Cybercriminals target individuals as well as organisations. Outlined below are some of the main types of cyberattacks to be aware of.
Malware Attacks
Malicious software attacks are intrusive or hostile files or programs that are specially designed to exploit devices in a way that benefits the attacker but harms the user. There are a range of different types of malware, with the most common being rootkits, trojans, spyware, and ransomware.
Ransomware Attacks
These programs take over a user’s system and encrypt files. They are usually installed when a user opens a fake email attachment or visits a malicious website. Once installed, they then lock files and demand a ‘ransom’ in order to provide the encryption key to restore access.
The cyberattackers will often also threaten to leak data in order to add extra pressure on the victim to pay up.
A number of large organisations have been victims of ransomware attacks, including the NHS and Royal Mail. In 2023, more than 317 million ransomware attacks were recorded.
Password Attacks
Passwords remain the main way of logging in to online accounts. Cyberattackers utilise a number of different methods to obtain passwords, including brute-force attacks, dictionary attacks, social engineering, keylogging and password-sniffing. They may also attempt to breach an organisation’s database of user credentials including passwords.
DDoS Attacks
A distributed denial-of-service attack, known as DDoS for short, is a coordinated effort to compromise/crash a website or server. It does this by sending millions of simultaneous requests. AI is now being used to undertake these attacks.
Web Security Experts
If you feel your website could do with a professional check-up, there are a number of specialists such as etempa.co.uk/website-security-checks/ who can offer various website security checks.
Phishing Attacks
Many people will have seen phishing attempts. They often involve emails purporting to be from banks or other reputable organisations. They will have links in them that are fake, or attachments that contain malware etc. They will usually ask for valuable information such as passwords, credit card details, or even intellectual property.
Everyday habits that keep attackers out
Knowing the types of attack is only half the job. At home, use passwords that are hard to guess, mixing letters, numbers and symbols, change them regularly, and keep anti virus software up to date. Learn to spot a suspicious email or link, and use the extra verification step your card provider offers when shopping online.
At work, use a different password for each system and watch for the signs of a dodgy email. Misspelt company names, odd looking links and any request to re-enter your username or password are all warning signs.
Organisations that run a website should make sure only trusted devices can reach the central network, protect the login used to update the site with a strong random password or two step sign in, and keep all website software up to date. Monitoring the site for malware and ransomware helps catch problems early, and a plan for how to respond to different kinds of attack means less panic if one gets through.
How ransomware holds data hostage
Ransomware is a type of malicious software that works by threatening the victim rather than simply damaging their machine. It encrypts files on the computer and locks the user out of their data, and sometimes their backups, until a payment is made. Businesses of every size are targeted, and the demand usually arrives with a message telling the victim they must pay to get their files back.
Most infections begin with a careless click. Opening an email attachment from an unknown sender, or downloading a file from an untrusted website, is one of the easiest ways for this kind of software to get onto a system. Training staff to treat unexpected attachments and links with suspicion is one of the simplest defences.
Prevention matters far more than any cure. Keeping software up to date, using security tools and holding regular backups stored separately from the main network all reduce the damage an attack can do. Some businesses also take out cyber liability insurance to help cover the cost of recovering from an incident.
Ransomware, spear phishing and automated attacks
Cyber threats are becoming more sophisticated, and both large corporations and small businesses are targets. A few types of attack stand out.
Ransomware remains one of the most serious. Malicious software encrypts files or locks systems, shutting down the operations a business depends on, and the criminals demand payment within a deadline. If it is not paid, sensitive data may be destroyed or leaked, causing reputational damage on top of the disruption. Phishing has also developed. Spear phishing targets a particular individual, using tactics such as links to fake websites to trick them into giving away login details, personal data or other credentials. Training and awareness are the best defence, backed by robust identity verification.
Criminals are also using the processing power of cloud computing to launch huge volumes of automated attacks on many targets at once. These range from phishing and malware to data poisoning, where the training data used to teach machine learning systems is corrupted with malicious content.