Today’s threats
The threat landscape within the cyber world is extremely diverse and is continually becoming more complex. The task of protecting users, data, and systems is becoming more difficult and requires the advancement of even more intelligent tools to keep bad actors out. Today, criminals are more sophisticated, and large groups have formed with significant financial backing to support the wrongdoings of these groups. The following are common cyber threats: national governments, nation-states, terrorists, spies, organized crime groups, hacktivists, hackers, business competitors, and insiders/internal employees.
Tip
To learn more about these cyber-threat sources, the Department of Homeland Security (DHS) has a great reference here: https://us-cert.cisa.gov/ics/content/cyber-threat-source-descriptions.
To shed some light on real-world examples of data-breach sources today, Verizon releases an annual report, Data Breach Investigations Report. You can view their latest report here: https://enterprise.verizon.com/resources/reports/dbir/. The report is built on a set of real-world data and contains some eye-opening data on data breaches, such as the following revelations highlighted in the 2021 report:
- 85% of breaches involved a human element.
- 61% of breaches involved credentials.
- 3% of breaches involved vulnerability exploitation.
- Action variants in breaches: phishing 36%, up by 25% from 2020; use of stolen credentials 25%; ransomware 10%, which more than doubled from 2020.
- Credentials remain one of the most wanted data types.
- The most common motivation for attacks continues to be financial.
- The number-one threat actor is currently organized crime.
The full 2021 report can be found here: https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/.
There are many types of cyberattacks in the world today, and this creates a diverse set of challenges for organizations. While not all threats are Windows-specific, there’s a chance that Windows is the median or attack vector in which an attacker gains access by exploiting a vulnerability. An example of this could be an unpatched OS or an out-of-date application. Next, we list many types of threats that could cause damage directly using a vulnerability within the Windows OS or by using the Windows OS as an attack vector.
Malware is software or code designed with malicious intent that exploits vulnerabilities found within the system. The following types of threats are considered malware: adware, spyware, virus (polymorphic, multipartite, macro, or boot sector), worm, Trojan, rootkit, bots/botnets, ransomware, and logic bombs.
In addition to malware, the following types of attack techniques can be used to exploit vulnerabilities:
- Keylogger
- Phishing (email phishing, spear phishing, whale phishing, vishing, smishing, or pharming)
- Social engineering
- Business Email Compromise (BEC)
- Structured Query Language (SQL) injection attack
- Cross-Site Scripting (XSS)
- Denial of Service (DoS) and Distributed Denial of Service (DDoS)
- Session hijacking
- Man-in-the-Middle (MITM) attacks
- Password attacks (brute-force, dictionary, or birthday attacks)
- Credential stuffing or reuse
- Identity theft
- Advanced Persistent Threats (APTs)
- Intellectual property theft
- Shoulder surfing
- Golden Ticket: Kerberos attacks
- Domain Name System (DNS) tunneling and dangling DNS
- Zero-day
Tip
To learn more about the threats listed earlier, the National Institute of Standards and Technology (NIST) has a glossary that provides more information on most, if not all, of the threats in the preceding list: https://csrc.nist.gov/glossary.
Now that we’ve just reviewed today’s threats, let’s take a look at an extremely important topic that has everyone’s attention. Ransomware preparedness is on everyone’s security priority list.