Forms of Attack

A form of attack is a method used by an attacker to harm a computer system or the data on it. The systems and networks you use hold things worth having — school reports, orders, contact lists, photos — so there is always someone willing to try, and an attacker only needs one way in.

The six forms of attack

Form of attack	In a sentence
Malware	Harmful software installed on a system to steal, damage, lock or delete data, or to take control of a device.
Social engineering, including phishing	Deceiving people into giving away information or access, because people are the weak point in any system.
Brute-force attack	Software trying huge numbers of password combinations until one works, to get into an account, device or network.
Denial of service attack	Flooding a server or service with requests so that genuine users cannot use it.
Data interception and theft	Capturing data as it travels across a network, or stealing a device that holds data.
SQL injection	Typing SQL code into a web form so that a database reads out, changes or deletes records.

Each form has its own giveaway: software doing the guessing, a server swamped by fake traffic, a message that is not genuine, or data taken while it is travelling.

Attacks rarely arrive alone

One form of attack is often used to deliver another, so a single description can involve two of them. Suppose someone phones the office of a family-run garden centre, says they are from the company that supplies the till software, and asks an assistant to confirm the admin password so a fault can be fixed. Nothing is broken and nothing looks unusual, so nobody is suspicious — that evening the caller signs in and installs malware that locks every sales record. The social engineering did the getting in; the malware does the damage. In the same way, a denial of service attack can keep staff busy fixing a website while data is quietly being taken.

The six forms of attack

Attacks rarely arrive alone

Practise this