Becker - ISC Cyberattack Flashcards

Cybersecurity

The practice of protecting an organization’s IT infrastructure and critical data from bad actors by deploying a variety of technologies, internal control processes, and best practices to mitigate the business impact of attacks

Data Breach

When information is compromised and utilized without the authorization of the owner

Examples include ransomware, phishing, malware, and compromised passwords

Service Disruptions

An unplanned event that causes the general system or major application to be inoperable for an unacceptable length of time

Examples include malware, DDoS attacks, SQL injections, and password attacks

Cyberattack

Any type of malicious activity that targets computer information systems, infrastructures, computer networks, or personal computer devices, and attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself

Threat Agent

An internal or external attacker that could negatively impact data security through theft, manipulation, or control of sensitive information or systems

Examples include an attacker, threat actor, or hacker

Adversary

Actors with interests in conflict with the organization

They are incentivized to perform malicious actions against the organization’s cyber resources such as intercepting purchases, theft of data, tampering with hardware prior to installation, social engineering attacks, and more

Network-Based Attacks

Type of cyberattack in which the goal is to gain unauthorized access or disrupt operations for users

Infrastructure of a network is targeted, including switches, routers, servers, and cabling

Backdoors (Trapdoors)

Methods to bypass security access procedures by creating an entry and exit point to a network that is undocumented

Often installed by system owners so they can bypass security measures to gain quick access

May be intentionally installed or unintentionally left available to product defects

Covert Channels

Mechanisms used to transmit data using methods not originally intended for data transmission by the system designers

Violate the entity’s security policy but do not exceed the entity’s access authorization, so they can communicate data in small parts

Two types: storage and timing channels

Storage Channel

Type of covert channel in which data is transmitted by modifying a storage location, allowing another party with lower security permission to access the data

Timing Channel

Type of covert channel in which the delay (or gaps) in transmitting data packets is used to hide the transmission

Buffer Overflows

Type of network-based cyberattack in which attackers overload a program’s buffer, the temporary storage, with more input than it is designed to hold

May cause the program to overwrite the memory of an application or crash

The attacker can then inject malicious code or take control of a system

Denial-of-Service (DoS) Attacks

Type of network-based cyberattack in which an attacker floods a system’s network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle

This excess volume consumes the network’s resources so that it cannot respond to service requests, leaving it vulnerable to network protocol or application exploitation

Distributed Denial-of-Service (DDoS) Attacks

When multiple attackers or compromised devices are working in unison to flood an organization’s network with traffic

These network-based cyberattacks manipulate the operation of network equipment and services in such a way that may be more powerful than a traditional DoS attack

Man-in-the-Middle (MITM) Attacks

Type of network-based cyberattack in which the attacker acts as an intermediary between two parties intercepting communications, acting as a legitimate entity within a typical secure session

As information is passed between the two parties, the attacker can read or redirect traffic

Port Scanning Attacks

Attackers scan networks for open ports to find vulnerabilities that can be exploited so that they can gain unauthorized access to a company’s network

This network-based cyberattack focuses on logical ports that are used for protocols such as TCP port 80, which is one of the most common ports used on the internet

Ransomware Attack

Type of network-based cyberattack that typically comes in the form of malware that locks a user or company’s operating systems, applications, and the ability to access data until a ransom is paid

Reverse Shell Attack

Type of network-based cyberattack in which a victim initiates communication with an attacker from behind a company's firewall so that the attacker can bypass the firewall and any other network safeguards and remotely control the victim’s machine

Replay Attack

A type of MITM cyberattack (network-based) in which a cybercriminal eavesdrops on a secure network communication, intercepts it, and then “replays” the message at a later time to the intended target to gain access to the network and the data that is behind the firewall

Return-Oriented Attack

Type of network-based cyberattack that uses a sophisticated technique that utilizes pieces of legitimate original system code (each a gadget) in a sequence to perform operations useful to the attacker

Each gadget ends with a “return” instruction causing a series of code to execute and carry out complex operations

Spoofing

The act of impersonating someone or something to obtain unauthorized system access by using falsified credentials or imitating a legitimate person or entity by using fake IP addresses, domains, or email addresses

Type of network-based cyberattack

Application-Based Attacks

Type of cyberattack that targets specific software or applications (desktop or web) such as databases or websites to gain unauthorized access or disrupt functionality

SQL Injection

Type of application-based cyberattack in which an attacker injects malicious SQL code into existing SQL code on a company’s website to gain unauthorized access to a company’s data

Cross-Site Scripting (XSS)

Type of application-based cyberattack in which the attacker injects code to a company’s website that attacks users visiting the company’s website

Race Condition

Type of application-based cyberattack in which an attacker exploits a system or application that relies on a specific sequence of operations

Mobile Code

Type of application-based cyberattack in which a software program is designed to move from computer to computer to “infect” other applications by altering them in some way to include a version of the code

Overwrite Virus

Type of virus that deletes or overwrites information in the file infected

Multi-Partite Virus

Type of virus that uses a mixture of infection methods to infect files, trying different ways to infect a file if others fail

Parasitic Virus

Type of virus that launches when an application that has the virus launches and the same rights as the program being launched are given to the virus

Polymorphic Virus

Type of virus that mutates by changing its structure so that it can avoid detection

Resident Virus

Type of virus that installs a copy of itself on a computer’s memory

Host-Based Attack

Type of cyberattack that targets a single host such as a laptop, mobile device, or a server to disrupt functionality or obtain unauthorized access

Brute Force Attack

Type of host-based cyberattack that is a password-cracking scheme in which an attacker uses an automated program that attempts to guess a password

The program tries all possible combinations of potential passwords based on a preset algorithm

Keystroke Logging

Type of host-based cyberattack in which the attacker tracks the sequence of keys pressed by a user on a keyboard to collect confidential data such as usernames, passwords, and personal information

Malware

Software or firmware intended to perform an unauthorized process that has an adverse impact on the confidentiality, integrity, or availability of an information system

Common examples are viruses, worms, Trojan horses, adware, spyware, and other code-based programs that infect a host

Rogue Mobile Apps

Type of host-based cyberattack that involves the use of a malicious app that appears legitimate

A fraudulent party creates a mobile application that is installed by a victim unsuspectingly and that app then steals information, gives the attacker unauthorized access, or executes some other malicious act

Social Engineering Attack

Type of cyberattack that involves the use of psychological manipulation or deception to get employees to divulge sensitive information, provide unauthorized access, or assist an attacker in committing fraud

Phishing

Type of social engineering cyberattack in which the attacker uses authentic looking, but bogus, emails that request information from users or direct them to a fake website that requests information

Spear Phishing

Form of phishing that targets employees in a corporate entity by posing as a legitimate department or employee, such as human resources or the IT director

The goal is to obtain confidential information such as usernames, passwords, or personal data that can be used for exploitation

Business Email Compromise (BEC)

Type of social engineering cyberattack in which the attacker targets executives and other high-ranking individuals

Form of phishing

Pretexting

Type of social engineering cyberattack in which the attacker creates a fake identity or scenario so that the employee has a sense of urgency to act

Similar to BEC and spear phishing

Catfishing

Type of social engineering cyberattack in which the attacker creates a fake online persona that is used to lure a victim into a personal relationship with a fraudster

Pharming

Type of social engineering cyberattack in which a victim enters personal information into a website or portal that imitates a legitimate website

Often used in combination with phishing

Vishing

Type of social engineering cyberattack in which the attacker uses the telephonic system Voice over Internet Protocol (VoIP)

Normally involves a spoofed or fraudulent caller ID that is tied to a legitimate business or person

Physical (On-Premises) Attack

Type of cyberattack that is a security breach carried out on an organization’s premises or performed in some way that physically involves a bad actor gaining control of sensitive data, hardware, and/or software

Intercepting Discarded Equipment

Type of physical cyberattack in which fraudsters obtain access to outdated or discarded equipment in the trash or through companies that accept discarded equipment and steal sensitive data stored on such devices

Piggybacking

Type of physical cyberattack in which the attacker uses an authorized person’s access to gain entrance to a physical location or electronic access

Tampering

Type of physical cyberattack in which the attacker gains physical access to a company’s IT infrastructure and modifies the way its network collects, stores, processes, or transmits data

Theft

Type of physical cyberattack in which the attacker physically steals data, hardware, or software

Supply Chain Attack

Type of cyberattack that targets the production and distribution of goods within a supply chain so that there are larger disruptions in the normal operations of a company, government, or other entity

Embedded Software Code

Type of supply chain cyberattack in which the attacker inserts code into prepackaged software or firmware being sold to a company that later installs the software after purchase

Foreign-Sourced Attack

Type of supply chain cyberattack in which governments may use products sold to other countries to conduct surveillance or deliver malicious code

Pre-Installed Malware on Hardware

Type of supply chain cyberattack in which the attacker installs malware on devices that will be used by computers in a supply chain, such as USB drives, cameras, or phones

Vendor Attack

Type of supply chain cyberattack in which the attacker targets key vendors so that the normal production of goods or business operations is disrupted

Watering Hole Attack

Type of supply chain cyberattack in which fraudsters identify websites of suppliers, customers, or regulatory entities that are known to be used by several companies or even entire industries

The attackers then look for weaknesses at that third party that can be used to deliver malware, steal data, or obtain unauthorized access

Reconnaissance

First stage of a cyberattack in which attackers discover and collect as much information about the target IT system as possible

Gaining Access

Second stage of a cyberattack in which the information collected in the previous steps is used to gain access to the target of an attack using a variety of techniques

Escalation of Privileges

Third stage of a cyberattack in which attackers attempt to gain higher levels of access

Maintaining Access

Fourth stage of a cyberattack in which the attacker remains in the system for a sustained period of time until the attack is completed and looks for alternative ways to prolong access or return later

Network Exploitation/Exfiltration

Fifth stage of a cyberattack in which attackers proceed with the objective of disrupting system operations by stealing sensitive data, modifying data, disabling access to systems or data, or performing other malicious activities

Covering Tracks

Sixth and final stage of a cyberattack that occurs while the attack is in progress or after the attack is completed and involves the attacker concealing the entry or exit points in which access was breached

Typosquatting

A form of cybercrime where attackers register domain names that are similar to legitimate websites but contain common typographical errors that users might make when entering URLs

This allows attackers to capture traffic from users who mistype website addresses