10 Common Cyber Attacks and How They Target Systems

How do phishing attacks differ from social engineering tactics?

Phishing serves as a specific digital delivery method for the broader, psychological strategy of social engineering, which encompasses any manipulative technique used to trick individuals into divulging confidential information.

• Pretexting: A fabricated scenario where an attacker poses as an authority figure, such as an IT administrator, to gain trust.
• Baiting: Leaving a physical USB drive in a lobby, hoping a curious employee plugs it into a networked computer.
• Quid pro quo: Offering a fake service, like a free software update, in exchange for sensitive login credentials.
• Tailgating: Following an authorized person into a restricted physical area to bypass electronic badge readers.

What is the mechanism behind a distributed denial-of-service (DDoS) attack?

A DDoS attack operates by overwhelming a target server or network with a massive volume of traffic, effectively exhausting its resources until it becomes unresponsive to legitimate users. Attackers typically utilize a botnet—a vast collection of compromised devices like home routers or security cameras—to flood the victim with connection requests simultaneously. This distributed approach makes blocking the attack difficult because the traffic originates from thousands of unique, often legitimate, IP addresses across the globe.

A common example involves a volumetric attack where a site is hit with millions of requests per second, causing the server's bandwidth to saturate. One important nuance is that not all traffic spikes are malicious; a legitimate surge in interest, often called the "slashdot effect," can mirror the symptoms of a DDoS attack, forcing administrators to distinguish between genuine user demand and a coordinated botnet assault.

In what ways does ransomware compromise organizational data integrity?

Ransomware destroys data integrity by encrypting files so they cannot be accessed, often modifying the file structure to prevent recovery without a unique decryption key.

1. Infiltration: The malware gains entry, often through a malicious email attachment or an unpatched remote desktop vulnerability.
2. Exfiltration: Before locking files, the attackers copy sensitive data to their own servers to increase leverage.
3. Encryption: The software runs a script to scramble local and network-attached files using high-grade AES-256 encryption.
4. Demand: A text file is dropped in every folder, providing instructions on how to pay a ransom in cryptocurrency.
5. Deletion: Some variants delete shadow copies or backups to make sure the victim has no path to recovery.

What are the primary indicators of a man-in-the-middle (MitM) intrusion?

Man-in-the-middle intrusions are characterized by the unauthorized interception of communication between two parties, often signaled by subtle anomalies in network traffic or security certificates.

• Latency: A sudden, unexplained delay in data transmission that occurs because the attacker is inspecting and forwarding packets in real time.
• Certificates: Browser warnings indicating that a site's SSL/TLS certificate is invalid or does not match the expected domain name.
• Redirects: Users being unexpectedly sent to a different URL or seeing content that looks slightly altered from the expected version.
• Connections: Unrecognized devices appearing in the list of active sessions on a wireless router or corporate VPN gateway.

How do zero-day exploits jeopardize software security protocols?

Zero-day exploits jeopardize security by targeting software vulnerabilities that are unknown to the vendor, leaving users with no official patch or defense mechanism. Because the flaw is undocumented, signature-based antivirus software cannot detect the malicious code, allowing attackers to gain unauthorized access or execute arbitrary commands with little resistance. A lot of people assume that zero-days are only used by state-sponsored actors, but these exploits are frequently traded on underground markets and eventually find their way into the toolkits of common cybercriminals looking for easy entry into high-value networks.

What distinguishes SQL injection from cross-site scripting (XSS) vulnerabilities?

SQL injection targets the back-end database by manipulating input fields, while XSS injects malicious scripts directly into web pages viewed by other users. A 2023 study showed that SQL injection remains a top-tier threat, as it can bypass authentication entirely to dump entire database tables.

How can organizations mitigate the risks associated with insider threats?

Mitigating insider threats requires a combination of strict least-privilege access controls and robust behavioral monitoring to detect anomalous activity. Organizations should implement systems that track file access patterns, such as an employee suddenly downloading thousands of sensitive documents outside of their usual job requirements. By limiting access to only the data required for a specific role, the damage an individual can cause is contained, preventing a single compromised or disgruntled user from accessing the entire enterprise network.

One nuance is that not all insider threats are malicious; accidental data leaks caused by human error, such as misconfiguring a cloud storage bucket, are just as damaging as intentional sabotage. Consequently, technical controls must be paired with regular training to make sure that employees understand the security implications of their daily actions, as well as the risks of inadvertently bypassing established security protocols.

What role does malware play in advanced persistent threats (APTs)?

Malware acts as the persistent foothold in APTs, allowing attackers to maintain long-term access to a network. These campaigns often use custom-tailored malware to evade detection for 200 days or more, enabling the silent exfiltration of intellectual property while remaining hidden from standard security monitoring tools.