Table Of Contents
Cybercrime is only getting worse!
Cybercriminals are constantly iterating, exploiting vulnerabilities, and engineering new and better ways to gain unauthorized access to data. As technology advances and fuels innovation for good, practical endeavors, it also facilitates bad actors as they pursue criminal undertakings. Technology such as Artificial Intelligence, Machine Learning, and the Internet of Things (IoT) gives criminals a new arsenal from which to draw.
In all honesty, it is pretty scary how good cybercriminals are becoming. For many, it causes anxiety to answer an email or reply to a text message – let alone download an attachment!
Defining a Cyberattack
To better understand the world of cybercrime, let’s start by defining a cyberattack as a deliberate act perpetrated by an individual or organization to breach a network or system and cause damage or destruction. Perpetrators of this crime are known as hackers, and their motives often center around financial gain, sabotage, or espionage. With this definition in mind, let’s now shift our attention to the top five cybersecurity threats (sadly, far from an exhaustive list).
Top 5 Cybersecurity Threats
- Social Engineering
Social engineering manipulates vulnerable victims into disclosing sensitive information and taking specific actions that give cybercriminal(s) access to a network or system. Phishing is highly prevalent and involves:
- Tricking recipients into clicking a link.
- Downloading an attachment.
- Taking other actions to satisfy a cybercriminal’s whims.
Phishing victims take action because they believe that a message (typically an email) comes from a legitimate source. The emails trick victims using branding and other visual tactics to give recipients confidence in the sender’s authenticity. With the assurance that the visual tactics impart, victims mindlessly take specific action on the part of the recipient, such as clicking a link or downloading an attachment. Clicking a link or downloading an attachment exposes the victim’s network or system unwittingly (often through Malware), giving access to sensitive information.
There are many other types of social engineering, with some more targeted and others involving physical interplay, such as tricking a victim into inserting a USB into their device. However, all forms of social engineering aim to exploit a victim through psychological manipulation and executing the desired actions of the perpetrator(s).
- Malware
Malware is software designed to specifically infiltrate a computer system without authorization and often results in damage, disruption, or even destruction. Cybercriminals employ diverse methods to inject Malware into unsuspecting victims’ computer systems, such as Phishing as described above, through seemingly innocuous free internet downloads, and more. Once the Malware infects a user’s system, the system is now vulnerable to the theft of sensitive information and monitoring user activities. It can even be used as part of an attack on another network or system. Like social engineering, there are many types of Malwares, such as Trojan viruses, spyware, worms, Ransomware, and more.
- Ransomware
One particularly nasty type of Malware is called Ransomware. Just like its name implies, Ransomware aims to hold a victim and the victim’s data for ransom until the cybercriminal’s demands are met. One typical scenario involves when a cybercriminal prevents access to critical data (say, at a hospital) until a large payment is made (typically a largely untraceable cryptocurrency payment) for the organization to regain access and business continuity. Another typical example involves cybercriminals stealing potentially harmful data such as risqué photos from a victim and threatening to expose them through publication unless specific directions are followed.
A more novel side of Ransomware is RaaS (Ransomware-as-a-Service), which not only exploits victims’ short-term but enables other bad actors to follow a blueprint of sorts, further exploiting large institutions or organizations.
- DDoS
Distributed-denial-of-Service (DDoS) attacks are large-scale, coordinated attacks that aim to take down websites and crash servers, rendering online services unavailable. Essentially, a DDoS attack causes a traffic overload by using other victims’ computers infected by Malware (usually Trojan viruses) to become an army of “bots” controlled by a botmaster cybercriminal.
Microsoft for example, stopped more than 350,000 DDoS attacks in the latter half of 2021 alone! One attack is believed to have coordinated over 10,000 computer bots worldwide and resulted in Azure going down for approximately 15 minutes.
- Man-in-the-Middle
MitM (Man-in-the-Middle) attacks trick unsuspecting users by infiltrating the communication between a user and an application. Such attacks allow cybercriminals to intercept communications for nefarious purposes such as data theft and impersonation. Like the cybersecurity threats listed above, MitM attacks come in multiple varieties.
One example is email hijacking when a cybercriminal gains unauthorized access to email accounts to send out phishing emails or Malware. Another common type of MitM attack involves any Bluetooth-connected devices. Though many kinds of Bluetooth attacks exist, one common type is BlueJacking. BlueJacking is when one Bluetooth-enabled device. Hijacks another and sends spam content (which could be Malware).
Cybercrime is only getting worse!
As previously stated, the top-5 cybersecurity threats are in no way exhaustive. Moreover, each of the listed five threats comprises many different types in and of themselves. This is to say, we live in an exciting digital world, rampant with change and technological advancement. However, it is a world also filled with smart, sophisticated, and stealthy cybercriminals looking to exploit their next victims.
Since we all use technology and the internet, it is imperative that we educate ourselves to prevent the many threats we face.
Sources
- https://www.splunk.com/content/dam/splunk2/en_us/gated/ebooks/top-50-security-threats.pdf
- https://www.exabeam.com/information-security/cyber-security-threat/
- https://www.datamation.com/security/cybersecurity-threats/
- https://www.imperva.com/learn/application-security/cyber-security-threats/
- https://home.sophos.com/en-us/security-news/2021/bluetooth-attacks
- https://cxosjournal.com/email-hijacking/
- https://www.windowscentral.com/azure-stops-biggest-ddos-attack-ever-according-microsoft