Protecting anything starts with knowing what is worth protecting and who might want it, so this section begins with assets and then turns to attacks. The attacks are many, and their names are easier to keep straight if you sort them by the route they take to an asset. Some go through people, persuading someone to hand over a secret or open a door. Some go through code, getting malicious software to run on a device. Some go through the network, either overwhelming a service or listening in on traffic. Some go through credentials, guessing or reusing passwords. And some don't need to break in at all, because the attacker already has legitimate or physical access. The section ends with a kind of attacker, the advanced persistent threat, that may combine all of these routes.

What is worth protecting#

An asset is anything of value that someone could steal, alter, or make unusable. The most obvious assets are data. Personal data includes Social Security numbers, health records, and bank details, and organizational data includes student records and an organization's finances. Assets don't deserve equal protection, and the useful question to ask about each is what harm its exposure would cause. Student health records would cause lasting harm to individuals if exposed, so they rank far above a cafeteria menu or a staff directory already published on a district's website. Records about identifiable students, such as a spreadsheet linking ninth graders' names to their disciplinary actions, are protected, while a school's holiday calendar, a board agenda that has already been published, and a budget summary the board has released are not, since publishing them was the point. The kind of harm depends on the data: payroll records typically include Social Security numbers and bank details, so a breach of payroll data leads most directly to identity theft and financial fraud against employees, which is a different harm from losing product designs to competitors or losing a website to an outage.

Data isn't the only asset. Credentials, the usernames, passwords, and other secrets that prove who someone is, are assets in their own right, because they unlock everything else. Devices and the networks that connect them are assets too. An employee might argue that a company laptop isn't worth protecting because all customer files are kept on a central server, but an "empty" laptop can still hold saved logins and a trusted connection into the company's network, which gives an attacker a way in. A security plan that lists only an organization's files has therefore left out its staff credentials, its computers, and the network between them.

Attacks through people#

Many attacks never touch a technical weakness, because the easiest way past a well-maintained system is often to deceive a person who already has access. Social engineering is the general name for manipulating people rather than systems. Its tactics include urgency, which pressures someone to act before thinking; impersonation, in which an attacker pretends to be a boss, a vendor, or IT support; and baiting, which uses curiosity or an apparent gift to prompt a harmful action, as with infected USB drives left in a parking lot to be found and plugged in. Social engineering can be entirely physical: holding a door for a person in a delivery uniform can bypass badge readers and every other technical control in the building. A caller who claims to be a senior official and insists that a payment be made quickly and kept quiet is relying on urgency and secrecy to discourage the normal checking that would expose the fraud. Because these attacks target judgment, the defense is a procedure that doesn't depend on judgment in the moment, such as requiring help desk staff to confirm each caller's identity in a set way.

Phishing is social engineering delivered through deceptive messages, usually email or text, that trick people into revealing information or running malware. Most phishing is sent widely to whoever might fall for it. Spear phishing targets a specific person, using personal details such as a supervisor's name or a current project to make the message believable. Warning signs include urgency and lookalike addresses, such as a sender's domain with one letter changed. A lock icon in the browser isn't a sign of honesty, because attackers can obtain certificates for lookalike domains, and the lock shows only that the connection is encrypted. The reliable response to an unusual request is to verify it through a second channel that you already know to be genuine, such as a phone number on file, never one supplied in the message. No single defense is enough here. A mail filter is useful, but some messages will get through it, so organizations combine filtering with training and with multifactor authentication (described under 0004.b), which limits the damage if someone does enter a password on a fake site.

Attacks through code#

The second route is getting malicious software, or malware, to run on a device, and malware is named by how it spreads and what it does. A virus attaches to files and spreads as those files are shared and opened, so it depends on people moving the files. A worm spreads on its own, from machine to machine across a network, without attaching to a file or waiting for anyone to act. A Trojan disguises itself as legitimate software, such as a free game or a fake update, and relies on users to install it. What malware does once installed gives the other names. Spyware covertly gathers data about a user, and a keylogger is a kind of spyware that specifically records keystrokes. Because a keylogger captures each key as it is typed on the device, it gets passwords before the browser encrypts them for sending, so encryption doesn't protect against it.

Ransomware is malware that encrypts a victim's files and demands payment for the key to decrypt them. It often spreads across an organization's network before revealing itself, damaging as much as possible at once to raise the cost of refusing to pay. The defense that matters most is a backup that the ransomware can't reach: keeping at least one copy offline or otherwise isolated from the network lets an organization restore its files without depending on the attacker. Paying is a poor bet even when it seems cheaper, because payment doesn't guarantee that the attacker will provide a working key, that data wasn't copied before it was encrypted, or that the attacker has left the network.

Attacks through the network#

The third route uses the network itself, either to block a service or to listen in on it. A denial-of-service attack makes a service unusable, and a distributed denial-of-service (DDoS) attack does this by flooding it with requests from many sources at once. The sources are usually a botnet, a group of compromised devices, such as computers, cameras, and routers, directed by an attacker. The risk of being drafted into a botnet grows with the number of devices and their openness to outside access, which is why poorly secured Internet-connected devices are a concern (0004.e returns to why). Because the requests come from many addresses, blocking any one of them leaves nearly all the rest, so services defend themselves by spreading incoming traffic across many servers and filtering it. In the terms of 0004.b, a denial-of-service attack compromises availability: nothing is stolen or changed, but people can't use the service when they need it.

Other network attacks aim to read or alter what passes over it. In packet sniffing, an attacker captures traffic crossing a network, which is especially easy on open Wi-Fi in a café or airport. If a site uses plain HTTP, which isn't encrypted, anyone on the same network can capture a password as it is sent. In a man-in-the-middle attack, the attacker goes further, positioning themselves between two parties and relaying their communication, so that each believes it is talking directly to the other while the attacker reads or changes everything in between. The defense against both is encryption of the traffic in transit, end to end where possible. A virtual private network (VPN) encrypts all traffic between a device and a trusted endpoint, such as an employer's network, which protects someone working on public Wi-Fi. A browser's certificate warning may signal that a connection is being intercepted, so a user who sees one at a login page should not proceed.

Attacks through credentials#

Passwords get their own family of attacks, and the differences among them explain why different defenses matter. A brute-force attack tries every possible password in turn. A dictionary attack tries common choices first, such as password1 or a pet's name, which is far faster against people who choose predictably. Credential stuffing takes username and password pairs leaked in one site's breach and tries them on other sites, so it depends entirely on people reusing passwords. Length protects against guessing, and uniqueness protects against stuffing: a long password that was leaked from one site is still impractical to guess, but the leaked copy will work wherever it was reused.

It also matters where the guessing happens. Online guessing goes through a site's login page, so limiting attempts or locking an account after several failures makes it impractical. If attackers steal a database of password hashes (0004.d explains these), they can guess offline, on their own computers, where the guesses never pass through the company's login system and lockouts have no effect.

Attacks that use access someone already has#

Firewalls and filters are built to keep outsiders out, and the last group of attacks comes from people they don't stop. An insider threat comes from someone with legitimate access. The insider may be malicious, such as an employee who copies records to sell, or careless, such as one who emails a file of student data to the wrong list, and both count, because a person with legitimate access caused the exposure. A common case is a former employee whose account was never disabled, which is a failure to remove access when a role ends. Because the activity comes from inside, through an account that is authorized to be there, a firewall watching the network's boundary sees nothing unusual. The defenses are to limit each account to the access its role requires (least privilege, described under 0004.b), to remove accounts promptly when people leave, and to monitor for misuse of authorized access.

Physical access is a route of its own. Wardriving means searching for wireless networks from a moving vehicle, looking for ones that are open or weakly protected, so it depends on there being a wireless network to find. Device theft needs no network at all, and full-disk encryption protects the stored data when a locked device is taken. Shoulder surfing is watching someone enter sensitive information, such as a password or a student's records, and it needs no technology; positioning screens away from walkways and adding privacy filters reduce the opportunity.

Advanced persistent threats#

Most of the attacks above are opportunistic or aimed at quick profit. An advanced persistent threat (APT) is different in kind: a well-resourced attacker, often state-sponsored, that gains long-term, stealthy access to a target's network in pursuit of goals such as espionage. An APT may use any of the routes in this section, often with custom tools that security software hasn't seen before, and it moves slowly to avoid notice. Unlike ransomware, which announces itself with a ransom demand, an APT's goal depends on remaining undetected so that access can continue. One sign of its presence is a compromised machine making small, regular outbound connections to the same server, which suggests beaconing, a machine checking in with a command-and-control server that can send it instructions (0004.f describes this and other signs in logs). Because an APT may already be inside, further checks at the perimeter do little, and the more suitable defense is continuous monitoring for unusual activity across internal systems. Seeing what attackers try is the first half of the picture, and 0004.b turns to what defenders are trying to preserve and the safeguards they use.

• asset: anything of value, such as data, credentials, devices, or networks, that could be stolen, altered, or made unusable
• social engineering: manipulating people rather than systems, through tactics such as urgency, impersonation, and baiting
• baiting: using curiosity or an apparent gift, such as a USB drive left to be found, to prompt a harmful action
• phishing: deceptive messages that trick people into revealing information or running malware
• spear phishing: phishing that targets a specific person using personal details
• malware: malicious software
• virus: malware that attaches to files and spreads as they are shared
• worm: malware that spreads on its own
• Trojan: malware disguised as legitimate software
• spyware: malware that covertly gathers data about a user
• keylogger: malware that records keystrokes
• ransomware: malware that encrypts a victim's files and demands payment for the key
• distributed denial-of-service (DDoS): flooding a service with requests from many sources to make it unusable
• botnet: a group of compromised devices under an attacker's control
• packet sniffing: capturing traffic crossing a network
• man-in-the-middle: intercepting and relaying communication between two parties
• virtual private network (VPN): an encrypted connection between a device and a trusted endpoint
• brute-force attack: trying all possible passwords
• dictionary attack: trying common passwords
• credential stuffing: trying passwords leaked from one breach on other sites
• insider threat: a threat from someone with legitimate access
• wardriving: searching for wireless networks from a moving vehicle
• shoulder surfing: watching someone enter sensitive information
• advanced persistent threat (APT): a well-resourced, often state-sponsored attacker that gains long-term, stealthy access

Practice: practice questions for 0004.a