It's one thing to know generally that your systems are under fire from hackers around the world and malicious users around the office; it's another to understand specific attacks against your systems. This section discusses some well-known attacks but is by no means a comprehensive listing.
Many security vulnerabilities aren't critical by themselves, but exploiting several vulnerabilities at the same time can take its toll on a system or network environment. A default Windows operating system (OS) configuration, a weak SQL Server administrator password, or a server running on a wireless network may not be a major security concern by itself. But someone who exploits all three of these vulnerabilities at the same time could enable unauthorized remote access and disclose sensitive information (among other things).
REMEMBER: Complexity is the enemy of security. Vulnerabilities and attacks have grown enormously in recent years because of virtualization, cloud computing, and even social media. These three things alone add immeasurable complexity to your environment.
Nontechnical attacks
Exploits that involve manipulating people - end users and even you - are the greatest vulnerability in any computer or network infrastructure. Humans are trusting by nature, which can lead to social-engineering exploits. Social engineering is exploiting the trusting nature of human beings to gain information - often via email phishing - for malicious purposes.
Other common effective attacks against information systems are physical. Hackers break into buildings, computer rooms, or other area that contain critical information or property to steal computers, servers, and other valuable equipment. Physical attacks can also include dumpster diving - rummaging through trash cans and bins for intellectual property, passwords, network diagrams, and other information.
Network infrastructure attacks
Attacks on network infrastructures can be easy to accomplish because many networks can be reached from anywhere in the world via the internet. Examples of network infrastructure attacks include the following:
• Connecting to a network through an unsecured wireless access point attached behind a firewall.
• Exploiting weaknesses in network protocols, such as File Transfer Protocol (FTP) and Secure Sockets Layer (SSL).
• Flooding a network with too many requests, creating denial of service (DoS) for legitimate requests.
• Installing a network analyzer on a network segment and capturing every packet that travels across it, revealing confidential information in clear text.
Operating system attacks
Hacking an OS is a preferred method of the bad guys. OS attacks make up a large portion of attacks simply because every computer has an operating system., they are susceptible to many well known exploits, including vulnerabilities that remain unpatched years later.
Occasionally, some OSes that tend to be more secure out of the box - such as the old but still out there Novel Netware, and IBM Series 1 - are attacked, and vulnerabilities turn up. But hackers tend to prefer attacking Windows, Linux, and Mac OS because they're more widely used.
Here are some examples of attacks on operating systems:
• Exploiting missing patches
• Attacking built-in authentication systems
• Breaking file system security
• Cracking passwords and weak encryption implementations
Application and other specialized attacks
Applications take a lot of hits by hackers. Web applications and mobile apps, which are probably the most popular means of attack, are often beaten down. The following are examples of attacks and related exploits that are often present on business networks:
• Web applications are everywhere. Thanks to what's called shadow IT, in which people in various areas of the business run and manage their own technology, web applications are in every corner of the internal network and out in the cloud. Unfortunately, many IT and security professionals are unaware of the presence of shadow IT and the risks it creates.
• Mobile apps face increasing attacks, given their popularity in business settings. There are also rogue apps discovered on the app stores that can create challenges in your environment.
• Unsecured files containing sensitive information are scattered across workstation and server shares as well as out into the cloud in places like OneDrive and Google Drive. Database systems also contain numerous vulnerabilities that malicious users can exploit.
About the Book Author
Kevin Beaver is an independent information security consultant with more than three decades of experience. Kevin specializes in performing vulnerability and penetration testing and security consulting work for Fortune 1000 corporations, product vendors, independent software developers, universities, and government organizations. He has appeared on CNN and been quoted in The Wall Street Journal.
Stop hackers before they hack you!
In order to outsmart a would-be hacker, you need to get into the hacker's mindset. And with this book, thinking like a bad guy has never been easier. In Hacking For Dummies, expert author Kevin Beaver shares his knowledge on penetration testing, vulnerability assessments, security best practices, and every aspect of ethical hacking that is essential in order to stop a hacker in their tracks.
Whether you're worried about your laptop, smartphone, or desktop computer being compromised, this no-nonsense book helps you learn how to recognize the vulnerabilities in your systems so you can safeguard them more diligently-with confidence and ease.
• Get up to speed on Windows 10 hacks
• Learn about the latest mobile computing hacks
• Get free testing tools
• Find out about new system updates and improvements
More Network Security Articles:
• Denial of Service Attack (DoS) Detection and Mitigation
• Overview of IPsec with IKEv1
• Avoid Hacks by Rogue Wireless Devices
• Domain Name System (DNS) Vulnerabilities
• Email Security
• Firewall Perimeter Network (DMZ)
• Multi-Layered Approach to Cyber Security
• Wireless Network Security - The Basics of Securing a Wireless LAN
• What is a SQL Injection Attack?
• Design a Network Security Policy