Identifying Potential Malicious Attacks, Threats, and Vulnerabilities

In such cases, the organization will not have any capital loss, but will lose precious data-sets that is stored in the system. Further, there could be various root causes of such threats. The criminal intentions of the inner employees, the breaching intentions of the hackers and even the poor infrastructure could also be one of the major root causes of such threats. Hence, there is a need to develop solutions that will help to overcome the threats associated with each of the risk

Some people like to hack out of revenge. In today’s political climate – that makes sense. We are noticing more and more that the liberties they have been afforded us aren’t always for the benefit of the people. The power to vote has been something minorities were only awarded when it was signed into law in 1965 by President Lyndon Johnson outlawing the discriminatory voting practices adopted in Southern states after the Civil War. The fear of this country’s future political climate is a concern not only for Americans, but also internationally. “Fear of cybersecurity threats has plagued the 2016 presidential election since June when the Democratic National Committee site was hacked, with the U.S. government later determining the culprits were

All three of theses are high for impact as they can cause great deal of damage to the network and control I’ve listed as medium because there is the human action that must be considered. Virus and malware detection software should be installed and kept up-to-date as well as training for users to understand how to use email. Users should always be aware of who is sending them email and not open attachments from users they do not know or unsure of. Phishing is easy and generally great way of gaining access to a network, people in general want to help, they may get an email or a phone call from someone posing as something they should be able to trust and provide details that could allow the hacker to gain access to their network. Information such as equipment type (server, firewall, routers), IP address, email addresses, any of this information could be used to stage an attack on the network. Again training is key here. If you train your employees well on data security they will know what they can and can’t answer and whom to send request to so they can be followed-up on. The last one for the Workstation is the

Another threat is Phishing, it is the fraudulent practice of sending emails pretending to be from reputable companies in order to lure individuals to reveal personal information, such as passwords and credit card numbers.

As it was pointed out in a global security survey organizations are “haunted” by threats and that raises the concerns and demonstrates how vulnerable they are to attacks. The 48 per cent it thinks it is exposed to loss of data (information leakage) in another case 46 per cent in phishing and pharming and that pairs with the fact that the weakest link in the security system of an organization that causes failure is humans(such as employees, customers) with 86 per cent (Deloitte, 2009: 29-30). Therefore based on the information provided by these surveys, corporate intranets are the main target of internet attacks

Recently, the company has been the subject of a data breach in which confidential files in the network have been accessed by an unknown party. Upon investigation we have found that a supervisor that handles customer complaints received an e-mail from what appeared to have been a customer with a complaint regarding an error on the website. Upon investigation he found no such error, but did find that the return address did not exist. It is very likely the company has become the victim of one or more social engineers seeking to exfiltrate data from the company. It is believed that that source of the attack was a spear phishing campaign via the e-mail sent to the supervisor that oversees customer complaints. While supervisor e-mails are not normally

Multiple of organizations have gone to great lengths to make sure their networks are fully functioning correctly because it is the best way to facilitate information being shared and distributed as well as keep sensitive information secured. Organizations will eventually become exposed to potential malicious attacks and threats over a period of time. One of the potential threats to any organization is internal threats, which is a disgruntled employee that knows how the organization they work for operates. They already have some sort of access to a computer system in order to cause the most damage to an organization for a specific reason by putting a virus, Trojan horse, or a worm inside the network (Microsoft, n.d.). The second potential threat to any organization could be malicious individuals, groups, or organizations that are known as structured external threats (Tech-FAQ, 2012). These attackers are highly skilled on how a network works, and already know what damages and losses they will cause an organization. The motives for many structured external threats have to do with greed, politics, terrorism, racism, and criminal bribes (Tech-FAQ, 2012). The third potential threat to any organization is an unstructured external threat, which is an attacker often known as a script kiddie because they lacks the skills to develop the threat on their own when they try to attack an organization. They would use any cracking or scripted tools on the Internet that are already made to

Spam and Phishing are the two major types of email attacks. Organizations need to clearly understand what these terms mean in order to assess their impact and minimize their spread. Spam is unsolicited commercial e-mail. Phishing, on the other hand, uses legitimately looking emails that trick the receiver into giving out sensitive information (Boyle & Panko, 2015). Spam is the annoying email promising the reader to get rich, skinny, prettier etc. Most people are familiar with the Nigerian scam where a prince or oil tycoon wants to give up his fortune to the lucky

There are a variety of vulnerability identification factors that are seen as critical. The types of vulnerabilities associated with the Information Technology System depend on the nature of the system itself. Certain rules govern what action should be taken in this step. If the system has not yet been designed, the search for vulnerabilities should concentrate on the security policies of the organization, security procedures, system requirement definitions, vendor and developer’s product analysis. If the system is being implemented the identity of vulnerabilities should to expanded to include more specific information including security features described in the security documentation and results of the security certification test and evaluation. If the system is up and running, then the analysis of the IT system security features and security controls, technical and procedural should be used to protect the system. A table of Security Criteria can be found below:

The keys to prevention and detection of social engineering attacks should be included in the organizations security policy. Social engineering attacks require the same approach and security posture as another type of attacks on an organizations information and data. The organization must identify its assets, turn up span mail features, clarify the line between work and personal, develop effective access management, and conduct training and awareness of

The attacker(s) use social engineering to obtain the information from the organizations. First, the attackers would send emails to the employees of the organizations as if they were executives or part of the company. The emails contained attachments, such as Microsoft Offices files, that were loaded with exploit code so that when the employee opened the file, it will execute the exploit code compromising the computer. Also, a Trojan was executed when the file was opened and it attempts to connect the remote site that hardcoded into the virus. When the Trojan successfully contacted the remote site, the attacker(s) had control over the employee’s computers and compromised the information that they wanted. In this situation, the best way to protect a company from this types of attacks is by conducting training in which employees are introduced to the different ways the company could be attacked, how to identify these attacks, and what to

Computer security breaches have been occurred in too many places since information technology is used. Security practitioners declare that those breaches incident cost vast businesses that is estimated more than $1 billion, according to Pinsent Masons, (2014). There are also non-financial costs that companies may suffer. Figure 1 is illustrated World's Biggest Data Breaches that happened last decade.

The following report is a deep analysis the threat known as CVE-2017-11292; as mentioned in the previous threat analysis report summarizing three current threats. The purpose of the report is to notify National University of the harm that may be caused by CVE-2017-11292 and provide mitigations and solutions.

All employees will be required to take a social engineering course and the HR department will document the entire employee training regardless of their position in the company. The company will also provide email training on how to determine if someone is trying to use social engineering on the employee to gain information they should not have. During the training the company procedures and policy will address what can happen when these policies are violated. The company could consider using honey spot server, which would have a fake email server and other application server, in which a hacker will think they are on the live systems, but will really be on a fake systems and have alarms setup to inform the IT staff of any intrusion. To prevent spoofing, the IT staff can set up email authentication using signed and secure email message format. This encryption method will allow the sender encrypt the message with the receiver public key. The receiver will use the sender public key to verify the message and use his or her own private key to decrypt the

With the increase in threats over the past few years it is no longer acceptable for an organization to feel data is protected