ISC S3 Flashcards
(82 cards)
Cyberattacks 网络攻击
-malicious activity 恶意的
-targets computer information system, infrastructures, computer network or personal computer devices
-attempts to collect, disrupt, deny, degrade or destroy information system
-directly or indirectly affect the organizations, its customers, vendors and etc.
Threat agent
-internal or external attacker that could negatively impact data security
-through thef, manipulation
操纵 or control of sensitive information or system
Type of thereat agent: attack, adversary
-attack, threat actor or hacker
-adversary: actors with interest in conflict with the organization , perform malicious actions against organization’s cyber resources such as intercepting 拦截 purchases, theft of data, tampering with 篡改 hardware prior to installation
Type of threat agent: Government-sponsored/Nation-State Sponsored Actors:
They’ve been known to steal and exfiltrate intellectual property, sensitive information, and even funds to further their nation’s espionage causes.间谍活动原因
Type of threat agent: Hacktivist
-Groups of hackers that operate:
To promote certain social causes or political agendas
-On a self-proclaimed 自称 relatively moral basis by staying away from certain targets like:
Hospitals, Churches, and other organizations that have altruistic purposes or missions.
Type of threat agent: insider
-Employees that either organically developed into a person with malicious intentions
-Employees that intentionally infiltrated 渗透 an organization to achieve nefarious 邪恶 objectives.
Type of external threat
-Threats that occur from outside of the organization, entity, or individual that is the target of the cyberattack.
Type of cyber attacks:
-Network-based attack
-application based attack
-host-based attack
-social engineering attack
-physical ( on-premises) attacks
-supply chain attacks
Type of cyber attack: network-based attack
-backdoors and trapdoors
-methods to bypass security access procedures by creating an entry and exist point to a network that is undocumented . Not attack on a network but they facilitate entry into the network that can be used to execute attack
-backdoors may be intentionally installed or unintentionally left available due to product defects
-Trapdoors are often installed by system owners to bypass security measures to gain access.
Network based attack : covert channel
-Violate the entity’s security policy but do NOT exceed the entity’s access authorization.
So they can communicate data in small parts.
-storage channels : data is transmitted by modifying a storage location, allowing another party with lower security permission to access the data
-timing channels: use the delay ( or gaps) in transmitting data packets to hide the transmission
Network based attack: Buffer overflows
-attacker overload a program’s buffer (the temporary storage) with more input than it is designed to hold
-may cause the program to overwrite or crash
-the attacker can inject malicious code or take control of a system
Network based attack: denial of service ( DoS)
-an attacker floods a system’s network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle
Network based attack : distributed denial of service (DDoS) attacks
-when multiple attackers or compromised devices are working in unison 一致to flood an organization’s network with traffic
-more powerful than a traditional DoS attack
Network based attack: man in the middle ( MITM) attack
-(Eavesdropping)窃听
-The attacker acts as an intermediary between two parties intercepting 拦截 communications, acting as a legitimate entity within a typical secure session
Network based attack: port scanning attacks
-scanning network for open orts is frequently done by attackers to find vulnerabilities that can be exploited so that they can gain unauthorized access to a company’s network
-Common vulnerabilities include:
Un-secured protocols and or Unpatched protocols
Poor login credentials, and poorly configured firewalls.
Network based attack: ransomware attacks
Typically come in the form of malware that locks a user or a company’s operating systems, applications, and the ability to access data unless a ransom is paid.
Network based attack: reverse shell attacks
-Also referred to as ‘‘connect-back shells’’
-A victim initiates communication with an attacker from behind a company’s firewall so that the attacker can bypass the firewall and any other network safeguards and remotely control the victim’s machine.
Network based attack: replay attack
-A type of MITM attack in which a cybercriminal eavesdrops窃听 on a secure network communication, intercepts it, and then ‘‘replays’’ the message at a later time to the intended target to gain access to the network and the data that is behind the firewall.
Network based attack: return-oriented attack
-
Network based attack: spoofing
-The act of impersonating 模仿 someone or something to obtain unauthorized system access by using falsified credentials 伪造的 or imitating 模仿 a legitimate person or entity by using fake IP addresses, domains, or email addresses.
Network based attack: spoofing 欺骗
-Address resolution spoofing : all devices on a network have MAC addresses that maps to an IP address. Manipulating the mapping of the ARS means fraudsters can channel messages to alternate destinations.
-DNS spoofing : A company’s DNS server translates domain names to IP addresses. If this mapping is tweaked by an attacker to redirect someone to another IP address that leads to a mimicked website, the victim could potentially enter usernames and passwords, sensitive information, or download a malicious application from the fake site.
-Hyperlink Spoofing
application-based attack
-target specific software or applications (desktop or web) such as databases or websites to gain
application-based attack-SQL
-inject malicious SQL code into existing SQL code on a company’s website to gain unauthorized access to a company’s data
application-based attack-Cross-site scripting ( XSS)
-similar to SQL injection, but attack inject code to a company’s website that attacks users visiting the company’s website
