Information System Attack Methods for ISOKA SYS Exam

Importance in ISACA CISA Exam

  • Crucial topic for Domain Five: Protection of Information Assets.

  • Focus on different types of attacks and prevention methods.

Types of Attacks
Man-in-the-Middle (MitM) Attacks

  • Definition: Interception of communications between two parties.

  • Variants:

    • IP Spoofing: Masking source IP.

    • DNS Spoofing: Altering DNS records.

    • Email Hijacking: Unauthorized email account access.

  • Prevention: Strong encryption, VPNs, EDR tools.

Denial of Service (DoS) Attacks

  • Definition: Aims to make a system or service unavailable.

  • Effect: System crashes, slow legitimate requests.

  • Types:

    • Volume-Based: e.g., UDP floods.

    • SYN Attacks: Exploits TCP handshake.

    • Protocol Attacks: Targets network protocol weaknesses.

    • Application Layer Attacks: Targets specific applications.

Phishing Attacks

  • Definition: Malicious attempts to gather personal information by masquerading as a trustworthy entity.

  • Types:

    • Spear Phishing: Targeted emails.

    • Whaling: Phishing high-profile targets.

    • Smishing: Phishing via SMS.

SQL Injection Attacks

  • Definition: Attacks SQL databases by injecting malicious queries.

  • Aim: Manipulate SQL queries for unauthorized access (e.g., username/password lists).

  • Prevention: Validation and sanitization of input.

Cross-Site Scripting (XSS) Attacks

  • Definition: Malicious scripts injected into trusted websites.

  • Mechanism: Executes script in user's browser, potentially stealing info.

  • Prevention: Input sanitization and data validation in web applications.

Malware

  • Definition: Malicious software designed to disrupt, damage, or gain unauthorized access.

  • Types:

    • Viruses: Self-replicating programs.

    • Worms: Standalone, replicates across networks.

    • Trojans: Disguised as legitimate software.

    • Ransomware: Demands ransom for data release.

    • Spyware: Collects user information without consent.

    • Nuisanceware: Annoying software.

  • Prevention: Anti-virus, next-gen AV, EDR, regular updates and patching.

Zero-Day Attacks

  • Definition: Exploits occurring on the first day an attack is known, no patches available.

  • Challenges: Difficult to protect due to unknown nature.

  • Prevention: Patching (post-discovery), EDR tools, anomaly detection, sandboxing.

Insider Threats

  • Definition: Security risks from individuals within an organization.

  • Difficulty: Hard to detect due to legitimate access.

  • Categories:

    • Malicious insiders: Intentionally cause harm.

    • Negligent insiders: Risk from careless actions.

    • Compromised users: Unknowingly used by attackers.

  • Solution: Network segmentation, separation of duties, internal firewalls, continuous monitoring.

Key Concepts for SIS Exam

  • Understand the attack lifecycle:

    • Reconnaissance: Gather intelligence.

    • Scanning: Identify hosts, open ports.

    • Gaining Access: Exploit vulnerabilities.

    • Maintaining Access: Ensure continued access.

    • Covering Tracks: Erase evidence.

  • Familiarity with the Lockheed Martin Cyber Kill Chain.

  • Know how to identify and assess vulnerabilities.

  • Understand defense in depth, common attack vectors, evaluate security controls, and incident response.