Which of the following is the most common computer related security incident?

Information security, frequently referred to as InfoSec, consists of the systems, processes, and tools put in place to protect a company’s sensitive information from disruption of any kind, including modification, theft, and loss. There are many different kinds of InfoSec incidents that can pose a threat to your business. This article breaks down information security attack basics, and lists seven of the most common types of information security incidents with practical tips on how to handle them.

What Is an Information Security Incident?

An InfoSec incident is the unauthorized access, use, disclosure, data breach, modification or destruction of information. It can be a suspected, attempted, successful, or imminent threat of that unauthorized access. That means the information security incident doesn’t have to be successful in order for it to be a problematic security threat that requires procedures for both tracing and tracking the incident, and systems to prevent a similar event from happening in the future. An InfoSec incident can also be interference with an information technology operation or a disruption of an information technology process. 

What Are the Types of Information Security?

You might think that InfoSec and cybersecurity are the same thing — and they are frequently confused. In reality, information security is a type of cybersecurity specific to data security, and cybersecurity is a more general term that encompasses InfoSec as well as security related to internet-connected devices, hardware, software, and data. 

Within InfoSec itself, there are multiple types of information security and a variety of processes companies can use to keep their information secure and avoid a data breach. These range from the coding systems used to physically store hardware and physical plant materials properly, to making sure employees are properly trained and using protected devices, to ensuring that your company has a proper incident response plan. It’s important to cover all bases — plus, enabling a comprehensive and strong InfoSec plan can increase revenue. These are key types of information security that you should consider prioritizing for your business. 

Application Security

Application Security involves enhancing security at the application layer to prevent data breaches and reduce the likelihood of security vulnerabilities. Common vulnerabilities are frequently found in the user authentication processes (logins), which create easy access for a data breach.

Cloud Security

Cloud security encompasses securing data across applications, platforms and infrastructure within a cloud environment. Oftentimes businesses operate on a public cloud, which means they are running in a shared environment. Businesses must ensure that their data is secure and processes are in place to separate their business from a data breach or other security issue that may compromise outside clients of that third-party host. A shared environment shouldn’t mean shared risk of information exposure.

Cryptography

Cryptography and encryption is not just for spies. Cryptography may bring up visions of the WW2 Enigma machine and code-breaking, but in this instance it refers to coding, validating, and securing data. An example is the AES (Advanced Encryption Standard) algorithm, developed by the National Security Agency. The NSA provides cryptography solutions to companies looking for enhanced security. 

Infrastructure Security

Infrastructure security refers to physical plant safety and security. Think of physical media — from mobile devices, desktop computers, and servers to entire labs, data centers, and network hubs. 

Incident Response

How quickly can your company react to an InfoSec threat? This is the incident response. In preparation for a possible data breach, companies need to have a response plan in place for containing the threat and restoring the network. The plan must also include a system to preserve data — with timestamps — for analysis and potential prosecution. 

Vulnerability Management

At the fast pace of business today, things are rapidly changing and systems need frequent reviews and updates. Risk factors include outdated equipment, unprotected networks, and human error through a lack of employee training. Another often-overlooked risk is a relaxed company device policy, such as letting employees use personal devices for work that may not be properly protected. You can evaluate your own company’s level of possible exposure via a thoughtful risk assessment plan. 

What Are the Different Types of Security Attacks?

The types of information security incidents and attacks vary in sophistication levels from simple smash-and-grabs to the complex and meticulously planned long-term attacks. Equipment theft, such as a stolen laptop or USB drive, is a security attack. Unauthorized access to and use of — or changes to — software or data is a security incident. Compromising user accounts and a Denial-of-Service attack (or DoS attack) are also security attacks. Here are the common types of attacks used to commit a security breach:

Phishing

According to the FBI’s Internet Crime Report, phishing was once again the most common cybercrime in 2020, and phishing incidents nearly doubled year-over-year. Phishing attacks rely on human error, so employee training is critical to preventing a data breach due to phishing. Employees need to know not to click on suspicious links or download anything suspicious.

Brute-Force Attacks

In these attacks, hackers use software to repeatedly and systematically attempt password combinations until they find one that works. Given the sophistication of password cracking rigs, relying on a combination of letters, symbols, and numbers is no longer enough to provide strong protection. Limiting login attempts and enabling two-factor authentication are better preventative measures against brute-force attacks.

Malware

Malicious software, aka malware, infects devices without users knowing it’s there. Examples include Trojan horses, spyware, ransomware, and viruses — and can have costly consequences. In 2021, Colonial Pipeline, the biggest oil supplier in the US, got caught up in a ransomware incident, lost days of business, and ultimately paid off their attackers approximately $5 million dollars in bitcoin. According to Bloomberg, the hackers got into the system via a leaked password on an old account that allowed employees to access company servers remotely through a VPN (virtual private network), and it did not require two-factor or multi-factor authentication. Once the hackers were in, they placed the malware, encrypted the company’s data, and demanded a ransom.

Drive-By Downloads

This is a way of distributing malware. Malicious code is added to a page’s PHP or HTTP. When a user hits an infected site, the malware silently invades their device. These threats are hard to identify because websites can be compromised without knowing it, therefore users aren’t alerted.

SQL Injections

Structured Query Language (SQL) injections are when a hacker puts malicious code into a server to manipulate a company’s database. The goal is to access private company data, like customer information and credit card numbers. 

Cross-Site Scripting

These attacks occur when a hacker exploits vulnerabilities by inserting malicious code — usually JavaScript — into the user’s browser. This can allow them to gain access to the browser and a user’s sensitive information. 

Man-in-the-Middle Attacks

Hackers position themselves as middlemen between users and eavesdrop, intercept, and/or manipulate communication between two parties. This often occurs on unsecured networks, like public WiFi. 

Denial-of-Service (DoS) Attacks

A DoS attack overwhelms a website with a flood of traffic using bots in an attempt to crash the system and deny access to real users. Sometimes hackers will initiate a DoS attack to test a system’s integrity, especially when they manage a large consumer-facing website. 

How Can I Detect Security Incidents?

There are different ways to detect if your company is under threat of a critical security incident. Different types of information security incidents will have different markers for discovery. 

• Look for traffic anomalies, attempts to access accounts without permission, excessive use, and access of suspicious files. 
• Servers tend to have a relatively stable and consistent volume of traffic, subject to business calendar needs and resultant fluctuations. If a company experiences an unusual traffic increase, it should look into the cause and look out for an attack. 
• Employees are a main entrypoint for an InfoSec data breach, so be alert to employee access and if anyone on the team may be using their account for information outside of their area. 
• If the company notices an increase in memory or hard drive usage, it could be that someone is using them illicitly or leaking data. Files that are overly large — suspiciously inconsistent in size — could be holding material that a hacker is trying to keep hidden.

What Are Common Attack Vectors?

Attack vectors are the means or path by which a hacker can access a computer or server in order to execute a data breach or compromise a company. They exploit system vulnerabilities and human error. Common attack vectors include email (phishing attacks), compromised credentials (old login information, weak passwords, and not using multi-factor authentication are all risks for this), and weak encryption. Stolen physical media, plus the brute-force attacks, malware, and DoS attacks mentioned earlier are also possible attack vectors.

Seven Common Information Security Incident Types and How to Handle Them

The different types of information security incidents have a variety of methods for how to handle them, and they all are an important part of a rigorous and comprehensive InfoSec strategy. 

1. Third-Party Scanning 

Scanning happens when an external group is doing reconnaissance or probing site security. These can often be ignored unless you detect the IP address is from a source with a bad reputation, or if you notice lots of hits from the same IP source. If the scanning is from a legitimate source, you can contact their site security team. If you are unable to find source information, you can search the WHOIS information in the domain for details.  

2. Malware Infection

Malware can be very damaging. Scan systems frequently for indications of compromise. Signs of malware include unusual system activity, like a sudden loss of memory space, unusually slow speeds, repeated crashes or freezes, and unexpected pop-up ads. Antivirus tools can detect and remove malware. 

3. DoS Attacks

Denial-of-Service attacks can be detected by the flood of traffic hitting your site. Combat them by configuring your servers to fight HTTP flood requests and coordinate with your ISP to block sources when an attack occurs. Also, beware of a DoS diversion attack, which is when a DoS attack is initiated in order to distract security teams from a more serious data breach attempt. If the DoS attack succeeds in crashing a server, a reboot usually solves the problem. After that, reconfiguring firewalls, routers, and servers can block future fake traffic floods.

4. Unauthorized Access

Unauthorized access via brute-force attacks, phishing, or other password exploitations are frequently used to steal sensitive information. Monitor and investigate any unauthorized access attempt, prioritizing those in mission-critical areas with sensitive material. Two-factor or multi-factor authentication is a strong guard against unauthorized access, along with encrypting sensitive and confidential data. 

5. Internal Security Breach 

It’s critical to make sure that employees don’t abuse their access to information. Maintain access levels for employees with regard to the domains, servers, applications, and critical information that they have permissions for. Configure system to record privileged information accessed, and set notifications for unauthorized attempts to access data in restricted areas. Lastly, make sure all systems are monitored, as employee monitoring software reduces the risk of internal theft by identifying careless, disgruntled, or malicious team members.

6. Privilege Escalation Attack

An attacker who gains access to a network will often use privilege escalation to gain usage capabilities that normal users don’t have. This usually happens when a hacker has a low-level account access and wants higher-level IT privileges to study a company’s system or execute an attack. Companies can combat this by limiting access rights on a per-user basis that are calibrated to the unique level required for each employee to complete their tasks. 

7. Advanced Persistent Threat

An Advanced Persistent Threat (APT) is a prolonged and targeted attack. The hacker gains access to a network and remains undetected for an extended amount of time. The hacker will then frequently monitor network activity and steal data rather than cause damage to the network. It’s a prolonged theft where the hacker slyly goes undetected, stealing privileged information. Monitoring incoming and outgoing traffic can help prevent hackers from extracting sensitive information. Firewalls also help protect network information and can prevent SQL injection attacks, which are often used in the early phase of an APT attack.

Real-Life Examples of Information Security Incidents

There have been many high-profile information security incidents involving large numbers of customers and major corporations. In addition to the Colonial Pipeline ransomware exploitation, both Alibaba and LinkedIn have experienced large data breaches in recent years. In 2019, Alibaba experienced a leak of more than 1 billion pieces of user data when a developer scraped customer info including user names and cellphone numbers from their Chinese shopping site, Taobao. The information did not end up on the black market, but after the eight-month-long theft was discovered, the culprits were caught and ultimately fined and sent to prison. It was reported in June 2021 that the theft of LinkedIn information for 700 million users — representing approximately 93% of their user base — was exposed when a hacker bundled data for sale on the black market. The hacker scraped data using the site’s API and captured information that included email addresses, phone numbers, geolocation information, and other social media details that could lead to follow-on social engineering attacks. 

Get Ahead of Information Security Incidents Today

The importance of information security cannot be overstated. The increase in InfoSec incidents and significant data security threats means businesses are more at risk of information security attacks than ever before. Companies need to monitor the data security landscape and be prepared to respond to threats when they occur, and make sure to keep their data safe by adding information security to all aspects of an organization. 

It’s critical to establish an InfoSec incident response plan to ensure that your company is poised and ready to combat all types of information security incidents. This will reduce the cost of an information security attack and also work to prevent future attacks. Having the right technology can help — get started with AuditBoard’s information security compliance management software today! 

Which of the following is the most common computer related security incident *?

What is the most common security incident?

What are the most common types of computer security attacks?

What is the most common factor in computer security issues?