Malware
Steals and encrypts data. Then the decryption key is sold back to you if you want to recover the data.
Ransomware
A way of tricking a user and obtaining information. One method of this attack is over the phone.
Social-Engineering
Going to a website and injecting a query as input. One example could include the ' or '1'='1 input in order to dump the database. It modifies the database queries sent by the application.
SQL Injection
Protection: Input Validation
Combines WiFi monitoring and a GPS to gather information about Public access points. (e.g. drone)
Wardriving
Protection: Secure WiFi connections
Vulnerabilities that have not been detected or published by the public. It is unknown by the company and does not have a patch yet.
Zero-day
Protection: Bug-Bounty program
Trojan Horse
A way to trick a user into clicking on a link. Typically delivered via email to a single user or group of users.
Phishing
Overwhelm a resource such as a firewall or web-server leaving users with slow connectivity or unable to access a system.
DoS (Denial of Service)
Protection: Load Balancing; Cloud Services with DoS protection
Badges typically use this technology but the data can be captured and a badge can be cloned.
RFID Attacks
A weakness which can be exploited by a cyber attack to gain unauthorized access. Systems that don't get patched would most likely have this issue.
Vulnerabilities
Protection: Patching cycle
I spread throughout systems and self-propagate without any user intervention.
Worm
Is a highly targeted phishing attack aimed at senior executives such as a CEO.
Whaling attack (Phishing)
Protection: User Education
A group of infected systems that take orders on what to do from a single source such as a Command & Control. One example might be instructions to overload a website and cause a DoS.
Bots (Botnet)
Protection: Host-based firewall or IPS; Network monitoring
Make the frequency of the wireless network unavailable by overwhelming the signal.
Wireless jamming
Protection: Directional antenna to track down
The concept of pretending to be something you aren't. (e.g. email, MAC address, caller-id, etc.)
Spoofing
It keeps a log of everything you type. Passwords! Passwords! Passwords!
Keylogger
Infects a system and modifies core system files in order to stay hidden.
Rootkit
Protection: Secure boot
Takes advantage of the trust a user has for a website. An attacker could post a malicious script on a webpage that will run in a victims browser when they access the website.
Cross-site Scripting (XSS)
Protection: Input validation;
A malicious wireless access point where un-suspecting users connect to and can have their information stolen.
Rogue Access Point
Protection: 802.1x; Encrypt traffic
To access a computer system or encrypted data that bypasses the system's customary security mechanisms.
Backdoor
Protection: host-based IPS
I am waiting for an event to occur and then I will unleash my malware.
Logic Bomb (e.g. Disgruntled employee that gets fired)
Attacker will abuse by manipulating the mapping of MAC to IP address. Instead of systems mapping to the correct IP address the systems will go to the attackers IP.
ARP Poisoning
Protection: Encrypt traffic; Packet Filtering
When a network is super-secure. An attacker might use a tactic to place the attack/infection on an outside website commonly visited by employees. The attacker will then wait for the employee to visit the site.
Watering Hole Attack
Protection: Defense-in-depth (e.g. Firewall, IPS, Anti-Virus, etc..)
Sending unsolicited messages to another device via Bluetooth. More of an annoyance.
Bluejacking
Protection: Updated software/settings
Based on sending more data to a program/variable and overwriting a section of memory past the allocated space in order to perform a function that will give access to your system.
Buffer Overflows
Protection: DEP (Data Execution Prevention)