In today’s ever-changing world, there’s real advantage in understanding cybersecurity. Every day, the volume of data we generate keeps growing, and its protection is too often an afterthought. We have to stay knowledgeable about data protection, especially when handling sensitive information.
This is a dense subject, but as an introduction, here are some of the basic concepts behind an attack:
- Attack vector — the route or path that lets an unwanted visitor (a hacker) deliver malicious code, or “payload.”
- Payload — the data carried in a transmission unit, most commonly known as a “packet.”
- Packet — a unit of data routed within a packet-switched computer network.
- Computer network — a series of nodes interconnected for the purpose of exchanging data.
- Node — a connection point in a network that can send, receive, and/or store data.
- Data — information transformed into a state that facilitates exchange between parties.
It’s also worth getting familiar with two of the most common terms in cybersecurity: malware and system exploitation.
Malware is programming code developed with the intent to cause disruption or harm. Common types include worms, viruses, data miners, browser hijackers, adware, spyware, and ransomware.
System exploitation is an attack that takes advantage of a specific vulnerability, often to gain data or access to a protected system. Common types include SQL injection, cross-site scripting, denial of service, and buffer overflow.
To understand how intruders gain access to different systems, it helps to keep an informal framework of the steps a hacker typically works through before and during an intrusion. We’ve summarized this as a seven-phase framework:
- Reconnaissance — research, identification, and selection of targets.
- Weaponization — pairing remote-access malware with an exploit into a deliverable payload (e.g., a .pdf, .doc, or .xlsx file).
- Delivery — transmission of the weapon to the target (e.g., via email or a website).
- Exploitation — once delivered, the weapon’s code triggers, exploiting the vulnerable system.
- Installation — the weapon installs a backdoor on the target’s system, allowing persistent access.
- Command & control — an outside server communicates with the installed weapon, providing access inside the target’s network.
- Actions on objective — the attacker works to achieve the goal of the intrusion, which can include exfiltrating or destroying data, or pivoting to another target.