S3-m1 Flashcards
The goal of a cyber security program is to…
manage the cybersecurity risks by securing and enhancing confidentiality, data integrity, and availability
Data breaches
Occur when information is compromised and utilized without the authorization of the owner. Examples of attack’s that can result in data breaches include ransomware, phishing, malware, comprised passwords
Service Disruptions
are unplanned events that cause a general system or major application to be inoperable for an unacceptable length of time
-malware
-distributed denial of service attacks (DDoS)
-SQL injections
Compliance Risk
Regulators can require organizations to comply with cybersecurity regulations. The failure to comply with these regulations can result in fines and financial penalties.
What is a cyber attack?
any kind of malicious activity that targets computer information systems, infrastructures, computer networks, or personal computer devices, and attempts to collect, disrupt, deny, degrade or destroy information system resources of the information itself.
Attacker, Threat Actor, or Hacker
Threat Agent
Individuals or groups of individuals known as hacking rings Advanced Persistent Threats (APTs) that target people or organizations to gain access to systems, networks, an data
Adversary
Threat Agent
These are actors with interests in conflict with the organization
Government-Sponsored Actors
Threat Agent
These threat actor are funded, directed, or sponsored by nations
Hacktivitis
Threat Agent
Groups of hackers that operate to promote certain social causes or political agendas
Insiders
Threat Agent
Employees who either organically develop into someone with malicious intentions or intentionally infiltrates an organization to achieve nefarious objectives
External Threats
Threat Agent
Threats that occur outside of the organization, entity, or individual that is the source of the cyberattack
Network-based Attacks
These attacks target the infrastructure of a network, including switches, router, servers, and cabling, with the intent to gain unauthorized access or disrupt operations for users
Backdoor and Trapdoors
Methods to bypass security access procedures by creating an entry and exit point to a network that is undocumented. Trapdoors are often installed by a system owners so they can bypass security measures to gain quick access, whereas backdoors may be intentionally installed or unintentionally left available due to product defects
Covert Channels
Mechanisms used to transmit data using methods not originally intended for data transmission by the system designers
-storage channels: data is transmitted by modifying a storage location
-timing channels: the delay in transmitting data packets is used to hide transmission
Buffer Overflows
Attackers overload a programs buffer, the temporary storage, with more input than it is designed to hold. This may cause the program to overwrite the memory of an application or cash
Denial of Service (DOS)
An attacker floods a systems network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle. This excess volume consumes the networks resources so that it cannot respond to service request
Distributed Denial of Services (DDoS) Attacks
These occur when multiple attackers or compromised devices are working in unison to flood an organizations network with traffic. These attacks manipulate the operation of network equipment and services in such a way that they may be more powerful
Man in the Middle (MITM) Attacks
Attacker acts as an intermediary between two parties intercepting communications, acting as a legitimate entity within a typical secure session. As info is passed between two parties, the attacker can read or redirect traffic.
Port Scanning Attacks
Scanning network for open ports is frequently done by attackers to find vulnerabilities that can be exploited.
-attack focuses on logical ports that are used for protocols such as TCP
-normal for companies to have open ports
-common vulnerabilities include unsecured protocols, unpatched protocols, poor login credentials
Ransomware Attacks
Typically come from malware that locks a user or a company’s operating systems, applications, and the ability to access data unless ransom is paid
Reverse Shell Attacks
“Connect back shells” - a victim initiates communication with an attacker from behind a company’s firewall so that the attacker can bypass the firewall and any other network safeguards and remotely control the victims machine.
Replay Attacks (eavesdropping)
A type of MITM attack in which a cybercriminal eavesdrops on a secure network communication, intercepts it, and then replays the message at a later time to the intended target to gain access to the network and the data that is behind the firewall
Spoofing
The act of impersonating someone or something to obtain unauthorized system access by using falsified credential or imitating a legitimate person or entity by using fake IP addresses, domains, or emails
-address resolution spoofing
-DNS Spoofing
-Hyperlink Spoofing
Application based attacks
Target specific software or applications such as databases or websites to gain unauthorized access or disrupt functionality.
-sql injections
-cross site scripting (XSS)
-race condition
-Mobile code: overwrite virus, multi partite virus, parasitic virus, polymorphic virus
Host Based Attacks
Target a single host such as a laptop, mobile device to disrupt functionality or obtain unauthorized access
-Brute force
-keystroke logging
-malware
-rogue mobile apps
Social Engineering Attacks
These attacks involve the use of psychological manipulation or deception to get employees to divulge sensitive information, provide unauthorized access, or assist an attacker in committing fraud. Interaction through email, text, direct messaging, or social media
-Phishing
-Spear Phishing
-Business Email Compromise BEC
-Catfishing
-Pharming
-Vishing
Physical (on-premise) Attacks
A security breach carried out on an organizations premises or performed in some way that physically involves a bad actor gaining control of sensitive data, hardware, and or software
-Intercepting Discard Equipment
-Piggybacking
-Targeted by attackers
-Tampering
-Theft
