Below is a breakdown of the 10 most common types of cyberattacks plaguing organizations around the globe today.
1. Malware
Malware, which is a catch-all term and short for “malicious software,” uses a vulnerability to breach a network when a user clicks a dangerous link or email attachment, which is then used to install malicious software inside the system. Malware can do many things, including deny access to the critical components of a network, obtain information by retrieving data from the hard drive, and even render a system inoperable.
Ransomware, which is a type of malware that denies access to data and threatens to publish or delete it unless a ransom is paid, has significantly impacted schools and hospitals in recent months. In the first six months of 2021, globally, the education sector saw a 615% spike in ransomware incidents compared to 151% across all sectors. The healthcare sector saw a 594% increase. In three out of six months during the first half of 2021, education customers saw even more ransomware attempts than government customers.
Most law enforcement agencies try to discourage compromised organizations from paying a ransom because it funds malicious groups. The FBI says organizations should not pay a ransom because it doesn’t guarantee that you’ll get data back and it encourages more ransomware activities.
However, a recent survey has found that 83% of ransomware victims give in to their attackers’ demands, and nearly two out of three organizations were victims in the past year.
Tragically, an Alabama mother is suing Springhill Medical Center after she says her baby received botched care and later died while the hospital was dealing with a ransomware attack. The lawsuit was the first credible public claim that someone’s death was caused at least in part by hackers. This is just one example of the possible threat posed by a lack of solid cybersecurity practices.
2. Phishing
Phishing attacks masquerade as legitimate requests for information through email and trick users into revealing account credentials or other information. Some attackers leverage fake domains that are similar to legitimate websites in an attempt to capture credentials. The emails often appear to be legitimate but link the recipient to a malicious file or script designed to give hackers access to the device and take control.
Phishing attacks can also take place through phone calls (voice phishing), text messages (SMS phishing), or on social media networks through direct messages.
3. Man-in-the-Middle Attakcs
These attacks occur when a hacker intercepts the communication between two parties in an attempt to spy on the victims, steal personal information or credentials, or alter the conversation in some way.
Man-in-the-Middle attacks are less common these days as most email and chat systems use end-to-end encryption which prevents third parties from tampering with data that is transmitted across the network, regardless of whether the network is secure or not. This type of attack often exploits unsecured public WiFi networks.
Phishing or malware attacks are often leveraged to carry out a Man-in-the-Middle attack.
4. Denial-of-Service Attacks
Denial-of-Service (DOS) attacks work by flooding systems, servers and/or networks with traffic to overload resources and bandwidth, potentially resulting in the system being unable to process and fulfill legitimate service requests. Most sophisticated firewalls are able to detect and respond to DoS attacks.
However, Distributed Denial-of-Service (DDOS) attacks are launched from several infected devices with the goal of achieving service denial and taking a system offline, making way for another attack to enter the network environment. In October of 2020, a DDoS attack paralyzed the Miami-Dade County Public School’s e-learning platform.
A 2020 report found that four out of five companies experienced a DNS attack, with traditional DDoS making up 27% of the attacks (39% experienced phishing attempts and 34% experienced malware-based attacks).
In 2019, a man was sentenced to 10 years in prison and ordered to pay $443,000 for launching a DDoS attack against several U.S children’s hospitals in 2014. Authorities said the hackers knocked Boston Children’s Hospital offline for days, disrupting the day-to-day operations and research capabilities.
5. Internet of Things Attacks
The Internet of Things (IoT) is a network of Internet-connected objects able to collect and exchange data, such as IP phones, printers, intercom systems, and security cameras. IoT devices are generally less secure than most modern operating systems, making them a big target for hackers. The interconnectedness of IoT devices makes it possible for hackers to breach an entry point and use it as a gate to exploit other devices in the network.
More than 30% of all network-connected endpoints are IoT devices, and a 2019 report found the adoption of enterprise IoT grew 21.5% from 2018 to 2019, totaling an estimated 4.8 billion devices.
A 2020 report analyzed security incidents spanning 1.2 million IoT devices in thousands of locations across enterprise IT and healthcare organizations in the US. The analysis found that “the general security posture of IoT devices is declining, leaving organizations vulnerable to new IoT-targeted malware as well as older attack techniques that IT teams have long forgotten.” It also found 98% of all IoT devices are unencrypted, potentially exposing personal and confidential data.
6. Password Attacks
This is a type of cyberattack where a hacker tries to guess a user’s password. Methods used to identify an individual password include social engineering, gaining access to a password database, testing the network connection to obtain unencrypted passwords, or simply by guessing.
In 2020, remote work and distance learning brought on a whole host of cybersecurity issues which were compounded by the surge in the use of videoconferencing platforms like Zoom, Microsoft Teams and Google Meets. Through this surge, researchers discovered that tiny visual cues and an algorithm can be used by hackers to guess a user’s password if they sign in to an account while on a video call.
A hacker can use a methodology called keystroke inference, which is essentially watching the shoulders and upper arms for clues as to what the user at the other end of the call is typing.
It is likely we’ll see less and less of these attacks as more options become available for identity verification. For the first time in four years, passwords did not earn a spot in the top three most secure methods for authenticating a customer’s identity. This is especially good news since a 2020 survey found Millennial workers are 6.5 times more likely to reuse work passwords than Baby Boomers, who use safer password practices.
Cybersecurity experts recommend companies integrate a two-factor authentication system or a password manager. Neither requires employees to recall complex strings of characters and both better protect data.
7. Server Query Language Injections
Server Query Language (SQL) injections occur when an attacker inserts malicious code into a service using SQL language, forcing the server to deliver protected information. It usually involves submitting malicious code into an unprotected website comment section or search box.
SQL databases use SQL statements to query data, and these statements are typically executed through an HTML form on a webpage, according to Lepide. If the database permissions have not been set properly, the attacker may be able to exploit the HTML form to execute queries that will create, read, modify or delete the data stored in the database.
8. Cross-Site Scripting Attacks
Cross-Site Scripting (XSS) attacks are similar to SQL injection attacks except instead of extracting data from a database, they are usually meant to infect other users who visit the site. Using the example of the comments section on a webpage, Lepide says if the user input isn’t filtered before the comment is published, an attacker can publish a malicious script that is hidden on the page. When the user visits the page, the script can infect their device or be used to extract the user’s credentials. The attackers could also redirect the user to a malicious website.
9. Zero-Day Exploits
In these cyberattacks, hackers learn of a new vulnerability in a widely-used software program or operating system and then target organizations who use that software to exploit the vulnerability before a fix becomes available. With an increasing number of new software and apps being released every day, these cyberattacks are becoming more common than ever.
10. Rootkits
Rootkits are installed inside legitimate software and enable attackers to gain remote control and administration-level access over a system. Since rootkits hide in legitimate software, once a user allows the program to make changes to their operating system, the rootkit installs itself in the system and remains dormant until the attacker activates it or it is triggered through a persistence mechanism. Rootkits are typically spread through email attachments or downloads from insecure websites.
Cybersecurity Solutions from the ISG
It is clear that cyberattacks are a real threat to hospitals, K-12 school districts and colleges campuses, and have been worsened by the pandemic. Strong cybersecurity practices are a must-have to truly ensure the safety and security of all students, patients and employees.
Contact us today to speak with your local ISG expert about the various cybersecurity solutions they offer!
The original article was written by Amy Rock for Campus Safety Magazine.
