1.3Cyberattack Techniques (Malware, Targeted Attacks, Web App Attacks, DoS, Supply Chain Attacks)

A manager's purpose in learning attack techniques is not to implement the attack mechanics, but to judge which attacks pose the greatest risk to their organization and which controls are effective against them. Each technique exploits a different target—a software vulnerability, an application's input handling, human psychology, or the trust relationship with a partner—so misclassifying an attack leads to an ineffective countermeasure. This section organizes representative attack techniques around what a manager needs to know: how to tell them apart and where the response priorities lie.

1.3.1Malware, targeted attacks, and BEC

• Main types of malware: a virus (parasitizes another program and spreads with it); a worm (self-replicates standalone, spreading over a network); a Trojan horse (disguises itself as harmless, does not self-replicate); ransomware (encrypts files and demands a ransom); and spyware (covertly collects information and sends it out). Cutting off the infection vector (email attachments, malicious sites, USB drives, etc.) is the common first-line countermeasure.
• A targeted attack aims at a specific organization, using emails disguised as work-related to trick recipients into opening a malicious file. Because it is harder to detect and tends to cause prolonged damage than attacks aimed at unspecified many, early detection after intrusion (monitoring for suspicious internal traffic) matters as much as perimeter defense. Phishing uses fake sites or emails impersonating a legitimate organization to trick victims into giving up credentials.
• A BEC (business email compromise) attack uses email impersonating a business partner or executive to trick a staff member into making a wire transfer or disclosing personal data. Its distinguishing feature is that it aims for financial loss through email content alone, without malware, so a business process requiring verification of any change to payment details via a separate channel, such as a phone call, is a more effective countermeasure than a purely technical one.

1.3.2Web app attacks, DoS, password attacks, and supply chain attacks

• SQL injection injects malicious SQL into an input field to manipulate a database improperly (countermeasure: prepared statements). XSS injects malicious script into a web page so it runs in a viewer's browser (countermeasure: sanitizing). CSRF tricks a logged-in user into sending an unintended request (countermeasure: one-time tokens).
• A DoS attack exhausts a target server's capacity with a flood of requests. A DDoS attack is a DoS attack distributed across many machines (often a botnet), which cannot be stopped by blocking a single source. Password attacks: a brute-force attack tries every combination; a dictionary attack tries known weak passwords; a password-list attack exploits credentials reused from a breach at a different service. Countermeasures: account lockout, multi-factor authentication, and prohibiting password reuse.
• A supply chain attack uses a business partner, outsourced vendor, or software supplier with weaker security as a stepping stone to reach the real target — typically a large enterprise or critical infrastructure. Even if an organization hardens its own security, a compromised partner can provide a legitimate access route in, so vendor selection criteria, security requirements written into contracts, and periodic audits are the key management controls (covered in more depth in Chapter 5).

Consider a security officer at a mid-sized company reporting three attack attempts or incidents from the quarter to a management meeting. The first involved an email to the accounting department impersonating a business partner's executive, claiming "the payment account has changed, please transfer funds urgently." With no attachment, relying on email content alone to extract money, this is a textbook BEC attack; fortunately the staff member sensed something was off and called the partner directly, confirming it was fraudulent. In response, the company formalizes a rule that "any notice of a change in payment details must be verified by phone using a previously registered number." The second involved a flood of exploratory traffic probing the product search field on the company's e-commerce site with malicious strings — reconnaissance aimed at SQL injection — and the officer reports it was detected and blocked via WAF logs, while also confirming the thoroughness of using prepared statements throughout. The third involved a parts-supplying vendor separately suffering a ransomware attack, in which design data belonging to the company, held by that vendor, was encrypted and stolen. Even though the company's own network and servers were never directly attacked, information still leaked via a supply chain attack. Prompted by this incident, the company revises its practice to spell out security requirements for vendors in contracts — encryption, access control, and a prompt notification obligation upon an incident — and to require an annual third-party assessment. Across the three cases, the lesson is that the effective countermeasure differs entirely depending on whether the entry point is one's own system, a person (via email content), or a vendor.

1.3.3Section summary

• Malware types are identified by how they replicate (virus/worm/Trojan). Cutting off the infection vector is the common first-line countermeasure
• BEC exploits email content alone, without malware. The countermeasure is a verification process via a separate channel
• Supply chain attacks use a vendor or supplier as a stepping stone. The countermeasure is security requirements written into contracts plus periodic audits