Understanding Cyber Security Part 2

This type of threat includes single actors or groups targeting systems and critical infrastructures for financial gain or to cause disruption.

It is an attack launched by cyber criminals using one or more devices against a single or multiple computers or networks. Once successful it can disable systems, steal data, or use a vulnerable asset as a launch point for other attacks. A variety of threats have been used by cyber criminals to launch their attacks, including malware, phishing, ransomware, denial of service, among other methods, which I will be displaying and discussing below.

This type of threat refers to unlawful attacks against electronic systems to intimidate a government or its people and cause panic or fear.

It is a computer program able to copy itself and infect devices without permission or knowledge of the user. It might corrupt or delete data on a device, use e-mail programs to spread itself to other devices, or even delete everything on a hard disk.

It is a program that secretly records actions from a user on his/her device without his/her knowledge, so that cyber criminals can make use of this information (e.g., credit card details, etc.).

It is a software that displays unwanted advertisements on a user device normally in a form of pop-ups. It is also able to change the user browser’s homepage, add spyware and just bombard the user’s device with advertisements.

It is a form of software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This includes a virus, worm, trojan horse, spyware, some forms of adware or other code-based entity that infects an asset.

It is a computer program that appears to be harmless, however it has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program. Cyber criminals trick users into uploading trojan horses on their devices for whatever their purposes are.

It is another form of malware which criminals encrypt an organisation or individual’s data and demand payment (normally through cryptocurrency) to restore the access. Ransomware has become one of the biggest concerns of C-levels from different industries these days, where organisations’ critical data has become unavailable to staff and shared with unauthorised parties when there is no payment.

It is the act of tricking an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud by alluring such individual to gain his/her confidence and trust.

It is a technique used by criminals for attempting to collect sensitive data, such as bank account details, credential details, through a fraudulent request in email or on a web site, in which the criminals masquerade themselves as legitimate business or reputable people.

It is a form of phishing attack that has a highly target user, organisation or business.

Are security breaches or losses caused by employees, third parties or customers. Insider threats can be either malicious or negligent in nature.

It is a form of threat where attackers make use of a great number of hosts (which are mostly infected) with the intention to disrupt the traffic of a targeted system, such as a server, website or other network resource. Such thing occurs by flooding the target with messages, connection requests or packets, which will slow down the target or make it unavailable, preventing legitimate connections through its use.

APTs are prolonged attacks involving sophisticated levels of expertise and significant resources in which a malicious actor infiltrates into a network and remains undetected for long periods of time with the intention to steal companies’ data, adapting to protect itself from an organisation’s efforts to resist to it, and with the determination to maintain the level of interaction needed to execute its objectives.

It is a threat where the attacker positions himself/herself in between the user and the system so that he/she can intercept and alter data transmitted between them.

It is a form of attack that exploits a previously unknown hardware, firmware, or software vulnerability.

Vishing is a form of scam (e.g., phone call or voicemail) that appears to be from a trusted source, but in fact it isn’t. The main purpose of the attack is to steal someone’s identity or money via phone calls or voicemails. 

Smishing is a form of scam (e.g., SMS text or direct-chat message) that appears to be from a trusted source, but in fact it isn’t. The main purpose of the attack is to steal someone’s identity or money via SMS messages or direct-chat messages. 

Botnet is the combination of the word robot and network. Malicious actors have been using trojan viruses to breach the security of several users’ devices, take control of them, and organize all the infected devices into a network of “bots” that can be managed remotely by the criminal to launch attacks.