Security: Explain common social-engineering attacks, threats, and vulnerabilities.

Question 1

What is a Phishing Scam?

Answer 1

Unsolicited email – Hope to get bites to take credentials – usually through a link.

Can be a target attack for specific company – Spear Phishing

Question 2

What is Vishing?

Answer 2

Voice over IP attempts – getting data by capturing the traffic

Question 3

What is whaling?

Answer 3

Trying to manipulate people in Power or sending Phishing emails to executives to get critical information.

Question 4

What is Shoulder Surfing?

Answer 4

Looking over someone shoulder and gaining information

Question 5

What is Dumpster Diving?

Answer 5

Search info via trash

Question 6

What is tailgating?

Answer 6

Piggybacking – an accomplice that tries to enter without authority through a mantrap.

Question 7

What is an Evil twin?

Answer 7

Rogue access point: Set up an AP within the range of your access point. Setting up an SSID spoof with the same SSID – Can be used with roaming devices – gathering information this way.

Question 8

What is DDoS?

Answer 8

DDoS Attack means “Distributed Denial-of-Service (DDoS) Attack” and it is a cybercrime in which the attacker floods a server with internet traffic to prevent users from accessing connected online services and sites.

Question 9

What is the difference of DoS and DDoS

Answer 9

What is the Difference between DoS and DDoS Attacks? ​ A denial-of-service (DoS) attack overloads a server with traffic, thereby shutting it down.

A distributed denial-of-service (DDoS) attack is a DoS attack in which numerous computers or machines flood a targeted resource.

In essence they are they same how ever with DDoS it is a specified target with numerous computers.

Question 10

What is a Zero day attack?

Answer 10

Moment of exploits not known at the point of attack. No fixes and only the attacker knows when It happens. Need patches to fix it over time.

Question 11

What is an On Path attack?

Answer 11

From source to destination, abstractly could go through quite a few networks could be in a single network, but when they say on path attack, what you have is that a threat actor that’s trying to get in the middle. Hence, the old the old designation of that communication path so that they can either eavesdrop, they can basically take the source of the communication completely out of that communication altogether. And they can do it a couple of different ways. A couple of ways that they can do it is there’s something known as spoofing. One could be ARP spoofing or one could be IP spoofing.

Question 12

What is ARP Spoofing?

Answer 12

ARP spoofing: A hacker sends fake ARP packets that link an attacker’s MAC address with an IP of a computer already on the LAN. ARP poisoning: After a successful ARP spoofing, a hacker changes the company’s ARP table, so it contains falsified MAC maps. The contagion spreads.

Question 13

What is ARP Spoofing vs IP spoofing?

Answer 13

ARP spoofing – Links a perpetrator’s MAC address to a legitimate IP address through spoofed ARP messages. It’s typically used in denial of service (DoS) and man-in-the-middle assaults. IP address spoofing – Disguises an attacker’s origin IP. It’s typically used in DoS assaults.

Question 14

What are some of the common ways of a Password attack?

Answer 14

Brute force – trying to run every possible combination via physical input

Dictionary attack – load a whole dictionary and run through rules to generate a password

Question 15

What does a SQL do?

Answer 15

Structured Query Language (Injection) manipulates the data base server by In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution which will gain sensitive data.

7-Eleven breach—a team of attackers used SQL injection to penetrate corporate systems at several companies, primarily the 7-Eleven retail chain, stealing 130 million credit card numbers. HBGary breach—hackers related to the Anonymous activist group used SQL Injection to take down the IT security company’s website

Question 16

What is insider threat?

Answer 16

disgruntled employee, An employee, they talk about fraud. This is a fraudulent or malicious employee on the inside of your network that works for your company, that maybe is trying to disrupt your organization, maybe steal your intellectual property and sell it to a third party organization. That maybe is your competitor. A lot of times threats don’t, well not a lot of times, I can’t say that, sometimes threats don’t come from the outside. Sometimes the threats come from within your internal company And that’s where we have things like additional techniques like data loss prevention that actually monitors this type of activity to make sure that your intellectual property doesn’t leave your network. Because again, insider threats are a very real thing and something we have to be aware of.

Question 17

What is Cross-site scripting?

Answer 17

Well, when we have a cross site scripting attack is what it’s called XSS. Then what happens is they use the attacker can actually embed a script that is in a URL. Send that URL to the client and the client thinks that they’re clicking on a legitimate URL that takes them to a page. But on the end of it, it’s actually executing a script. All right. That is what is known as cross side scripting. It’s when an attacker can actually send a bogus link with a script embedded to in the end of the URL. And when that victim clicks on it it executes a piece of malware maybe downloading into their computer. Maybe a key logger, if you will, whatever it might be. And that forms the basis of the attack.

Question 18

What are the vulnerabilities of Non-Compliant systems?

Answer 18

It is harder to manager and also track any uses within that systems.

Question 19

What are the vulnerabilities of unpatched systems?

Answer 19

Unpatched security vulnerabilities allow attackers to run a malicious code by leveraging a known security bug that has not been patched or updated to prevent malicious attacks.

The vulnerabilities that you need to consider is:

Ransomware

Misconfiguration is when there is an error in system configuration. For example, if setup pages are enabled or a user uses default usernames and passwords

Zero-day

Spyware - adware

Data Breaches (DDoS)

Compromise Credentials

Trust Relationship – Attackers can exploit trust configurations that have been set up to permit or simplify access between systems (e.g. mounted drives …

Question 20

What are the vulnerability of Unprotected systems (Missing Antivirus/ Missing firewall) ?

Answer 20

If a software firewall/ anti virus is disabled, it’s not just the associated computer that’s in harm’s way; worms – a type of malware – for example, can spread across a network connection, infecting all of the PCs attached to the LAN. Disabling a hardware firewall also impacts all of the devices that connect to the network.

Question 21

What are the vulnerability of BYOD?

Answer 21

Very hard to manage and track data due to personal and business use.

Easily can be lost or stolen which can compromise data.

Unsecured WiFi - When employees connect their personal devices to an unsecured network, such as a public WiFi network, their devices can become vulnerable

Possibility of Jailbroken or root a phone and potentially over ride administration control to the device can bring potential harm to sensitive information.

Compliance enforcement · Employees may fail to appropriately secure confidential data outside the confines of the office. · Employees may accidentally share