4.2Threats and Attack Techniques (Malware, Web Application Attacks, Social Engineering)

Choosing the right countermeasure starts with identifying what an attack technique actually exploits. Malware exploits software vulnerabilities or careless execution, web application attacks exploit flaws in an app's input handling, and social engineering exploits human psychology and habits. Because the exploited target differs, so does the effective countermeasure—this section organizes representative attack techniques around what each one exploits.

4.2.1Malware and targeted attacks

• A virus parasitizes another program file, self-replicating and spreading as the host program is executed. A worm self-replicates as a standalone program, spreading autonomously across a network to other machines without needing a host. A Trojan horse disguises itself as a harmless program to get in, and performs malicious actions such as installing a backdoor without self-replicating.
• Ransomware encrypts or otherwise disables a victim's files and demands payment in exchange for restoring access. Spyware covertly collects personal information or usage history and transmits it externally without the user noticing. For both, cutting off the infection vector (email attachments, malicious sites, USB drives, etc.) is an effective countermeasure.
• A targeted attack aims at a specific organization or individual, using emails disguised as work-related to trick the recipient into opening a malicious file. Compared with older attacks aimed at unspecified many, it is harder to detect and tends to cause prolonged damage. Phishing uses fake sites or emails impersonating a legitimate organization to trick victims into giving up credentials; verifying URL/domain authenticity is an effective countermeasure.