16 Types of Cybersecurity Attacks and How to Prevent Them
Cybersecurity Attacks
- Data Breach: Examples, Causes & Preventing the Next Breach
- 16 Types of Cybersecurity Attacks and How to Prevent Them
- XXE Complete Guide: Impact, Examples, and Prevention
- How XSS Payloads Work with Code Examples & Preventing Them
- SQL Injection Attack: How It Works and 4 Preventive Measures
- Advanced Persistent Threats: Attack Stages, Examples, and Mitigation
- Supply Chain Attacks: Impact, Examples, and 6 Preventive Measures
- The Growing Threat of Credential Stuffing and 6 Ways to Defend Your Organization
What Are Cybersecurity Attacks?
18 Minute Read
Threat actors employ cybersecurity attacks to perform malicious activities against computer systems, devices, or networks. A cybersecurity attack may use one or several attack vectors to target individuals or organizations, and achieve objectives ranging from financial gain to sabotage and terrorism.
For example, threat actors may use brute force attacks, credential stuffing, or other forms of social engineering to gain unauthorized access to computing systems. More sophisticated attacks, like advanced persistent threats (APTs), employ various techniques and vectors to gain unauthorized access to a corporate network and remain undetected until achieving their objectives.
A successful cybersecurity attack may result in a data breach. Next, actors may try to steal the data, modify it, sell it, or hold it for ransom. Prevention techniques include data backup, penetration testing, bounty training, and addressing security vulnerabilities. This is part of an extensive series of guides about hacking.
In this article:
Common Types of Cybersecurity Threats
1. Data Breach
A data breach is a cyberattack in which sensitive, sensitive or protected data is compromised or disclosed. Data breaches can happen to organizations of all sizes. The data stolen might include personally identifiable information (PHI), protected health information (PHI), trade secrets, customer data, or other sensitive data.
If a data breach results in theft of personal information or a breach of government or industry compliance obligations, the offending organization can face fines, lawsuits, reputational damage and operational disruption.
Learn more in our detailed guide to data breaches.
2. SSRF
Server-side request forgery (SSRF) is a web security vulnerability that allows an attacker to send a request to an unexpected location in a server-side application.
In a typical SSRF attack, an attacker can convince a server to establish a connection to an internal private service within the organization's infrastructure. It can also force the server to connect to external systems, exposing sensitive data such as credentials.
Learn more in our detailed guide to SSRF
3. XXE
XML External Entity Injection (XXE) is a web security vulnerability that allows an attacker to compromise an application by exploiting the way it handles XML data. In most XXE attacks, attackers can view files on the application server's file system and interact with backends or external systems that the application itself has access to.
In some cases, attackers can exploit XXE vulnerabilities to launch server-side request forgery (SSRF) attacks, compromising underlying servers or other backend infrastructure.
Learn more in our detailed guide to XXE
4. XSS
Cross-site scripting (also known as XSS) is a web security vulnerability that can compromise user interaction with vulnerable applications. It allows attackers to bypass same-origin policies designed to isolate commands originating from different websites.
An XSS vulnerability allows an attacker to impersonate a user of an application, perform any actions for which the user has privileges, and gain access to the user’s data. If the victim's user has administrative access to the application, XSS enables complete compromise of the application and its data.
5. Code Injection
Code injection is a generic term for an attack in which attackers inject code that is accepted by the application as a benign input, and is interpreted or executed by the application, but in fact contains malicious instructions.
This type of attack exploits improper validation of untrusted data in an application. Common types of code injection include command injection, SQL injection, and PHP injection.
6. Command Injection
Command injection is an attack designed to execute arbitrary commands on the host operating system through a vulnerable application. Command injection attacks can occur when an application passes insecure user-supplied data, such as forms, cookies, or HTTP headers, to the system shell.
In a command injection attack, attacker-supplied operating system commands are typically executed with the privileges of the vulnerable application. Command injection attacks are caused by insufficient input validation.
7. SQL Injection
SQL injection is a technique used by attackers to gain unauthorized access to web application databases by appending malicious code strings to database queries.
Attackers manipulate SQL code to provide access to protected resources such as sensitive data and execute malicious SQL statements. Properly executed SQL injection can expose intellectual property, customer data, or private company administrator credentials. Most techniques use command characters that switch the context of a SQL query to perform unexpected actions on the database.
SQL injection attacks can target any application that uses a SQL database, and websites are the most common attack target. Common SQL databases include MySQL, Oracle, and SQL Server. With the advent of NoSQL databases, attackers have discovered similar techniques to perform NoSQL injection.
8. Remote Code Execution
Remote code execution (RCE) allows an attacker to execute malicious code remotely on a computer. This vulnerability allows an attacker to take complete control of an affected system with the privileges of the user running the application. After gaining access to the system, attackers often attempt to escalate privileges.
Many other types of attacks listed here could lead to RCE in some circumstances, and a range of vulnerabilities in operating systems and applications enable RCE. Any attack or exploit that enables RCE is considered highly severe and can have disastrous consequences.
9. Credential Stuffing
Credential stuffing is the automatic insertion of stolen credentials into website login forms to gain unauthorized access to user accounts.
Many users reuse the same password and username pairs, so if those credentials are exposed in a data breach or via phishing attacks, they can enable attackers access to multiple systems. Attackers attempt to submit the same credentials to hundreds of websites to gain access to additional accounts.
Credential stuffing is similar to a brute force attack, but instead of trying random strings or dictionaries of common passwords, it uses known passwords obtained in previous breaches.
10. Advanced Persistent Threat
Advanced persistent threat (APT) is a broad term used to describe an attack in which an intruder or team of intruders gains a long-term presence on a network, usually with the goal of stealing sensitive data.
The targets of these attacks are carefully selected and investigated and often involve large corporate or government networks. Many APT attackers are part of organized cybercrime groups, or might be supported by hostile nation states, meaning they have the resources, technology, and time to conduct highly sophisticated attacks.
APT attackers can use a variety of methods to penetrate a network without being detected. They perform lateral movement, escalate privileges, and deploy malware such as trojans or rootkits that allows them to gain a persistent hold. Attackers may dwell on the network for months or years, continuously exfiltrating valuable data.
11. Supply Chain Attacks
A supply chain attack exploits a weak link in an organization's supply chain. A supply chain is a network of all individuals, organizations, resources, activities and technologies involved in the creation and sale of a product. The supply chain includes all aspects of material delivery, from supplier to manufacturer to end-user delivery.
In several recent attacks, sophisticated attackers targeted the software supply chain, by compromising software components or systems that were trusted by and deployed by thousands of organizations worldwide. This makes it critical for organizations to closely vet the security standards of their vendors, third-party software components, and IT systems.
Learn more in our detailed guide to supply chain attacks
12. Cache Poisoning
Cache poisoning is a network attack in which an attacker injects incorrect information into the Domain Name System (DNS) or web cache to harm users. Attackers use a web server and cache to propagate incorrect information to a DNS server or a target system’s cache, with the goal of delivering malicious Hypertext Transfer Protocol (HTTP) responses to users.
Typically, DNS cache poisoning diverts traffic from legitimate websites to malicious websites controlled by an attacker. This leaves users vulnerable to risks such as malware infection and data theft.
13. HTTP Request Smuggling
HTTP request smuggling attacks exploit inconsistencies in the way two HTTP servers parse a non-RFC-compliant HTTP request. Typically these are a back-end server and an HTTP-enabled firewall or proxy. The attacker crafts several custom HTTP requests that hide or “smuggle” a malicious request in a seemingly benign request.
Through HTTP smuggling vulnerabilities, attackers can bypass security measures, gain access to sensitive information, and hijack user sessions. This attack can also lead to secondary exploits such as firewall bypass, partial cache poisoning, and cross-site scripting (XSS).
14. LFI and RFI
Local file inclusion (LFI) is a web vulnerability that can allow an attacker to run or access a file on a vulnerable website or web application. This can allow the attacker to read sensitive files, access sensitive information, and execute arbitrary commands on the back-end server.
Remote file inclusion (RFI) is the process of including remote files by exploiting a vulnerable include file inclusion process implemented in the application. It is different from LFI because it allows an attacker to execute malicious code from an external source, instead of accessing files already present on a local web server.
In an RFI attack, a hacker uses the dynamic file inclusion capability, present in many web frameworks, to upload a malicious external file or script. If a web application accepts user input (such as URL and parameter values) and passes it to the file inclusion mechanism without proper validation, attackers can perform RFI to inject a malicious script or executable.
15. IDOR
An insecure direct object reference (IDOR) attack occurs when an application provides direct access to an object based on custom input from the user. Attackers can gain direct, unauthorized access to resources by changing the value of a parameter to directly point to an object—which might be a database entry or any file on the local system.
This can allow an attacker to bypass authentication and directly access sensitive resources on the system, such as database records and files.
Learn more in our detailed guide to IDOR vulnerabilities
16. Cloud Misconfiguration
Security misconfigurations are common in cloud environments. They happen when security settings are not defined correctly, or insecure default values are used. A simple example is a cloud bucket containing sensitive data, which is exposed to the Internet with no authentication.
Most cloud-based services can be configured securely, but this requires vigilance on the part of the cloud customer. Misconfiguration often occurs when users set up a cloud resource without properly securing it, leaving it open to exploitation by attackers. In other cases, cloud resources may have been properly secured at the time, but may have become insecure due to a new vulnerability or a change to the cloud environment.
Misconfigured compute instances, storage buckets, cloud databases, containers, or software as a service (SaaS) applications (to name only a few types of cloud resources), can easily be detected by attackers using a variety of scanning tools. Many large-scale, highly publicized breaches were the result of cloud misconfigurations that were not detected and remediated in time by the organization. This raises the need for continuous scanning of cloud systems and rapid remediation of security misconfigurations.
Learn more in our detailed guide to security misconfiguration
How to Prevent Cybersecurity Attacks
Penetration Testing
A penetration test (pen test) is an authorized simulation of a cyber attack against a computer system or network. Penetration testing aims to identify exploitable vulnerabilities and check the organization's security posture. Ethical hackers perform penetration testing to help organizations proactively find and fix critical exploits that may lead to security breaches.
Continuous Application Testing: Bounty Programs and Vulnerability Disclosure Programs (VDP)
A VDP encourages third parties to help an organization discover security vulnerabilities. It establishes clear guidelines for ethical hackers, researchers, and others, how to discover and submit vulnerabilities to the organization. This helps protect organizations from publicly known vulnerabilities, and allows security researchers to operate without fearing legal action.
In a VDP, organizations may occasionally reward researchers, but there is no organized compensation mechanism. A bug bounty program, by contrast, is an organized reward system offered to ethical hackers for discovering and disclosing bugs. Bounty programs pay for each discovered vulnerability. Ethical participants in bug bounty programs can earn full-time incomes, and organizations may toggle programs on and off as needed.
Create a Cybersecurity Awareness Training Program
Research indicates that a contractor or employee may initiate two out of three preventable insider threat incidents. Organizations can protect themselves by creating a cybersecurity awareness training program. It helps identify risky employee behaviors, track improvement metrics, and provide employees with the necessary education, skills, and knowledge for a security-first culture.
Address OWASP Top 10 Vulnerabilities
The Open Web Application Security Project (OWASP) is a non-profit organization dedicated to helping improve application security, providing a free and credible knowledge base on its website. The OWASP top 10 vulnerabilities list includes critical web application vulnerabilities. The list is revised and updated as needed. It is globally recognized as an essential best practices guide for web application security.
Use CVE Databases
Common Vulnerabilities and Exposures (CVE) databases provide a list of publicly disclosed information on security vulnerabilities and exposures. It enables parties to easily share information about known vulnerabilities and quickly update security strategies with the latest security flaws. CVE provides a standardized identifier and name/number for each exposure or vulnerability. Each identifier offers access to specific threats across several information sources.
Monitor Third-party Access to Your Data
Most organizations allow third-party access to their data. Remote employees, business suppliers, vendors, and subcontractors can access corporate information and resources to perform their job and conduct business. However, third-party access opens up the organizations to various insider threats, such as malware and credentials leaks. Organizations can protect their information by monitoring third-party activities and limiting the scope of third-party user access.
Backup Your Data
Backup helps protect your data. If the organization experiences a data breach, loss, or outage, you can recover information from your data backups. You can use data backups to recover an overwritten file and restore deleted files. If a ransomware attack targets your organization, you can use your backup copies instead of paying the ransom.
Conclusion
In this article, we covered 16 common cybersecurity attacks including:
- Data breaches - unauthorized access and theft of data by threat actors.
- Cross site scripting (XSS) - allows attackers to impersonate a user of an application and perform unwanted actions on their behalf.
- SQL injection - involves attackers injecting malicious SQL queries into user inputs.
- Advanced persistent threats - lets attackers gain persistent access to a protected network or system.
- Supply chain attacks - allows attackers to exploit trust relationships between a company and its vendors or suppliers.
- Cloud misconfiguration - involves exploitation of cloud systems that were not properly secured by their users.
To secure your organization against these and other attacks, use a combination of internal protective measures and external help. Internally, you should align developers, operations staff, and security teams around best practices to prevent vulnerabilities in web applications and other critical systems, review third-party vendor relationships, and ensure you have a solid backup strategy.
Beyond that, it is a great idea to involve external security experts in your cybersecurity strategy. Penetration testing and bug bounties are just two ways you can leverage the talent of ethical hackers to discover and resolve your most critical vulnerabilities.