attacks involve the use of psychological manipulation or deception to get employees to divulge sensitive information, provide unauthorized access, or assist an attacker in committing fraud.

Phising

A form of digital social engineering that uses authentic looking— but bogus—emails that request information from users or direct them to a fake website that requests information.

Spear Phishing

This form of phishing targets employees in a corporate entity by posing as a legitimate department or employee, such as human resources or the IT director. The goal is to obtain confidential information such as usernames, passwords, or personal data that can be used for exploitation.

BEC (Business Email Compromise)

This is a form of phishing that targets executives and other high-ranking individuals. It typically involves schemes to get the executive to transfer money through a wire, pay fake foreign suppliers, or send sensitive data to someone impersonating an attorney or other employee. This scheme has also been called whaling.

Pretexting

This attack is similar to BEC and spear phishing, but it involves creating a fake identity or scenario so that the employee has a sense of urgency to act. By using this form of pretext, or false reason, the attacker is able to obtain sensitive information or manipulate the victim into performing some other fraudulent act.

Catfishing

This scheme involves the creation of a fake online persona that is used to lure a victim into a personal relationship with a fraudster. The person conducting the scheme then appeals to the emotional nature of the victim and requests money, gifts, or other items of value.

Pharming

This attack is often used in combination with phishing as it involves a victim entering personal information into a website or portal that imitates a legitimate website. The link to the fraudulent site may be in a phishing email.

Vishing

This technique involves fraudulent schemes using the telephonic system Voice over Internet Protocol (VoIP). Schemes normally involve a spoofed or fraudulent caller ID that is tied to a legitimate business or person. Attackers often use incoming recorded messages that may be interactive and use key tones or voice recognition to convert information input by the victim into numbers or letters.

Typosquatting

This is a form of cybercrime where attackers register domain names that are similar to legitimate websites but contain common typographical errors that users might make when entering URLs. This allows attackers to capture traffic from users who mistype website addresses.

Physical Attacks

This is a security breach carried out on an organization's premises or performed in some way that physically involves a bad actor gaining control of sensitive data, hardware, and/or software.

Intercepting Discarded Equipment

By obtaining access to outdated or discarded equipment in the trash or through companies that accept discarded equipment, fraudsters can steal sensitive data stored on such devices.

Piggybacking

This method of attack involves an attacker using an authorized person's access to gain entrance to a physical location or electronic access.

Targeted by Attackers

On-premises infrastructures are often targets of hacking groups or attackers because they know that many organizations lack sophisticated cybersecurity defenses.

Tampering

This involves gaining physical access to a company's IT infrastructure and modifying the way its network collects, stores, processes, or transmits data.

Theft

This refers to the act of physically stealing data, hardware, or software.

Supply Chain Attacks

These attacks use cyber tactics to target the production and distribution of goods within a supply chain so that there are larger disruptions in the normal operations of a company, government, or other entity.

Embedded Software Code

This form of attack involves inserting code into prepackaged software or firmware being sold to a company that later installs the software after purchase.

Foreign-Sourced Attacks

In many countries, governments have deep and widespread control of companies in the private sector. Those governments may use products sold to other countries to conduct surveillance or deliver malicious code.

Preinstalled Malware on Hardware

This method of attack involves installing malware on devices that will be used by companies in a supply chain, such as USB drives, cameras, or phones. Once the company acquiring the devices connects them to the company's network, the malware executes.

Vendor Attacks

This attack is perpetrated upon key vendors of a target company so that the normal production of goods or business operations is disrupted.

Watering Hole Attacks

In this method of attack, fraudsters identify websites of suppliers, customers, or regulatory entities that are known to be used by several companies or even entire industries. The attackers then look for weaknesses at that third party that can be used to deliver malware, steal data, or obtain unauthorized access.

Reconnaissance

In this first stage, attackers discover and collect as much information about the target IT system as possible. Information obtained may include the location of facilities, the type of network and infrastructure deployed, security measures in place, and the names of employees as well as the management hierarchy. During this phase, attackers may also search for specific vulnerabilities

Gaining Access

This is the step in a cyberattack when the information collected in the previous steps is used to gain access to the target of an attack using a variety of techniques.

Escalation of Privileges

Once unauthorized access into a system is obtained, attackers attempt to gain higher levels of access in this stage. This may be done by obtaining the credentials of a user with higher privileges.

Maintaining Access

In this stage, the attacker remains in the system for a sustained period of time until the attack is completed and looks for alternative ways to prolong access or return later.

Network Exploitation and Exfiltration

In this stage, attackers proceed with the objective of disrupting system operations by stealing sensitive data, modifying data, disabling access to systems or data, or performing other malicious activities.

Covering Tracks

This step occurs while the attack is in progress or after the attack is completed and involves the attacker concealing the entry or exit points in which access was breached.

Application Malware

This threat occurs when a user downloads an application that appears to be legitimate but gives an unauthorized user access to the device. For example, when a user visits a site, malware could be installed that steals private information without the user's knowledge.

Location Tracking

Unauthorized tracking is a risk that involves a threat actor using Global Positioning System (GPS) technology to locate people, devices, or other assets. With this knowledge, attackers can devise plans that use the victim's location to perpetrate an attack.

Device Mismanagement

Insufficient password controls and device mismanagement can increase the risk of a cyberattack. This can lead to the loss of critical information or access to the devices on the IoT network.

Device Spoofing

This is when an attacker connects illegitimate devices to a company network to gain information or perform unauthorized activities. Illegitimate devices may include phony devices or standard devices being modified for malicious attack.

Escalated Cyberattacks

IoT devices can be used as an attack base to infect more machines, or as an entry point for access into a connected network.

Expanded Footprint

IoT devices paired with other devices that are directly connected to a company's core network expand the footprint of total devices under a company's purview, thus increasing the number of points subjected to attack.

PASTA

Model has seven stages that focus on risks and countermeasures that are prioritized by the value of the assets being protected. The seven stages are

VAST

Model is based on the Agile project management methodology. Its goal is to integrate threat management into a programming environment on a scalable basis.