The Cyber-Attack

A Cyber-attack is a type of risk that aimed computer networks, systems and user data. These threats can come in the form of malware, phishing and other malicious activity. Cyber-attacks have been rated the fifth top-rated risk in 2020 and have become new status quo across public and private sectors. Foremost reason for the rise of the cybercriminals is clarified by expertise as:

The Risk of Remote Working

Ever since the pandemic hit globally, most organisations are forced to shift their employees to work remotely. Despite most of us are entering post-pandemic now, research results indicate that most employees will still continue to work remotely. Working from home bearings new cybersecurity risk it is also the most cited topic in the new trend. Home offices are often are less secured than centralised offices where firewalls, routers and access management are run by IT Security teams. In order to keep up the business operational during the pandemic season security inspection was not as firm as usual. Therefore, cybercriminals took advantages while adapting to it.

The Blooming of Internet of Things (IoT) & Cloud

The vast expansion of IoT also leads to the rise of cybercrime. This growth also refers to devices other than computers, phones and servers that connect to internet and data sharing across devices. IoT devices nowadays also include wearable fitness trackers, smart watches, smart home appliances as well as voice assistance. With the current trends and the changes in living lifestyle evolving rapidly, human rely more on these devices to assist with daily activities which also lead to more devices connecting to network and increase the potential for attackers to access our data. Gartner analysts predicted that in 2023, there will be estimated 43 billion IoT devices connected in the world.

With the increasing number of crimes by the Cyber-attacks, we should work towards initiating and developing a culture of awareness around cybersecurity issues. Cyber Threats are no longer an IT department issue to handle. In fact, everyone should start creating awareness of the threats and taking basic precautions as a fundamental part of every job description in 2023.

As a fundamental steps, the most common types of cyber-attacks classified as follows:

1.  Malware

Malware is hardware, firmware, or software that is intentionally included or inserted into a system for a destructive purpose and it is usually without the victim’s knowledge. Malware is also known as malicious code or malicious software. Over the years malware has become one of the most significant external threats to the systems. Malware able to cause extensive damage and disruption, and required massive efforts within most organisations. The below image simply explains the different types of common malware programs.

Picture 1: Types of Malware

Among the malware, viruses are a type of malware that often take the form of a piece of code inserted in an application, program, or system and they’re deployed by victims themselves.

Ransomware act as its name which is a type of malware that cyber attackers used for the ransom purpose. It locks and encrypts the target victim’s device or data then demands ransom from targeted victims in order for targeted victims to restore their access.

Spyware is a type of malware that enters devices without the owner’s knowledge. This is often for the purpose of stalking on internet activity, pursuing log in and password information, or collecting sensitive information which could be used for fraudulent purposes.

2.  Password Attacks

Password attack is the act of various methods used to maliciously authenticate into password-protected accounts. Password attacks are also known as one of the most common methods of corporate and personal data breaches.

Types of password attacks include:

• Phishing attacks
• Credential stuffing attacks
• Brute force attacks
• Dictionary attacks
• Password Spraying Attacks
• Keylogger Attacks
• Man-In-The-Middle Attacks

Among all the attacks, phishing attacks are the type that most press online. Victims usually will receive fake emails or notifications that pretend it is from trustworthy sources for example from banking institutes by asking victims to perform certain actions. Once users click on the links provided by hackers, they will gain genuine access to your account. This is not the end yet if victims are using the same password for multiple accounts. Hackers will then be having access to all victim’s accounts that share the same password.

Therefore, implementing a strong and unique password solution for every account access is recommended defence that evolves alongside.

3.  Distributed Denial of Service (DDoS) Attacks

Distributed denial of service (DDoS) attacks is a family of denial of service (DoS) attacks. DDoS (Distributed Denial of Service) is a category of malicious cyber-attacks that hire cybercriminals to cause an online service, network resource or host machine unavailable to the intended users on the Internet.

Distributed denial of service (DDoS) attacks is launched from multiple connected devices that are scattered across the Internet. These multi-person, multi-device bombardments are usually harder to stop, mostly due to the total volume of devices involved. Unlike single-source DoS attacks, DDoS attacks have a tendency to target the network infrastructure in an attempt to penetrate it with massive volumes of traffic. The attacks will continue until the server crashes or stop responding. While Service disruptions can often take hours to remediate causing huge financial losses.

Some of the main reasons for DDoS attacks are due to Ransom, Hacktivism, or competition. Types of DDoS attacks include application layer attacks, Protocol attacks and Volumetric Attacks.

4.  Structured Query Language (SQL) Injection

A Structured Query Language (SQL) injection is a type of cyber-attack that results from inserting malicious code into a server that uses SQL to manipulate the towards access to private information. The attacks use a set of SQL codes to manipulate a database and gain access to potentially valuable. Submitting the malicious code can be as simple as entering it into a vulnerable website search box. SQL is a query language applied in programming to access, modify, and delete data stored in backend database. This information may include sensitive company data, user lists or customer details.

The common SQL injection examples include: Recovering hidden data, where attackers can alter an SQL query to return additional results. Sabotaging application logic, where hackers can modify a query to disrupt with the request’s logic.

Due to websites and servers that commonly use databases, SQL injection liabilities are one of the older and most common types of cyber-attack. Numerous developments within the hacker community have multiplied the risk for this type of attack. Specifically, the development of tools to detect and exploit SQL injection are now freely available from open-source developers. Cybercriminals take advantage of these tools to automatically perform attacks in only a few minutes by letting them access to any table or column in the database with just simple clicks.

Types of SQL Injection are listed as follows:

1.       In-band SQL

• Error-based SQLi
• Union-based SQLi

2.       Inferential SQLi (also known as Blind SQL injection)

• Time-based SQLi
• Boolean SQLi

3.       Out-of-band SQLi

Noteworthy principles to help preserve organisations from cyber-attacks include:

Awareness Exercise:

Produce awareness about cyber risks within the team responsible for your web application, data as well as security by providing necessary role-based training to all users.

Use the latest versions:

It is crucial to keep the development environment up to date for optimised protection. This is to ensure eliminate of the older versions when needed which may lack current safety landscapes. Ensure the organisation are well protected with the latest software and security reinforcements at all time.

For more information about the Cyber security, feel free to email us at info@cybiant.com or contact us via the website chat.