Skip to content

Chapter 6 of 8

Threats, Attacks, and Malware

Attackers rely on a wide arsenal of techniques, often chaining multiple weaknesses together. Phishing tricks users into revealing credentials or executing malicious actions through deceptive emails or pages. Spear phishing targets specific individuals with researched, personalized content, making it far more convincing. Whaling aims at executives, smishing delivers phishing via SMS, vishing uses voice calls, and Business Email Compromise (BEC) impersonates executives to authorize fraudulent wire transfers. A man-in-the-middle (MITM) attack secretly intercepts and potentially alters communication between two parties who believe they are communicating directly; TLS with valid certificate validation makes such interception extremely difficult, while certificate pinning trusts only specific certificates or public keys to defend against compromised CAs. DNS spoofing returns false DNS responses to redirect traffic, mitigated by DNSSEC, which adds cryptographic signatures to DNS records for integrity.

Malware, malicious software designed to damage systems, steal data, spy on activity, or disrupt operations, comes in many forms. Viruses attach to legitimate programs, worms self-replicate and spread without user interaction, and trojans disguise themselves as legitimate software. Rootkits stealthily hide their presence at the OS or firmware level, logic bombs activate on a trigger condition such as a date or event, and backdoors provide hidden access that bypasses normal authentication. Ransomware encrypts a victim's files and demands payment for the decryption key; security experts recommend not paying because payment does not guarantee recovery and funds criminal operations, instead isolating affected systems, restoring from backups, and reporting to authorities. Botnets, networks of compromised devices controlled by an attacker, are often used to launch Distributed Denial of Service (DDoS) attacks, which flood a target from many sources to exhaust resources, much harder to mitigate than a single-source DoS. Defenses against DDoS include anti-DDoS services such as Cloudflare and AWS Shield, rate limiting, scaling, and sinkhole routing.

Software supply chains have become prime targets. A supply chain attack compromises a software dependency or build pipeline to attack downstream users, as exemplified by the 2020 SolarWinds Orion breach that infiltrated thousands of government and corporate networks. Dependency confusion publishes a malicious package with the same name as an internal package, while typosquatting registers package names similar to popular ones, such as reqeusts versus requests, to trap users. A Software Bill of Materials (SBOM) lists the components and dependencies in a piece of software, enabling organizations to know what they are running. The secret sprawl problem arises when API keys, tokens, and passwords are scattered through code and config, becoming a common cause of breaches. Secret scanning, offered by GitHub, GitLab, and AWS, automatically detects secrets in repositories, while centralized secrets management services like HashiCorp Vault or AWS Secrets Manager store and control access to those credentials. Brute-force attacks systematically try many passwords or keys, dictionary attacks use a wordlist of likely passwords, and credential stuffing reuses leaked credentials from one site to log into another; defenses include MFA, rate limiting, breach detection services such as Have I Been Pwned, and unique passwords per site. Software updates patch known vulnerabilities that attackers actively exploit, making prompt patch management essential. Even well-designed systems can leak through indirect channels: side-channel attacks exploit information leaks such as timing or power consumption, with Spectre and Meltdown as famous CPU examples; timing attacks infer secrets from execution-time variation and are mitigated by constant-time algorithms.

All chapters
  1. 1Foundations of Cybersecurity
  2. 2Identity, Authentication, and Access Control
  3. 3Cryptography and Public Key Infrastructure
  4. 4Network and Infrastructure Security
  5. 5Application and Web Security
  6. 6Threats, Attacks, and Malware
  7. 7Defense Operations and Incident Response
  8. 8Governance, Risk, and Compliance

Drill it

Reading is not remembering. These come from the Cybersecurity Fundamentals deck:

Q

What are the three components of the CIA triad in cybersecurity?

Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring system...

Q

How does a breach of "integrity" in the CIA triad differ from a breach of "confidentiality"?

A confidentiality breach means unauthorized parties accessed the data (e.g., a data leak). An integrity breach means the data was altered or tampered with witho...

Q

Why is "availability" considered equally important as confidentiality and integrity?

Even if data remains confidential and unaltered, a system is useless if legitimate users cannot access it when needed. DDoS attacks, ransomware, and hardware fa...

Q

What is a phishing attack and what makes spear phishing more dangerous?

Phishing uses fraudulent emails or messages to trick victims into revealing sensitive information or clicking malicious links. Spear phishing targets a specific...