In a NetEnrich survey of IT professionals, 68 percent say protecting against security breaches is one of their top goals. Public sentiment generally agrees — people view cybercrimes as a serious threat — but there’s a stunning knowledge gap when it comes to the most common cyberattacks.
In a poll of internet users, Pew Research Center found that just 16 percent knew that a botnet is a group of computers networked together and used by hackers to steal data. Fewer than half (48 percent) could define the term “ransomware,” and 46 percent said they think that all email is encrypted by default (which is false).
Enterprise IT is nothing less than a digital battlefield today. Fighting back starts with understanding the facts. To that end, here’s a rundown of the most common cyberattacks.
- Malware is the workhorse of cybercrime. The term refers broadly to any type of software that is used to inflict harm on a system. The most common cyberattacks may include viruses that disable networks or mine for data. This also includes such sub-genres as ransomware, which attackers use to lock up a target computer and demand a fee for the release of captured data. Malware often is inserted into a system via malicious email attachments or bogus “alerts” that pop up in the course of internet browsing.
- Phishing scams exploit the “human error” factor, manipulating unsuspecting users into divulging sensitive or personal information, or enticing them to click on links that enable hackers to infiltrate systems unseen. Attackers may pretend to be someone the user knows or they may preface an email with an urgent security notification or dire financial warning that seems to require an immediate response. The message looks legitimate and it spurs curiosity, but following the links leads the user into a trap, exposing information and even entire enterprise systems. Phishing scams will also aim to steal credentials, which hackers can then use to spy or steal at will.
Increase Security With Biometric Scanning
White Paper
Password management can be a headache. Biometric scanning offers an alternative security solution. Download Now
- The SQL Injection attack looks to exploit the SQL programming language, which manages critical data across websites and digital services. Attackers use malicious code to insinuate themselves into the target server in order to gain access to a range of critical data points. These might include passwords and usernames, credit card information, financial data and other high-value targets. Hackers are well-versed in the known vulnerabilities of SQL servers and can turn these to their advantage.
- Cross-Site Scripting (XSS) doesn’t often make the headlines, but it’s a real and potent threat. In this scenario, hackers use malicious code to target website users. Rather than attack the site itself, an XSS incursion uses a website to inject itself into the user’s browser, and then bids to gain access to passwords and other critical data. This poses a profound reputation risk to the enterprise; no company or government agency wants its website to be the source of a breach inflicted on its own customers.
- Denial of Service (DoS) attacks became hot news late last year, when hackers deployed the Internet of Things to cause massive internet outages on the East Coast. A DoS attack aims to grind web traffic to a halt by flooding a website with very high levels of traffic, overloading servers and shutting down access. Unlike phishing scams and other ruses meant to mine valuable data, a DoS typically aims not to steal but simply to destroy: a kind of cyber vandalism on a potentially global scale. As almost all businesses today rely on the internet, the specter of a DoS attack poses a serious threat.
- Session Hijacking and Man in the Middle attack strategies take advantage of the unique session ID that’s assigned each time websites exchange information. The “man in the middle attack” allows the hijacker to assume a fake identity in order to gain access to unauthorized information.
- Credential reuse refers to hackers’ ability to collect up and deploy usernames and passwords, based on users’ stubborn refusal to change their credentials periodically or use different passwords for different sites. Often a hacker only needs to steal a password once in order to gain ready access to multiple sites and services.
These are some of the most common cyberattacks. Should they sound alarm bells for enterprise IT managers? Absolutely. Cybersecurity requires a thoughtful and methodical approach, with a range of defenses aligned to meet the threat. A secure mobile platform will be a starting point for many, with other defenses to embrace not just network infrastructure but also the human element. It’s up to IT leadership to ensure everyone is properly trained on good email hygiene, smart password management and other key measures to help ensure cybersecurity across the enterprise.
Are unpatched security vulnerabilities worth the risk? A recent report shows just how much known vulnerabilities can cost your business.
