WHAT ARE COMPUTER SECURITY THREATS

Computer security threaths can be defined as negative online activities which aims at gaining unauthorized access into computer systems with the sole aim of stealing sensitive and confidential information from company’s and individual websites to the benefit of the online thief. These online thieves are called hackers.

What are the sources of computer security threats?

Primary sources of threats are employees/insiders, malicious hackers, natural disasters, foreign adversaries, and hostile attacks. In several cases, the areas for sources of threats may overlap. For example, hostile attacks may be performed by foreign adversaries or a disgruntled employee.

Who are computer security threat agents?

A threat agent (also called a threat actor is. any person or thing that acts (or has the power to act) to cause, carry, transmit, or support a threat. Examples of threat agents are malicious hackers, organized crime, insiders (including system administrators and developers), terrorists, and nation states.

The following are the types of computer security threats.

Spoofing

Spoofing is when someone hides their identity to evade detection for their wrong acts and pretends to be someone else in an attempt to gain trust and get sensitive system information. The common spoofing done by changing the hardware or MAC address is called MAC cloning, changing the IP address or the unique identity on the network is called IP spoofing, and impersonating as someone else in their digital communication is called email spoofing.

4.2 Information-gathering attacks

Information gathering is the practice of attacker gaining priceless details about probable targets. This is not an attack but only a pre-phase of an attack and is totally passive as there is no explicit attack. Systems including computers, servers, and network infrastructure, including communication links and inter networking devices, are sniffed, scanned, and probed for information like whether the target system is up and running, what all ports are open, details regarding the operating system and its version, etc. Some of the information-gathering attacks are sniffing, mapping, vulnerability scanning, phishing, etc.

4.3 Password attacks

The simplest way to achieve control of a system, or any user account, is through a password attack. If the personal and behavioral details of the victim are known, the attacker starts with guessing password. Frequently, the attacker uses some form of social engineering to trace and find the password. Dictionary attack is the next step in password attacks and is automated.

4.4 Malware

After gaining access to a system, the attacker takes the support of malware or malicious software that clandestinely acts against the interests of the computer user.

4.5 Virus

Computer viruses are the most communal threat to the computer users. Computer viruses are malicious software designed to blow out from one computer to another through file transfer, piggybacks on genuine programs and OS, or e-mails. The email attachments or downloads from particular websites contaminate the computer and also other computers on its list of contacts by using the communication network. Viruses influence the system security by changing the settings, accessing confidential data, displaying unwanted advertisements, sending spam to contacts, and taking control of the web browser [2]. The viruses are identified as executable viruses, boot sector viruses, or e-mail viruses.

4.6 Worms

Computer worms are fragments of malicious software that reproduce swiftly and blow out from one computer to another through its contacts, again spreading to the contacts of these other computers and so on and reaching out to a large number of systems in no time. Captivatingly, worms are prepared for spreading by exploiting software vulnerabilities. Worms display unwanted advertisements. It uses up tremendous CPU time and network bandwidth in this process thereby denying access to the systems or network of the victim, creating chaos and trust issues on a communication network.

4.7 Trojans

Trojans are programs that appear as perfectly genuine but, in reality, have a malicious part embedded in it. Trojans are spread usually through email attachment from the trustworthy contacts and also on clicking on fake advertisements. The payload of Trojans is an executable file that will install a server program on the victim’s system by opening a port and always listening to that port whereas the server is run on the attacker’s system. Hence, whenever the attacker wants to login to the victim machine, they can do so by means of the backdoor entry making it hidden from the user.

4.8 Spyware and adware

Spyware and adware are software with a common property of collecting personal information of users without their knowledge. Adware is intended to track data of the user’s surfing behaviors, and, based on that, pop-ups and advertisements are displayed. The adware clause in the agreement during the installation process is often skipped with least seriousness. Spyware on the other hand gets installed on a computer and gathers information about the user’s online activities without their knowledge. Spyware contains keyloggers that record everything typed on the keyboard, making it unsafe due to the high threat of identity mugging.

4.9 Scareware

Scareware is yet another malware that tricks victims by displaying fake alerts and forcing the victim to buy protective software that is fraudulent. The alerts or the pop-up messages sound like warning messages along with proper protective measures, which if followed creates security issues.

4.10 Rootkit

Rootkit is a pool of software tools that gets mounted in stealth along with some genuine software. Rootkit allows remote access and administrative control on a system. With these privileges, the rootkit performs malicious activities like disabling of antivirus, password sniffing, keylogging, etc.

4.11 Keylogger

Keylogger software has the ability to record keystrokes and also capture screenshots and save it to a log file in encrypted form. Keylogger software can record all the information that is typed on the keyboard including passwords, e-mail, and instant messages. The log file created by the keylogger is saved and mailed to the attacker on a remote machine with the motive to extract password and banking details for financial fraud.

4.12 Ransomware

Ransomware is a malicious software that hampers admission to computer or files on the computer. The computers may be locked or files encrypted. Accordingly, the two common types of ransomware are lock screen ransomware and encryption ransomware. The victim will be demanded ransom for the restriction to be removed, and this gets displayed on victim’s system. There can also be notification stating that establishments have detected illicit activity on this computer and demands ransom as fine to avoid prosecution.

4.13 Rogue security software

Rogue security software is another malicious program that deceives users to believe that there is malware installed on their system or the security measures are outdated and hence of concern. They offer installing or updating users’ security settings. Then it is an actual malware that gets installed on the computer.

4.14 Botnets

A collection of compromised systems or bots acts as a team of infected computers under the control of a bot master to remotely control and send synchronized attacks on a victim host. This army of bots, agents, and bot master constitute a botnet. Botnets are used for sending spams and also for distributed denial of service attacks.

4.15 Denial-of-service attacks

Denial-of-service (DoS) attacks as the name suggests deny users from accessing or using the service or system. This is mainly done by overwhelming the bandwidth, CPU, or memory wherein the access to the network of the victim machine or server offering the service gets denied. DoS attacks thus interrupt the service of a computer or network systems, making it inaccessible or too inferior in performance.

4.16 Distributed DoS

In distributed DoS (DDoS) attacks, the victim is targeted from a large number of individual compromised systems simultaneously. The DDoS attacks are normally done with the help of botnets. The botmaster is the attacker who indirectly attacks the victim machine using the army of bots or zombies. The DDoS attacks occur when a large number of compromised systems act synchronously and are being coordinated under the control of an attacker in order to totally exhaust its resources and force it to deny service to its genuine users. It is the upsurge in the traffic volume that loads the website or server causing it to appear sluggish [2].

4.17 IoT-based attacks

The last decade has seen exponential increase in the use of Internet of Things (IoT) that are smart devices used at home, organizations, and businesses. The issue with these IoT is its weak security as these devices are often overlooked when it comes to applying security patches that create lead-ins for attackers to seize these devices to infiltrate the networks. An IoT-based attack is any cyberattack that leverages a victim’s use of IoT to sneak malware onto a network.

4.18 Session hijacking

In session hijacking, the hacker takes control of a session going on between two hosts. Session hijacking usually takes place in applications that use TCP with a sequence number prediction. With that sequence number, the attacker sends a TCP packet.

4.19 Blended attacks

A blended attack is a software exploit that encompasses a mixture of exploit techniques to attack and propagate threats, for example, viruses, worms, and Trojan horses.

4.20 Website attacks

Website attacks are targeting browser components that are at risk of being unpatched even when the browser is patched. SQL injection attacks are intended to target any website or web application that uses an SQL database such as MySQL, Oracle, etc. by taking advantage of the security flaws in the application’s software. This attack is used to obtain and corrupt user’s sensitive data.

4.21 Mobile phone and VOIP threats

Malware target mobile phones, VoIP systems, and the IP PBXs as these devices have plentiful published vulnerabilities. There are attack tools freely available on the Internet, and misusing these vulnerabilities makes these attacks too common and simple even for a script kiddie.

4.22 Wi-Fi eavesdropping

Wi-Fi eavesdropping is an attack used by network attackers to grab sensitive information of a target system. It is the act of silently listening on an unencrypted Wi-Fi network.

4.23 WPA2 handshake vulnerabilities

The key reinstallation attack (KRACK) lets an attacker to decipher the network traffic on Wi-Fi routers. Every device connected to Wi-Fi, such as computers, smartphones, smart devices, and wearables, can be identified by the hacker.

4.24 Insider attacks

One of the prevalent all-time computer security threats faced by any organization is from its own employees. Insider attacks are initiated by disgruntled employees of an organization. Insider usually has certain privileges to the data as well as rights on the systems and networks that they attack, giving them an advantage over external attackers. These attacks can be hard to prevent with firewalls, which are the first level of defense.

4.25 Supply chain attacks

A supply chain attack seeks to cause harm by targeting the least secured elements in the supply network.

4.26 Buffer overflows

Buffer overflows are used to exploit programming glitches that do not take care of the buffer size. If a buffer is jam-packed beyond its size, the data overflows into the contiguous memory. This flaw gets smartly used by hackers to change the execution of the program.

4.27 User to root attack

User to root attack is a case of privilege escalation where a user gains a higher privilege than that authorized. This is not a class of attack as such, and it is the process of any attack. Every attack will do activities the attacker is not privileged to do.

4.28 Man-in-the-middle attacks

Man-in-the-middle attacks allow the hacker to snoop on the communication between two systems, affecting the privacy. A common method of doing this is to place the attacker at a point and redirect all the communication through the route that includes that hacker so that eavesdropping is possible by the hacker.

4.29 Pharming

Pharming is a widespread online fraud that will automatically point to a nasty and illicit website by relaying the authentic URL. Even when the URL is correctly entered, the redirection happens to some forged website looking similar to the actual one. This fake site prompts one to enter personal information that gets to someone with a wicked intent.

4.30 Spam

Spams are unsolicited bulk e-mail messages that annoy the user with unwanted and junk mails. It gives burden for communications service providers, organizations and individuals alike. These emails can be commercial ones like an advertisement or noncommercial one like chain letters or anecdotes. Spam is considered an active vehicle for virus propagation, scams, fraud and is a threat to computer privacy. Spam also phishes for interesting information with offers and promotions that trick victims into following links or entering details.

Computer Security Threat– Solutions

Given the numerous ways a computer virus can spread, how can a company ensure that its network is protected?The system administrator of a company should do the following;

• Install strong Anti-Virus Software.
  Ensure that reputable anti-virus software is installed on all computers. This should include all servers, PCs and laptops. If employees use computers at home for business use or to remotely access the network, these PCs should also have anti-virus software installed.
• Ensure that the anti-virus software is up to date.
  Everyday new computer viruses are being released and it is essential that businesses are protected from these viruses by keeping the anti-virus software up to date. If possible, companies should look at policies whereby computers that do not have the most up to date anti-virus software installed are not allowed to connect to the network.
• Employ a firewall to protect networks.
  As computer viruses can spread by means other than email, it is important that unwanted traffic is blocked from entering the network by using a firewall. For users that use computers for business away from the protection of the company’s network, such as home PCs or laptops, a personal firewall should be installed to ensure the computer is protected.
• Filter all email traffic.
  All incoming and outgoing email should be filtered for computer viruses. This filter should ideally be at the perimeter of the network to prevent computer viruses. Emails with certain file attachments commonly used by computer viruses to spread themselves, such as .EXE, .COM and .SCR files, should also be prevented from entering the network.

• Educate all users to be careful of suspicious e-mails.
  Ensure that all users know to never open an attachment or to click on a link in an email they are not expecting. Even when the email is from a known source, caution should be exercised when opening attachments or clicking on links in emails. Criminals use the trust placed in an email contact you know to trick you into clicking on a link or attachment.

• Scan Internet Downloads.
  Ensure that all files downloaded from the Internet are scanned for computer viruses before being used. Ideally this scanning should be done from one central point on the network to ensure that all files are properly scanned.

• Don’t run programs of unknown origin.
  It is important that you use a trusted source for your software requirements. This is to ensure that all software installed can be accounted for and that its sources can be confirmed to be legitimate. Apart from ensuring that the correct licensing agreements are in place, using a trusted supplier can help reduce the risk of software infected with a virus compromising your business. All users should be educated to never run a computer program unless the source is known or has originated from a person or company that is trusted.

• Implement a vulnerability management program.
  Most computer viruses and worms try to exploit bugs and vulnerabilities within the operating system and applications that companies use. New vulnerabilities are introduced into networks every day, be that from installing new software and services, making changes to existing systems or simply from previously undiscovered vulnerabilities coming to light. It is important to regularly review your network and the applications running on it for new vulnerabilities. Any discovered vulnerabilities should be rated and prioritised regarding their criticality and the potential business impact they could have. Once this has been done, a plan on how to manage those vulnerabilities, either by patching, upgrading, or managing the vulnerability using tools such as firewalls or Intrusion Detection Systems should be put into place.
• Make regular backups of critical data.
• 
  It is important to ensure that regular copies of important files are kept either on removable media such as portable drives or tape to ensure you have a trusted source for data in the event that the network is infected with a computer virus. Not only will this ensure that important data is available in the event of a computer virus infecting the company’s network, backups will also enable the company to restore systems to software that is known to be free from computer virus infection. For added security you should store these backups securely offsite. That way should a major disaster happen to the business, e.g. the building goes on fire, the data will remain safe in the secure offsite location and can be restored quickly in a new facility

• Develop an Information Security Policy.
  The creation and publication of an Information Security Policy is key to ensuring that information security receives the profile it requires in the organisation and is the first critical step in securing the company’s systems and data. It is important that senior management support the Information Security Policy and that all users are made aware of their roles and responsibilities under this policy.

• Monitor logs and systems.
  Regular monitoring of network and system logs can assist in the early identification of a computer virus infecting the network or other attacks by criminals. Unusual traffic patterns or log entries could indicate that the network has been infected or that its security has been compromised. As well as monitoring for suspicious traffic and events, it is important that logs for other devices are checked regularly to ensure that the network remains protected. Log files for the backups should be checked regularly to ensure that the backups succeeded, likewise the log files for anti-virus software deployed should be regularly checked to ensure that all PCs are running the latest version of the anti-virus software.

• Develop an Incident Response Plan.
  Knowing what to do when a computer virus enters the network or when you suffer a security breach is critical to minimise the damage they may cause, both to the business and also to customers and suppliers. The incident response plan should outline the roles and responsibilities that people have in the event of a computer virus infecting the network or indeed any other type of security breach. This plan should be drawn up and agreed between all relevant parties before an incident occurs. Remember, the worst time to develop a security incident response plan is in the middle of such an incident.

• Restrict end user access to systems
  Where possible, end users should not be given administrative privileges to their workstations. Most computer viruses can only run in the context of the user that is logged into the system, i.e. they only have the same permissions as the user running the program. If that user has their access restricted, then the virus will be similarly restricted. Unfortunately many applications designed for the Windows platform require the end user to have such privileges; however these users should be the exception rather than the rule.

In Conclusion

Cyber criminals poses a very real and constant threat to every business. It is important that businesses recognise this threat and take the appropriate steps, such as those outlined above, to reduce the likelihood and minimise