Lesson 1: Advanced Threats and Attack Techniques

Modern cyber threats often target the confidentiality, integrity, and availability (CIA) of information systems. Malware is malicious software designed to disrupt or gain unauthorized access. Types of malware include viruses (self-replicating code attaching to files), worms (standalone programs that spread across networks), trojan horses (malicious code disguised as legitimate software), and ransomware (encrypts files to extort payment). Each can steal data, corrupt information, or block system availability. For example, ransomware like WannaCry can make critical data inaccessible until a payment is made. Organizations must use up-to-date antivirus software and backup systems to mitigate these threats.

Attackers often use social engineering to trick users into revealing credentials or downloading malware. Phishing is a common tactic: fraudulent emails or messages mimic trusted sources to steal passwords or install malware. Variations include spear-phishing (targeted emails) and vishing (phone-based phishing). For instance, a fake email claiming to be from "HR Department" asking to reset your password can compromise corporate systems. Vigilant practice—such as verifying the sender's address, not clicking unknown links, and never giving out passwords—helps prevent these attacks.

Many attacks exploit web applications. SQL Injection (SQLi) occurs when attackers insert malicious code into database queries, potentially exposing or altering data. Cross-Site Scripting (XSS) allows attackers to inject scripts into web pages that run in other users' browsers. Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting unintended commands. These attacks exploit poor input validation or session management. For example, a vulnerable login form that concatenates input directly into a SQL query can allow an attacker to retrieve user passwords via SQLi.

Networks have specific vulnerabilities. A Denial of Service (DoS) attack floods a server or network with traffic, causing legitimate requests to be dropped. A Distributed DoS (DDoS) uses many compromised machines (a botnet) to overwhelm targets, making mitigation harder. Man-in-the-Middle (MITM) attacks intercept communication; for example, an attacker on a public Wi-Fi could eavesdrop on unencrypted traffic. Attackers may also spoof IP or MAC addresses or exploit protocol flaws. Regular patching, secure network configurations, and intrusion prevention tools help reduce these risks.

Ready to apply this? The practice set below walks through exam-style problems with step-by-step solutions and a hands-on defense exercise.

Review Questions

1. What are the three goals of information security known as the CIA triad?
2. Explain the difference between a computer virus and a worm.
3. Describe a typical social engineering attack (e.g., phishing) and one way to prevent it.
4. What is SQL Injection and why is it dangerous for web applications?
5. How does a DDoS attack work, and what can organizations do to mitigate its impact?

Worked Examples

Problem: A website has a login form where entering username='admin' OR '1'='1' in the username field logs you in without a password. Identify the vulnerability and suggest a fix.

Solution: This is SQL Injection. The input bypasses authentication by exploiting unfiltered input in the SQL query. The fix is to use parameterized queries or prepared statements and validate user input to prevent SQL code execution.

Problem: A company server receives an overwhelming flood of traffic from many sources, causing a crash. Which attack is this and how can it be prevented?

Solution: This describes a Distributed Denial of Service (DDoS) attack. Prevention can include using firewalls or anti-DDoS services to filter malicious traffic, deploying redundant servers or using a content delivery network (CDN) to absorb traffic, and keeping network resources scalable.

Problem: An employee receives an email that looks like it's from HR asking for login credentials to update benefits. How should the employee respond, and what is this attack?

Solution: This is a phishing attack (social engineering). The employee should verify with HR directly (e.g., by calling the HR office), and should not click any links or provide credentials. Confirm legitimacy through a trusted channel and report the attempt to the IT/security team.

Hands-On Exercise

Try using a basic firewall on your computer. For example, configure Windows Defender Firewall or a Linux ufw (Uncomplicated Firewall) rule to block incoming connections on a specific port (like port 80). Observe how this can prevent unauthorized access to services. (This practice helps you understand perimeter defenses and blocking unnecessary network access.)

How to Pass

• Always mention the CIA triad (Confidentiality, Integrity, Availability) when discussing threats.
• Understand key examples and differences (virus vs worm, DoS vs DDoS). Professors often expect specific examples (WannaCry ransomware, a famous DDoS incident).
• For social engineering or phishing, emphasize user awareness and double-checking sources.
• Remember relevant laws like the Data Privacy Act (RA 10173) and how it relates to data breaches.
• Practice analyzing simple scenarios; explain both the attack and how you would fix or prevent it. Common mistakes: neglecting mitigation steps or confusing attack types.