During our week three assignment, we used the ping and tracert commands to understand better how data travels through networks. Through my research of the ping command, I learned about attacks that can be executed. DoS and DDoS attacks can be crippling to websites and are not difficult to execute. A DoS attack, or denial of service, is executed when a user uses the ping command to overwhelm a system, slowing it down or causing it to completely shut down (Vahid & Lysecky, 2017). A DDoS, or distributed denial of service, is when an attacker uses a botnet (a large network of computers under the attacker’s control) to send a very large number of requests to website blocking access for actual users. DoS and DDoS attacks are not limited to just computers, anything that is connected to the internet can potentially be a victim of these types of attacks (Delving into internet ddos attacks, 2018). These types of attacks cost organizations time by trying to block the attack; they can also cause significant monetary damage due to the downtime of the website and loss in productivity. To block these attacks, the IT department can ensure that their network is behind a firewall. The firewall will allow the team to block IP addresses of incoming attackers. They should also have an intrusion detection system in place to identify potential threats and stop any illegal activities.
The next type of attack I researched is phishing attacks. A phishing attack is when an unsuspecting user receives communication where they are asked to share confidential information. The request can come in the form of an e-mail or text, called smishing. They may be asked to share account numbers, credit card numbers, or usernames and passwords (Vahid & Lysecky, 2017). These types of attacks can cause damage to systems if the user reveals sensitive information and the attackers gain access to computer systems. Phishing can also cause monetary damages, as the attackers may request the user to send money (Five ways to avoid, 2018). The IT department should invest in training employees on how to spot phishing attempts. Most attempts contain grammatical errors and should alert employees right away. The phishing attempt may contain links that the user can check by hovering over and seeing if the link redirects to a malicious website. The IT department should also have filters in place, so any items incoming that may be suspected phishing attempts are automatically redirected and never reach the user.
The last type of attack I researched was social engineering. Social engineering takes advantage of the human element in cybersecurity (Bullée, Montoya, Pieters, Junger, & Hartel, 2018). Social engineering happens inside the computer world as well as in the physical world. During a social engineering attack, the attacker may present themselves, under pretenses, as someone important in the company to trick employees into sharing sensitive information or in extreme cases, allowing the attacker into confidential areas. If the attacker makes it through security, the attacker has access to systems and information that can cause significant physical and monetary loss to the business. The IT department should work with the security department to train employees on ways to spot a social engineering attack. There should be checks and balances set up for employees to use to verify if a potential threat is an actual employee or not, such as asking for employee numbers. The employees should be trained to contact management if there is any suspicion. Another way to protect against social engineering is to run simulated tests to expose any weak points in security and to see how employees respond to threats.
References
Bullée, J.-W. H., Montoya, L., Pieters, W., Junger, M., & Hartel, P. (2018). On the anatomy of social engineering attacks-a literature-based dissection of successful attacks. Journal of Investigative Psychology and Offender Profiling, (1), 20. https://doi-org.proxy-library.ashford.edu/10.1002/jip.1482
Delving into internet ddos attacks by botnets: characterization and analysis. (2018). IEEE/ACM Transactions on Networking, Networking, IEEE/ACM Transactions on, IEEE/ACM Trans. Networking, (6), 2843. https://doi-org.proxy-library.ashford.edu/10.1109/TNET.2018.2874896
Five ways to avoid a phishing attack. (2018). Medical Economics, (11). Retrieved from http://search.ebscohost.com.proxy-library.ashford.edu/login.aspx?direct=true&db=edsbig&AN=edsbig.A546749550&site=eds-live&scope=site
Vahid, F., & Lysecky, S. (2017). Computing technology for all. Retrieved from zybooks.zyante.com/
The next type of attack I researched is phishing attacks. A phishing attack is when an unsuspecting user receives communication where they are asked to share confidential information. The request can come in the form of an e-mail or text, called smishing. They may be asked to share account numbers, credit card numbers, or usernames and passwords (Vahid & Lysecky, 2017). These types of attacks can cause damage to systems if the user reveals sensitive information and the attackers gain access to computer systems. Phishing can also cause monetary damages, as the attackers may request the user to send money (Five ways to avoid, 2018). The IT department should invest in training employees on how to spot phishing attempts. Most attempts contain grammatical errors and should alert employees right away. The phishing attempt may contain links that the user can check by hovering over and seeing if the link redirects to a malicious website. The IT department should also have filters in place, so any items incoming that may be suspected phishing attempts are automatically redirected and never reach the user.
The last type of attack I researched was social engineering. Social engineering takes advantage of the human element in cybersecurity (Bullée, Montoya, Pieters, Junger, & Hartel, 2018). Social engineering happens inside the computer world as well as in the physical world. During a social engineering attack, the attacker may present themselves, under pretenses, as someone important in the company to trick employees into sharing sensitive information or in extreme cases, allowing the attacker into confidential areas. If the attacker makes it through security, the attacker has access to systems and information that can cause significant physical and monetary loss to the business. The IT department should work with the security department to train employees on ways to spot a social engineering attack. There should be checks and balances set up for employees to use to verify if a potential threat is an actual employee or not, such as asking for employee numbers. The employees should be trained to contact management if there is any suspicion. Another way to protect against social engineering is to run simulated tests to expose any weak points in security and to see how employees respond to threats.
References
Bullée, J.-W. H., Montoya, L., Pieters, W., Junger, M., & Hartel, P. (2018). On the anatomy of social engineering attacks-a literature-based dissection of successful attacks. Journal of Investigative Psychology and Offender Profiling, (1), 20. https://doi-org.proxy-library.ashford.edu/10.1002/jip.1482
Delving into internet ddos attacks by botnets: characterization and analysis. (2018). IEEE/ACM Transactions on Networking, Networking, IEEE/ACM Transactions on, IEEE/ACM Trans. Networking, (6), 2843. https://doi-org.proxy-library.ashford.edu/10.1109/TNET.2018.2874896
Five ways to avoid a phishing attack. (2018). Medical Economics, (11). Retrieved from http://search.ebscohost.com.proxy-library.ashford.edu/login.aspx?direct=true&db=edsbig&AN=edsbig.A546749550&site=eds-live&scope=site
Vahid, F., & Lysecky, S. (2017). Computing technology for all. Retrieved from zybooks.zyante.com/
No comments:
Post a Comment