Skip to content

Types of Cyber Attacks

When people think about a cyber attack or a data breach they think of a hacker typing malicious code into a terminal to exploit a weakness in a network to access sensitive data. While this does happen, the majority of the time the weakness they are trying to exploit are the humans that use the network. Hackers would rather trick an employee into divulging sensitive data rather than spend the time to attack another vulnerability. Humans are simply easier to exploit.

There are so many ways that an attacker can expose your systems and the consequences can be dire. You not only have to account for the technical components of the cyber landscape but also the human aspects. Educating yourself and your employees on the dangers of the web is vitally important to avoiding a cyber disaster.

Cyber Attack Statistics

It is estimated that the cybercrime economy is worth about $1.5 trillion annually. In contrast, the federal government provides only $15 billion dollars in funding for cyber security. This means companies are often left to defend themselves from the dangers of the web.

Many companies may believe that they are not in the right industry or are not the right size to need to worry about cyber security. The truth is that the vast majority of attacks effect small and medium sized businesses. The breakdown of cyber attack victims by industry is as follows:

  • 43% – Small and Medium Sized Businesses
  • 16% – Public Sector Entities
  • 15% – Healthcare Organizations
  • 10% – Financial Industry
  • 16% – Other

While small and medium sized businesses account for 43 percent of cyber victims, that same demographic only accounts for 13 percent of the total cyber security market in 2018.

Common Vulnerabilities

There are a myriad of weak points in every network system but a bad actor only needs one to cause a nightmare. Often times, the vulnerabilities are already well known across the web to hackers but their targets are completely unaware. Below is just a sampling of some of the most common software vulnerabilities:

  • Buffer Overflows
  • Handler Errors
  • User Interface Errors
  • Authentication Errors
  • Structure and Validity Issues
  • Missing Data Encryption
  • SQL Injection
  • Cross-site scripting and forgery
  • URL redirection
  • OS Command Injection

Common Attacks and Exploits

The above gives you just a small idea of what avenues a threat actor might have if they targeted your business. There are a set of tried and true attacks that hackers like to use regularly, however. The following are the most popular types of cyber attacks:

Phishing attacks – Social engineering attacks are often the most effective attack types, especially phishing attacks. Phishing attacks do not rely on a hacker knowing the technical details of your network. All a bad actor needs to know is an email address, social media account, or the phone number of one of your employees. The attacker will then reach out to the employee and pretend to be an authority figure, supervisor, financial institution, or even co-worker to try to obtain sensitive information. They may ask for login credentials, send your employee to a portal to gather information, or trick your employee into installing malware.

Malware – Malware refers to malicious software such as viruses, ransomware and backdoors. Ransomware attacks in particular have become increasingly popular among cyber criminals. In a ransomware attack an attacker hijacks a network and holds it hostage. An attacker may completely lock a system to make it inaccessible or threaten to release sensitive data unless they are paid.

Denial of Service – In a denial of service attack a bad actor overwhelms a network with illegitimate requests.  Sometimes this is done using a network of thousands of infected computers in a distributed denial of service attack (DDoS). The effect is that your network shuts down from the barrage of fake requests and legitimate requests are unable to be processed. For instance, if a company has an e-commerce web store or client portal, an attacker may use a DDoS attack to shut the site down and threaten to keep it down until they are paid.

Man-in-the-middle (MITM) attack – In a man-in-the-middle attack, an attacker will “listen in” on communications and transactions between two parties. An attacker can do this by taking control of or making themselves into a relay node and passing the communications from one side to the other. This all happens without the parties’ knowledge and the attacker can parse the communications for sensitive information to exploit. This is commonly accomplished by taking control of a wireless access point such as a Wi-Fi router.

SQL Injection – SQL is a coding language that is commonly used to manage databases of information. In an SQL injection attack an attacker will exploit a flaw in how SQL processes invalid data. What can happen is that an attacker will request information from a database but make the request with code that causes the database to dump all data, destroy data, change existing data, or spoof identity. For instance, if the SQL code that is handling your database does not account for certain unintended characters, such as an extra space or a backslash, when receiving a request from an end user, the code could act in unexpected and dangerous ways and an attacker can take advantage.

What Alliant Cybersecurity Can do For You

Cybersecurity is not just a concern for giant corporations or financial institutions – it’s a concern for everyone. Our team, made up of industry leaders in cybersecurity, professional services and legislation, realized that even though there are many solutions and providers available, none of them were truly tailored to professional services within the middle market. With that challenge in mind, Alliant Cybersecurity focuses on custom solutions that provide the maximum amount of protection for both your organization as well as your clients.

If you are concerned about your businesses cybersecurity strategy or if your company does not have a cybersecurity strategy, reach out to our team of industry experts so we can help prepare you for the worst. We can test your network, identify vulnerabilities, and prepare your company to defend against attackers.