Key Cybersecurity Concepts, Threat Vectors, and Attacks
Events, Alerts, Incidents, and Breaches
Event vs. Alert vs. Incident vs. Breach: An event is any observable occurrence involving a system, network, application, or user activity. An alert is a notification generated when potentially suspicious activity is detected. An incident is an event that actually or potentially threatens the confidentiality, integrity, or availability of information or systems. A breach is a security incident involving unauthorized access, disclosure, loss, or use of sensitive information. Therefore, not every event is an alert, not every alert is an incident, and not every incident becomes a breach.
Pharming Attacks and Countermeasures
Pharming: Pharming is a more technical variant of phishing that redirects users from a legitimate website to a fraudulent one by manipulating website traffic. It usually exploits vulnerabilities in DNS servers or caches, host files, routers, or DNS settings. Its objectives are similar to phishing, including information theft, malware distribution, and fraud. Security measures include secure DNS, HTTPS connections, updated systems, secure router configurations, and user awareness.
Ransomware Mechanisms and Stages
Ransomware: Ransomware is malicious software that blocks access to systems or data and demands payment from the victim. It commonly encrypts files or systems and requests a ransom in exchange for a decryption key. Modern ransomware may also steal data before encryption and threaten to publish it, combining encryption, data exfiltration, and extortion. It may enter through phishing, compromised credentials, vulnerabilities, or malicious attachments and can severely disrupt business operations and critical services.
- Initial Access
- Execution & Persistence
- Privilege Escalation & Lateral Movement
- Data Discovery & Exfiltration
- Encryption & Extortion
Web Application Attacks: SQLi, XSS, and CSRF
SQL Injection, XSS, and CSRF: SQL Injection, XSS, and CSRF are common web application attacks:
- SQL Injection (SQLi): Consists of injecting malicious commands to interact with a database and may be used to bypass authentication, disclose information, or modify data.
- Cross-Site Scripting (XSS): Consists of injecting malicious HTML or JavaScript into a vulnerable website so that it executes in another user’s browser, for example, to steal cookies.
- Cross-Site Request Forgery (CSRF): Tricks an authenticated user into performing an unwanted action by abusing the user’s active session.
Vulnerabilities, Exploits, and Payloads
Vulnerability vs. Exploit vs. Payload: A vulnerability is a flaw or weakness that can be accidentally or deliberately used to cause a security incident. An exploit is a piece of code, software, data, or sequence of commands designed to take advantage of a vulnerability. A payload is the code executed after the exploit successfully takes advantage of the vulnerability and performs the intended action, such as gaining access, escalating privileges, or deleting files. Therefore, the vulnerability is the weakness, the exploit takes advantage of it, and the payload performs the action.
Malware Types: Viruses, Worms, and Trojans
Virus vs. Worm vs. Trojan:
- Virus: A virus is malicious code that attaches itself to a legitimate file or program and requires user or system action to execute.
- Worm: A worm is self-replicating malware that spreads automatically and can propagate without direct user interaction, potentially consuming network resources and causing denial of service.
- Trojan: A Trojan is malicious software disguised as legitimate software or files. Unlike worms, Trojans do not usually self-replicate and may be used to create backdoors, steal information, gain unauthorized access, or download additional malware.