Contact Us
en
types of cyber security threats
Article

5 Key Types of Cyber Security Threats and How to Stay on Top of Them

Over the last year, data losses and cyber events have reached record-high numbers. Therefore, cyber security has become a top priority for everyone, including large businesses and small- to -medium-size enterprises, governments, and individuals. Let's explore the most common types of cyber security threats and how to protect against them.

The year 2020 has spurred the transition to remote work; 88% of companies globally have transitioned to working from home. And while offices are equipped with well-protected routers and firewalls, remote work has made it easier for cybercriminals to attack more vulnerable employees’ devices and networks.

In 2021, 35% of enterprises reported an increase in cyber attacks. Hence, more businesses started looking for ways to build up their cyber defence, often partnering with experienced providers of cyber security services.

The cyber security threat involves malign actions with the intention of gaining access to or stealing sensitive data and damaging or disrupting the network of another individual or organisation. A cyber attack can be launched by different malicious actors, including an individual hacker, a terrorist group or even a trusted individual like an employee or contractor. In this article, we look at the most common types of cyber security threats and share some expert advice on protecting your organisation against them.

5 types of cyber security threats to watch out for in 2021 and beyond

Cyber threats are changing and evolving from day to day. However, to prevent cyber attacks, companies should be aware of the most common threats and strengthen their security against possible breaches.

1. Social engineering

Social engineering is the process of manipulating a person into disclosing confidential information or installing malware on their device. According to ISACA, social engineering is indicated as one of the most common cyber threats. What is worse, this threat comes in all shapes and sizes. Here is a rundown of its most common forms.

Phishing is when hackers pretend to be a trusted person or company by using their proper logos and names. The hackers send an email to an individual or group of individuals asking them to perform a certain action, such as verifying their mailing address or providing their credit card number, login credentials or other valuable personal information.

Phishing can further be divided into subcategories. For instance, spear phishing is an attack targeted at a specific person. Malicious actors gather information about a person that is available online and tailor email correspondence accordingly to sound more convincing. Another category of phishing is whaling. This involves the hackers target a company’s CEO or CFO. Here are some other examples:

  • Vishing or voice phishing is using phones to record and gain access to sensitive data.
  • Smishing or SMS phishing involves accessing text messages.
  • URL phishing is when an attacker includes a malicious URL.

Baiting involves hackers tricking victims into taking a particular action by offering them something desirable or playing with their curiosity, for example, by offering the possibility of downloading a free movie. Attackers might also use a USB flash drive, for instance, by handing it to their target at a conference or leaving it where it will be found by their target in a cafe. And while a victim may think it is just a free storage device, the hacker has loaded it with malware that can damage the victim’s software.

Quid pro quo is very similar to baiting. But instead of offering a product, cyber criminals provide a service. For instance, they contact their victim and offer to fix a bug in their system. However, to access the support on offer, the victim will need to share their credentials.

Scareware attacks involve hackers scaring their victim into doing something. This type of attack usually requires the victim to act quickly. For example, a person might receive an email claiming that someone has hacked their account, and that they need to act now and change their credentials to secure the account. By responding to the hackers’ claims and changing their credentials, the victim gives them to the attackers.

Piggybacking and tailgating are two very similar types of attack. Piggybacking is when a criminal tags along with an authorised person to gain access to a restricted area. This type of attack can be electronic or physical. Tailgating involves a criminal accessing a restricted area by closely following an authorised person. In both cases, malicious actors can get access sensitive information and use a device to steal data or breach a system.

2. Malware

Malware is malicious software or code that uses a vulnerability to breach an organisation’s network. Cybercriminals can enter malicious code into a company’s software to compromise its security systems, deny access to critical information or critical assets, and gain access to sensitive data. There are several variations of malware. Let’s go through the most common types.

  1. Ransomware attacks involve blocking a user’s data and threatening to publish or delete it unless a ransom payment is made.
  2. Viruses infect a company’s computer systems and spread around the whole network. Malicious actors can use viruses to make a profit, send a political message or sabotage a company.
  3. Trojans are malicious programs that are inserted into a useful program. They are typically used to create a “backdoor” for cybercriminals to access a company’s systems.
  4. Spyware collects information about an individual. This sensitive data can then be used to blackmail the person or install other malicious programs onto their device.

Man in the middle

A man in the middle (MITM) attack involves a hacker intercepting a conversation or transaction between two parties. For instance, when an individual connects to a public Wi-Fi network, a criminal who is aware of a vulnerability in the system can interrupt the traffic and receive the information being shared between the parties.

Denial of service attack

This involves an attacker disrupting a network’s normal traffic by overloading it, meaning it cannot respond. The denial of service (DoS) can be used to demand a ransom or disrupt operations. When an attack simultaneously targets multiple devices or systems, it is called a distributed denial of service (DDoS) attack.

A domain name system (DNS) attack is a type of DDoS attack where cybercriminals take advantage of vulnerabilities in DNS servers. Thus, when users enter what they believe to be a trusted address, the DNS server is compromised, and the users are redirected to malicious sites.

Cloud breach

With many organisations transitioning to cloud-based systems, an increasing number of hackers are targeting cloud security. Cyber criminals exploit weaknesses in cloud deployment and security misconfigurations to access and steal the assets and sensitive data of companies.

preventive actions enterprises can take to avoid it security vulnerabilities

 

Top recommendations to protect your network from cyber attacks

There’s no one-size-fits-all approach to avoiding cyber attacks completely, but companies can potentially get ahead of all the types of cyber security threats and mitigate their risks by being proactive. Here are our top tips for companies to protect their networks.

Educate employees

Once your employees are forewarned, they become forearmed, and it is harder for cybercriminals to trick them into doing something or disclosing information. Make sure that your employees:

  • Do not open unsolicited links
  • Do not disclose personal information to third parties
  • Use two-factor authentication
  • Create unique and strong passwords
  • Do not use unsecured Wi-Fi networks
  • Do not leave their devices unattended
  • Keep programs and systems up to date

Ask your security team to conduct regular training simulating hackers and observe how your employees react. Identify pain points and make sure that your staff are prepared should such a situation ever occur for real.

Take preventive measures

Apart from training sessions, consider the following preventive measures to protect your systems:

  • Set spam filters to detect threats and stop phishing emails from reaching end-users.
  • Block access to known malicious IP addresses by configuring firewalls.
  • Install anti-virus and anti-malware programs to regularly scan software for potential threats.
  • Provide a list of safe programs that can be downloaded onto corporate devices.
  • Make sure that only those who absolutely need access have administrator accounts.
  • Manage access controls. For example, those who only need to read a file don’t need editing rights.

Ensure business continuity

Cyber security incidents often activate business continuity and disaster recovery plans. Ensure that in case of an attack, critical business infrastructure is safe and services delivery is maintained. The following steps can be taken to achieve this:

  • Create data backups and make sure the restoration process is working.
  • Conduct regular penetration testing and vulnerability assessments to evaluate the security of a system and define its vulnerabilities.
  • Ensure that critical data backups are secured. For example, some cloud-based backups can be locked in case systems are continuously backed up in real-time.

Final thoughts

With increasing reliance on digital technologies, companies should also increase the maturity of their cyber security to navigate this uncertain environment. Experienced cyber security partners can help identify weak points in your security system and shield your company against all types of cyber security threats.

Contact us today to start taking measures to prevent cyber attacks and mitigate the risks they pose.

ESET Benefits from Hiring a Flexible QA Team and Assessing IT Security Risks
View Case Study
eset
Have a question?
Speak to an expert
Contact Us
  • We need your name to know how to address you
  • We need your phone number to reach you with response to your request
  • We need your country of business to know from what office to contact you
  • We need your company name to know your background and how we can use our experience to help you
  • Accepted file types: jpg, gif, png, pdf, doc, docx, xls, xlsx, ppt, pptx, Max. file size: 10 MB.
(jpg, gif, png, pdf, doc, docx, xls, xlsx, ppt, pptx, PNG)

We will add your info to our CRM for contacting you regarding your request. For more info please consult our privacy policy
  • This field is for validation purposes and should be left unchanged.

The breadth of knowledge and understanding that ELEKS has within its walls allows us to leverage that expertise to make superior deliverables for our customers. When you work with ELEKS, you are working with the top 1% of the aptitude and engineering excellence of the whole country.

sam fleming
Sam Fleming
President, Fleming-AOD

Right from the start, we really liked ELEKS’ commitment and engagement. They came to us with their best people to try to understand our context, our business idea, and developed the first prototype with us. They were very professional and very customer oriented. I think, without ELEKS it probably would not have been possible to have such a successful product in such a short period of time.

Caroline Aumeran
Caroline Aumeran
Head of Product Development, appygas

ELEKS has been involved in the development of a number of our consumer-facing websites and mobile applications that allow our customers to easily track their shipments, get the information they need as well as stay in touch with us. We’ve appreciated the level of ELEKS’ expertise, responsiveness and attention to details.

Samer Awajan
Samer Awajan
CTO, Aramex