Hi everyone and welcome back to another edition of
the Hussey Coding blog.
This month we are looking at the topic of cybersecurity and have already asked the question what is it? Why is it important and what do you need to know about it? And now that we have those answers it's time to look at some of the immediate dangers out there, things that literally could cost you your business! Please bare in mind that the following list is not a comprehensive list of all forms of cyberattack rather a bite sized look at some of the more frequently used methods you are most likely to encounter.
In this blog we will look at
- DoS (Denial of service)
- MitM (Man in the middle)
- Phishing
- Spear phishing
- Malware
- Zero Hour
DoS - Denial of Service
Denial of service is a highly devastating method of attack.
An attacker will use one or multiple systems to overwhelm your system, server or network with more requests than they can handle, this then starts a chain of events that can harm your business in more ways than one.
The requests come pouring in, jamming up and slowing down the system, server or networks ability to process anything. As your new and regular customers try to engage with your site it will not respond with it's usual amazing speeds and eventually it will stop responding all together, this will result in abandoned shopping carts, disappointed and angry customers, damage to your site and companies reputation and revenue.
This form of attack is quite unique in it's reasoning, for the majority of attackers the motivation is to covertly access companies data for personal gain but this method is all about disruption, with the most common reasons being
- Disrupting similar businesses, competitors or rivals.
- To "voice" anger or displeasure against an industry and/or business.
- Practising for a bigger DoS attack completely unrelated to your business.
- As a distraction for other planned attacks
- Extortion
- And the most common reason for a DoS attack ... revenge!
MitM - Man in the Middle
As the name suggests this form of attack is where the attacker will position themselves between communicating parties in order to eavesdrop on the conversation. When the attacker is satisfied that no party is aware of their presence in the conversation they begin to manipulate it by intercepting messages and changing them for their benefit.
This is a particularly devious form of attack as there is a considerable effort on the attackers part to convincingly disguise themselves as all parties involved in the conversation/transaction.
Once the attacker is in position they are able to easily access, steal and manipulate all sorts of data and sensitive information allowing them to secretly take funds, access restricted areas like your administration panel or sell company secrets and customer data.
Phishing
This is when an attacker will send out e-mails that look like they are from a genuine source like a bank, social site or administrative department, in the hopes of collecting sensitive or personal data, like credit card or log in details, these e-mails could also contain links to copycat websites or attachments containing malware which once opened or clicked on begin the download process. This method relies heavily on the victims naivety in the area of cybercrime or their fear of fabricated consequences encouraging them to click that link or open that attachment and is a very hit and miss method.
However there is a type of phishing that is more refined and that is spear phishing.
Spear Phishing
This method has all of the same goals as regular phishing but is more calculated and malevolent. The attacker in this case takes the time to research their targets and to craft a more personal engagement making spear phishing very difficult to identify.
When you got that random e-mail from the Bank asking you send your details to verify your account, you just deleted the e-mail because you know that a bank would never ask for your details but when Bill, your accounting manager e-mails you asking you to click a link and input some details to authorise a transaction, well it's Bill, right? ... Wrong, this is spear phishing, a quick search of your company's website tells the attacker that Bill is the accounts manager and a quick e-mail conversation with your customer service shows them that your staff have company e-mail addresses so when .Bill@yourcompany.com e-mails you, you think nothing of it.
Phishing is number 1 on the most wanted list for cyberattacks worldwide and is one of the easiest ways to breach a company's security!
Malware
MALicious SoftWARE. Malware is any kind of unwanted software that has been installed onto your computer without your consent. It hides in good places as well as bad, it will sit and wait or it will quite happily replicate it's self across all of your systems, computers and/or networks by testing and exploiting any and all weaknesses it finds along the way. Most commonly found in links and attachments, see Phishing and spear phishing above, it can also be present in scripts, code and any active content. And if that wasn't enough malware comes in many forms such as viruses, spyware, worms, adware, scareware, trojans and ransomware.
Malware is designed to cause disruption, chaos and panic through a verity of different methods for a verity of different goals. It can block access to your network, disrupt your systems so that they become inoperable, it can copy data and send it back to the attacker without being detected and it can install more malware to your systems, giving you more than one issue to deal with.
Zero Hour
Now Zero hour attacks are unlike any other attack, where other attacks seek out vulnerabilities, lapses and gaps in security this one sits back and waits for the opportunity to come to it. These attackers wait for good, honest people looking to warn others of the potential security risk to announce to the world that there is a vulnerability or bug within a particular system, code or network and then they pounce like a lioness from the tall grass, taking full advantage of the weakness from the moment it's revealed until the moment there is a patch or update to rectify the issue. During this time an attacker will be able to install malware, copy, store or distribute private company data, distract you with a DoS attack or possibly all of the above and the biggest issue with this kind of attack? not even the attacker knows it's coming, so how could you?
Cybersecurity is a huge deal and needs to be taken seriously, not just by you or your IT department but by every member of staff within your organisation. If you've been reading through this list and wondering what to do next or desperately trying to think about ways to secure your business then don't worry, coming next in our cybersecurity series are 10 hints and tips over 2 blogs that you can do NOW to help prevent an attack.
Thank you for taking the time to read this blog, we hope you found it helpful and informative. If you are worried about the security of your store and don't have a developer or a dev team at your disposal then please send us an e-mail at info@husseycoding.co.uk and we'd be glad to help you out.
Until next time, stay safe and have a great day
You can also join all the fun on our various social media profiles
Facebook - facebook.com/husseycoding
Twitter - twitter.com/husseycoding
LinkedIn - linkedin.com/company/hussey-coding
Sign up to developer connection at www.developerconnection.co.uk
Facebook - facebook.com/DeveloperConnection
Twitter - twitter.com/devconnectionuk
LinkedIn - linkedin.com/company/developer-connection
No comments:
Post a Comment