Cyber Security & Threats

Common Malware Varieties

• Viruses: Malicious code that attaches itself to legitimate programs and replicates when the program is executed. They require human action to spread from one system to another.
• Worms: Standalone malware that replicates itself in order to spread to other computers. Unlike viruses, they do not need to attach to an existing program and can spread automatically across networks.
• Trojans: Programs that appear to be useful or legitimate but contain hidden malicious code. They do not self-replicate but provide a 'backdoor' for attackers to enter a system.

Network and Web Attacks

• Phishing: A method of gathering personal information using deceptive emails and websites. Attackers masquerade as a trustworthy entity to induce individuals to reveal sensitive data like passwords or credit card numbers.
• Denial of Service (DoS): An attack meant to shut down a machine or network, making it inaccessible to its intended users. Distributed Denial of Service (DDoS) uses a 'botnet' of multiple compromised systems to flood the target with traffic.
• SQL Injection: A type of vulnerability where an attacker can interfere with the queries that an application makes to its database. It typically allows an attacker to view data they are not normally able to retrieve.

• Passive vs. Active Attacks: A Passive Attack attempts to learn or make use of information from the system but does not affect system resources (e.g., eavesdropping). An Active Attack attempts to alter system resources or affect their operation (e.g., modifying data or DoS).

• Identify the Breach Type: When presented with a scenario, first determine which part of the CIA triad is affected. If data is stolen but not changed, it is a Confidentiality breach; if data is changed, it is an Integrity breach; if the system is down, it is an Availability breach.

• Distinguish Malware: Look for the 'replication' factor. If the software spreads by itself across a network without user interaction, it is likely a Worm. If it requires a user to open a file, it is a Virus.

• Check for Social Engineering: If an attack involves a person being tricked or manipulated (like a fake email or phone call), categorize it under Social Engineering or Phishing rather than a purely technical exploit.

• Verify Defense Layers: Remember the concept of Defense in Depth. A single security measure (like a firewall) is rarely enough; exams often look for multi-layered approaches including encryption, MFA, and user training.