Threats

Cyber-attacks are ever more frequent and a lot of effort goes into both preventing  and dealing with the consequences when they have happened. 

Understanding the motivation behind attacks can help organisations understand more about the risks they face so that they can tackle them.

The main reasons behind an attack are:

• Financial Gain - targetting sensitive information which can be sold or used for blackmail.
• Data and Information Theft - targetting data which may be valuable, e.g. to a competing business or to another government
• For fun - not motivated by money, but for the thrill of carrying out an attack. Individuals carrying out attacks for fun aim to gain notoriety within their communities
• To disrupt business activity - aiming to disrupt a business to prevent them from providing a service to their customers.
• Personal attacks - driven by personal vendettas against a business or individual. They could be a disgruntled former employee or customer

Malware is Malicious Software that causes damage. Once on a computer they can delete files , change files, copy files, and even encrypt files.

Types of malware

There are many types of malware and one piece of malware can be categorised in many ways:

• Viruses Infects files, and runs when the user operates the file. Will spread to other file. Requires human interaction to spread
• Worms Much like viruses but can self replicate without human interaction.
• Trojan Disguises itself as a different or useful file in order to get a user to download or operate it. 
• Keyloggers Tracks what the user is typing on their keyboard to steal passwords and personal information. 
• Ransomware Locks a computer by encrypting files. Usually shows up a ransom screen demanding money in exchange for access to the locked files.
• Adware After infecting the users computer it displays adverts on the screen using pop-ups, or by injecting them into web pages.

How does malware get onto a computer?

Malware can get infect a computer in numerous different ways including from the user downloading unknown files, downloading e-mail attachments, opening files from external storage, or from other computers on the network. Viruses could also be installed intentionally as well as accidentally.

Anti-malware

Anti-malware software (AKA Antivirus) scans a computers files and any incoming files. The files are compared to a database of virus signatures. If the file matches a signature in the database then it is identified as a virus. Anti-malware software must be kept up to date so that new viruses can be identified.

Sometimes called Man in the Middle attack or Passive attack, the attacker monitors data being sent over a network. The data being sent can be read and it may contain passwords, sensitive information, credit card details etc. Usually the attacker does not modify the data so the victims don’t realise it is happening.

Data interception cannot be prevented however the risks can be mitigated by using encryption to stop the data from being read.

A computer and network could have every possible protection but the most difficult vulnerability to fix is us (humans). Social Engineering is convincing a user to compromise the security of a computer or network For example: Tricking a user to use a USB Flash drive which has a virus or calling someone up to trick them into giving them remote access to a computer. There are four types of Social Engineering: Phishing, Pre-texting, Baiting and Quid Pro Quo

Phishing

Phishing is an example of Social Engineering where the attacker sends out e-mails pretending to be a trustworthy company or person. The e-mail will try to convince the user to click a link and this may lead to a page with a virus download or a website which attempts to trick the user into giving up personal information.

Pre-texting

With Pre-texting, an attacker will manipulate a victim by telling them a story as to why they need to divulge information. The story is used to help the attacker gain the victims trust. Examples:

• Receiving a call from someone at “Microsoft” and requesting login details to fix an account.
• Receiving a text from someone claiming to be a family member with a new telephone number.

Baiting

Baiting is where a hacker will use a false promise to entice a user into giving up information or into installing malware. For example: Leaving USB drives outside buildings in the hope that one will be taken inside and plugged into a computer

Quid Pro Quo

An attacker will offer an exchange often information in exchange for money. Usually the attacker will not pay the victim - remember if an offer seems too good to be true it probably is!

Prevention

The best way to defend against Social Engineering within an organisation is through the use of an Acceptable Use Policy (AUP). The AUP is a document which contains a set of common rules and procedures. Typically within an organisation everyone using IT equipment have to agree to and abide by the AUP.

Hacking is the act of gaining unauthorised access to a computer. A hacker will break in by circumventing security, they may know someones password, or they may have found weaknesses in software that allow them to access the computer.

Once a hacker has access to a computer they will be able to access the data on it as if they were an authorised user.

Hacking may take place remotely or even directly on the computer.

The most common form of hacking is someone simply logging onto a computer with someone elses username and password. This is why it is important to have a strong password that no one else knows.

Most computers and networks are protected by passwords.

A brute force attack is where an attacker guesses usernames and passwords in order to gain unauthorised access to a computer system.

Carrying this out manually using a keyboard to manually enter passwords could take an attacker their entire lifetime to successfully break into a system, however specialist software on powerful hardware is capable of making millions of password guesses every hour. 

This can render weak and common passwords ineffective at protecting systems.

An open network is one that anyone can access, and many open networks let devices connect without a password. That convenience comes at a cost: because the network is open and often unencrypted, the data travelling across it is not protected.

Interception and theft

When data is unencrypted, it travels in a form that anyone on the same network can read. A person sitting nearby with the right software can intercept that traffic and view it. Anything sent in plain text, such as a password typed into a login page, card details entered at an online checkout or a private message, can be captured and then reused to sign into your accounts or spend your money. For example, signing into your email over an open network in a shopping centre could let someone else copy your username and password as you type them. Stolen data has value, so it can also be sold on for financial gain.

Malware

An open network is easy for a malicious user to join, and once they are on it they can introduce malware onto a connected device. If that software installs successfully, it can corrupt files, damage the operating system or give the attacker control of the device and everything stored on it.

Ad hoc networks

An ad hoc network is created directly between devices, so it is open in much the same way and is easier for a hacker to reach. Because no server controls who joins, security is managed by each device individually rather than centrally. Each person has to configure and protect their own device, and there is no single point where an administrator can block intruders or apply rules for everyone. That is why an ad hoc network with no central security is less safe, not more.