M1 - Cybersecurity Threats and Attacks

Cybersecurity Threats and Attacks

• Cybersecurity protects an organization's IT infrastructure and data from malicious actors through technology, internal controls, and best practices.

Threat Agents

• Attacker/Hacker: Individuals seeking unauthorized access.
• Adversary: Motivated to attack due to conflict or incentive.
• Government/State-Sponsored: Funded by nation-states.
• Hacktivist: Driven by social or political causes.
• Insider: Someone with authorized access to systems.
• External Threats: Attacks originating outside the organization.

Cyberattack Types

• Network-Based Attacks: Exploit network infrastructure.
  • Backdoors/Trapdoors: Secret access points.
  • Covert Channels: Non-intended data transmission methods.
  • Buffer Overflows: Injecting malicious code by exceeding buffer capacity.
  • Denial-of-Service (DoS): Overwhelm a system with traffic.
  • Distributed Denial-of-Service (DDoS): DoS attacks from multiple sources.
  • Man-in-the-Middle (MITM): Attacker intercepts communication.
  • Replay Attacks: Attacker replays intercepted communications.
  • Port Scanning: Identify open ports.
  • Reverse Shell Attacks: Bypass firewalls.
  • Return-Oriented Attacks: Combine legitimate code sequences.
  • Spoofing: Impersonation (e.g., IP, MAC, DNS, hyperlink).
• Application-Based Attacks: Target application vulnerabilities.
  • SQL Injection: Inject malicious SQL code into applications.
  • Cross-Site Scripting (XSS): Inject malicious scripts into websites.
  • Race Condition: Exploit timing vulnerabilities.
  • Mobile Code (Malicious): Self-replicating from computer to computer.
• Host-Based Attacks: Target a single host.
  • Brute-Force Attacks: Systematically try passwords.
  • Keystroke Logging: Record keystrokes.
  • Malware: Unauthorized software (viruses, worms, Trojans, adware, spyware).
  • Rogue Mobile Apps: Malicious applications disguised as legitimate ones.
• Social Engineering Attacks: Exploit human psychology.
  • Phishing: Deceptive emails/messages.
  • Spear Phishing: Targeted phishing attacks.
  • Business Email Compromise (BEC): Targets executives.
  • Pretexting: Create a fake scenario.
  • Vishing: Phishing over the phone.
• Physical (On-Premises) Attacks: Exploit physical access.
  • Piggybacking: Following someone into a restricted area.
  • Tampering: Physically altering equipment.
  • Theft: Unauthorized removal of assets.
• Supply Chain Attacks: Exploit vulnerabilities in the supply chain.
  • Embedded Software Code: Malicious software within hardware/software.
  • Foreign-Sourced Attacks: Malicious code disguised as legitimate products.
  • Watering Hole Attacks: Target websites used by multiple organizations.

Cyberattack Stages

• Reconnaissance: Gathering information.
• Gaining Access: Entering the target system.
• Privilege Escalation: Increasing access level.
• Maintaining Access: Staying in the system.
• Network Exploitation and Exfiltration: Malicious activity.
• Covering Tracks: Hiding the attack.

Risks in Different Technologies

• Cloud Computing: Additional exposure, malware, compliance violations, data/control loss, visibility loss, multi-cloud management, intellectual property theft.
• Mobile Technologies: Malware, lack of updates/encryption, physical threats, unsecured Wi-Fi, location tracking.
• Internet of Things (IoT): Device mismanagement, spoofing, escalated cyberattacks, expanded footprint, information theft, outdated firmware, malware, network attacks.

Threat Modeling Methodologies

• PASTA (Process for Attack Simulation and Threat Analysis): Define objectives, scope, decomposition, threat/vulnerability analysis, attack modeling/simulation, and risk analysis.
• VAST (Visual, Agile, and Simple Threat): Flexible model for scaling threat analysis.
• STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial-of-Service, Elevation of Privilege): Categorizes various threats.