What Is a Cyberattack?

Types of Cyberattacks

• Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS)

  A DoS attack overwhelms an information system’s resources, so it can’t respond to service requests. Simply put, it inundates the company with traffic to consume its capacity and resources. Consequently, the system is incapable of fulfilling real customer requests.

  In this type of attack, cybercriminals send more traffic than the targeted device can manage, causing it to fail, for example, rendering it incapable of providing a service to users. Some examples of targets include online banking, websites, email, or any other service that relies on a targeted computer or network.

  A DDoS attack also overwhelms a system’s resources. However, it’s launched from multiple compromised devices. Often botnets are used for DDoS attacks. A botnet is a network of Internet-connected devices, each of which runs multiple software applications that perform automated tasks. In such an approach, you can’t stop the attack just by blocking the source of the traffic

• Malware

  Malware is malicious code or software and includes things like viruses, worms, ransomware, and spyware. Malware usually gets a foothold when a user clicks a risky email attachment or link that then installs dangerous software.

  Once malware penetrates a system, it can install additional damaging software, restrict access to crucial network components until a ransom is paid (ransomware attacks), disrupt certain components and render the system inoperable, or steal information by transmitting data from the hard drive (spyware).

• Man-in-the-Middle (MitM)

  Also called an eavesdropping attack, a MitM attack occurs when cybercriminals interrupt a transaction between two parties. The objective is to disrupt traffic to filter and steal information.

  For example, when using unsecured public Wi-Fi, cybercriminals can insert themselves between a user’s device and the network. Unknowingly, the user passes all data through the attacker. Another point of entry for attackers is malware that has already breached a device, which they can then use to install additional software to process the victim’s data.

• Phishing

  Phishing is a type of cyberattack in which an attacker sends false communications that look like they’ve originated from a trustworthy source, typically through email. The objective is to steal confidential information such as credit card and login data or to install malware on the victim’s device.

  Phishing is the most common kind of cyberattack. In 2021, 83% of businesses reported experiencing phishing attacks.⁴ An additional 6 billion attacks are likely to occur in 2022.⁵

  Here’s an example of a phishing attack: A person receives an email that looks like it came from their bank informing them that their online bank account has been compromised and will be disabled unless they verify their credit card information. The link in the email takes the person to a bogus website. When they fill in their credit card details, that information is stolen and used to carry out further crimes.

• SQL Injection

  SQL injection is when a criminal places malicious code in the SQL statements of a company’s website. As a result, the database of that website might be destroyed.

  An SQL injection attack allows criminals to retrieve the contents of a file, change (insert, update, or delete) data in the database, access confidential information from the database, run administration operations (like shutdown) on the database, and, in some instances, generate commands to the operating system.

  For example, an embedded form on a site may request a person’s account name and then send it to the database to fetch the linked account details via dynamic SQL.