According to a cyber security expert, the Oxford Dictionary definition of cyber threat is somewhat outdated: “A malicious attempt to harm or interfere with computer networks and computer systems.” This statement is incomplete without including the potential for damaging or stealing data and disrupting digital operations.
The threat is described as a possibility according to this definition. On the other hand, the threat as it is seen from the point of view of the cyber security community is more closely associated with the actor or adversary who is seeking to access the system. An attacker may be identified by the damage done, what is stolen, or the tactics, techniques and procedures (TTPs) he is using in the process of defacing a computer.
Cyber attacks range from phishing attacks to infrastructure infiltration. As you may know, cyber threats are extensive and they are not discriminatory when it comes to which organisations are targeted vs. which individuals.
Here are the different types of threats:
Backdoors
Generally, back doors are a way to gain remote access to a user’s computer or system without permission from the user.
DDoS Attacks
During a distributed denial-of-service attack (DDoS), systems and servers are flooded so that they cannot handle the requests, and as a result, crash. The attack is designed to disrupt normal internet traffic and take targeted websites offline.
Formjacking
A procedure known as formjacking involves inserting malicious JavaScript code into an online payment form in order to harvest the card information of customers.
DNS Poisoning Attacks
An attack that compromises the DNS (domain name system) to redirect traffic to malicious websites has been called DNS poisoning. The sites that are affected are not themselves hacked.
Cryptojacking
Bitcoinjacking – or cryptocurrency mining software – is maliciously installed on a computer as a means to mine cryptocurrency. This software illegally exploits the victim’s computing power to mine cryptocurrency with their help.
Malware
A wide term used to describe any file or program that has the intention of harming, destroying, or disrupting a computer system is called malware. Malware includes the following.
There is a class of software called botnet software that is designed to infect multiple devices that are connected to the Internet at the same time. It should be noted that some botnets comprise millions of compromised computers, each of which uses only a modest amount of processing power. As a result, you may find it difficult to detect this kind of malware, even when the botnet is running.
Using ransomware, an attacker encrypts the victims’ information and demands that they pay for the key to decrypt it in return for a payment of money. It is important to remember that paying a ransom does not necessarily guarantee that the data you had been encrypted will be recovered.
The RATs (Remote Access Trojans), as the name suggests, are malware that installs backdoors in targeted systems as a means to allow malicious users to access those systems remotely or acquire administrative control.
Rootkits entail a number of malicious payloads, such as keyloggers, RATs, and viruses, which are used by attackers to remotely access targets.
A bootkit is a type of rootkit that has the ability to infect the firmware that initiates the operating system at boot time – the code preceding the operating system.
Spyware can be thought of as a form of malware that is designed to monitor an individual’s computer activity in order to collect personal information.
Known as trojans, Trojan horses are types of malware that pose as legitimate software in order to steal information and then execute destructive behaviour.
Viruses and worms A virus is malicious software installed on a computer without the user’s knowledge. If a virus is attached to a file on other computer, it can replicate itself across other computers and spread to other systems.
In the sense that they self-replicate, worms are similar to viruses. This does not mean that they have to be attached to another program in order to carry out these functions.
A Mitigation Strategy for 'Affect'
During the surveying, delivery and breaching stages, all of the measures must be consistently applied. Otherwise, most attacks making use of commodity abilities are most likely to fail.
If you do not acknowledge that your adversary is capable of using bespoke capabilities, then it must be assumed that they will be able to get into your systems even if you don’t communicate with them. Ideally, you should have a good understanding of what constitutes ‘normal’ activity on your network, and effective security monitoring should be able to identify any unusual activity.
In the event that an attacker has been able to gain full access to your systems, it can be much more difficult for you to detect and eliminate their presence from your systems once they have gained full control over your systems. In such circumstances, a defence-in-depth strategy could potentially prove to be highly successful.
