Information Security Management: Module 2
Security Incidents and Attacks
Learn about the different types of cyberattacks.
Estimated reading time
10 minutes
Security incidents and attacks
A security incident happens when a threat exploits a vulnerability and information assets are impacted in the process. Security incidents become considered "attacks" when human action is the cause. Attackers are people who intentionally exploit vulnerabilities gain access to the assets in question. A security incident or attack is damaging if at least one of the security goals of an information asset is violated.
Attack types
There are two kinds of attacks: passive and active.
In a passive attack, the attacker does not alter the asset. They only view or listen to the asset. Thus, it is hard to identify if this incident has occurred, and the most common security goal violated by this attack is confidentiality. Attackers commit an active attack when they modify, falsify or copy the information that they are not meant to access.
Types of passive attacks
According to Liu, eavesdropping is listening to other people's conversations without their consent, and information is gathered from either the content or the people involved in the conversation. Wiretapping is the act of eavesdropping over a telephone network, and is harder to detect in wireless networks.
Shoulder surfing is like eavesdropping but done with observation instead of listening; this is the act of looking at others' screens without consent. Attackers who commit shoulder surfing attempt to gain access to credentials such as a user's PIN or password, but could be use for other types of data such as a user's personal details.
Network monitoring is when attackers tap into the network to gain knowledge of confidential information.
Types of active attacks
A denial of service (DoS) attack prevents authorised users from accessing the information that they have permission for. Attackers would corrupt the file, sever the communication between the user and the system or even crashing the service by sending many requests. A distributed denial of service (DDoS) works similarly, but multiple attackers or machines attempt make the system deny legitimate requests from authorised users. While both of these attacks do not involve altering data in some way, it does tamper with the system's availability, which can be traced or detected by the system itself.
Spoofing is when an attacker assumes to be a different entity in order to trick others into giving the attacker their information or credentials. Some common spoofing attacks are caller ID spoofing, email spoofing and webpage spoofing. Social engineering is when attackers simulate social situations to allow people to reveal information to them or let attackers access resources. They can claim to be someone they know, such as a family member or a coworker, and ask the victim for information.
Phishing is a method that combines spoofing and social engineering. It involves the attacker starting communication with their victim while pretending to be an authorised entity. They would also pressure the victim into acting on their communicated requests immediately either with a consequence or a reward. For example, an attacker would send an email pretending to be tech support and threaten the user to lock up their account if they do not fulfil a payment.
Pharming is an attack that involves redirecting users to a spoofed website so that attackers can steal their data. The attacker injects malicious code to the target's computer which sends the user to a website that tricks them into disclosing their credentials to the attacker.
Cross-site scripting (XSS) is when attackers insert malicious code in browsers, web pages or even input boxes, so that when a user interacts with the website, it downloads malware on the user's machine. Another similar attack is SQL injection. Malicious queries or SQL scripts are inserted in databases or inputs so that when the code runs, it alters the information in the target database.
A man-in-the-middle (MITM) attack happens when an attacker intervenes in the middle of a conversation. The people in the conversation would believe that they are talking to one another, when in fact, the attacker is talking to both of them separately. In this way, the attacker seizes control of the conversation.
A replay attack happens when the attacker records a certain information or credential from an authorised user, and uses that information to allow the attacker to access it. The attacker may not know what the exact credentials are, and can simply record and replicate the encrypted value.