Cybersecurity Glossary

The problems and aspects of cybersecurity – the set of means and technologies that aim to protect programs, computers, networks, and data against unlawful damage and invasion – arise daily in our personal and professional lives.

Cyber attacks with serious consequences and high impacts are quite common, causing even greater financial losses, as well as serious damage to the companies involved. The media are there to report these attacks. Senior executives lose their positions. The market value of the companies involved falls immediately. And finally, for others, the continuity of their business is seriously affected. These are just some consequences of malicious actions in the environment of organizations of all sizes and industries. And the expectation is not the best: the trend is that the amount and severity of cyber attacks and data leaks will grow in the coming years.

The Main Attack Methods

It is clear that cybersecurity risks are steadily increasing as attacks become more sophisticated and persistent. In addition, the types of attack scenarios also continue to increase, ranging from classic phishing techniques to sophisticated viruses that exploit zero-day vulnerabilities in software.

These attacks can come both from outside the organization and from within, through so-called Insider Threats, which are the ones that pose the greatest risk to a company. Internal employees can offer accidental threats, when what happens is just a lack of proper cybersecurity training, such as when there is negligence on the part of a worker when there is an attempt to bypass the policies implemented. One of the ways to bypass policies is through the Privilege Abuse, when larger-than-necessary permissions are granted to a user. Finally, an insider threat can have malicious motivations, such as financial gain, espionage, or revenge.

Some of the major techniques used by malicious agents to conduct a cyber attack are:

Malware – malicious programs, or malicious software, are also called malware. Programs designed to cause damage to systems or data stored on those systems are defined as malware. Computer viruses, worms, Trojans, spyware, and ransomware are the most important types of malware. Some specific actions taken by these programs include: intercepting the sending and receiving of data on a device, executing unauthorized commands, and stealing and distributing confidential data. It is worth to mention that the damage caused by malware also varies. Malicious actions can range from excluding irrelevant data from a non-critical server to permanent damage to devices and systems, including theft or hijacking of information that is critical to the business.

Phishing – Phishing emails can easily trick even an Information Security professional in a moment of distraction. In some cases, these messages seem authentic, in which malicious agents usually act like a real company that offers a real service, such as a bank that sends a message to an accountant, for instance. These emails usually appear as urgent messages that require immediate action, such as opening a link or opening an attachment to avoid further problems. Some of these messages may even contain legitimate links to disguise malicious links;

Social Engineering – Some of the most successful attacks involve nothing more than a phone call and an excellent persuasiveness. And they have a relatively low cost compared to other techniques used by malicious agents. These social engineers have two main goals: to get access to confidential information or steal that information. Getting access to confidential information can be part of an industrial espionage strategy, for example. But data theft can have financial or even ideological motivations.

Ways to Respond to a Cyber Attack

When it comes to cyber attacks, the question is not whether an organization will be affected, but when the cyber attack will take place. So, it is important to plan and be prepared to respond to malicious actions in your environment. Understanding the types of threats most commonly used by malicious attackers can help Security staff identify a security event before it can become a serious incident. Therefore, one can reduce the impact of malicious actions and resume normal operations as quickly as possible. Some of the key aspects of a company’s response to cyber attacks include:

Incident Response Plan – The purpose of an Incident Response Plan is to provide a guide to effectively deal with a cyber attack, whether through malware, phishing, or social engineering. Through this guide, it is possible to strategically assess which aspects of the business are at risk and to plan actions to mitigate any damages after a cyber attack. These actions can be: restoring systems and files from a backup, performing a fresh installation of an affected system, paying for ransomware, or asking the authorities to find solutions to restore data and systems.

Strengthening User Authentication – To prevent an organization’s credentials from continuing to be used by cyber criminals after an incident, it is recommended that it immediately reset passwords for critical credentials. To further increase the level of security, some systems include the possibility of using two-factor authentication, which combines the password with an additional factor for authentication. This factor can be a PIN or token generated through an application, a physical token or a mobile message via SMS;

Using a Privileged Access Management solution – a PAM is the aspect of Access and Identity Management that deals with users and high privilege credentials in an organization. These privileged credentials enable malicious attackers to gain unrestricted access to corporate resources and critical systems, with far greater privileges than a standard user. A PAM solution has a number of features to protect the company, track critical actions in the environment, and dramatically reduce the consequences of cyber attacks.

Conclusion

Cyber attacks and data leakages are no surprise in the Information Security field. With the increasing sophistication of attacks on organizations of all sizes, a potential cyber attack may be considered inevitable. However, in some environments, a cybersecurity event can have devastating consequences.

Thus, in today’s world, where people and companies are increasingly connected, sensitive data is increasingly vulnerable to improper access and use. In this context, cybersecurity should be the responsibility not only of companies, but of employees, suppliers, and business partners.