Staying Safe from Cyber Attacks: Common Threats and Social Engineering

Attackers use two main routes: breaking into systems with technical tricks, or tricking people into helping them. These two guides cover both: the most common technical threats, and the social engineering attacks that target human trust.

1. Common Threats Reference

DoS / DDoS

• What it is: A Denial-of-Service attack tries to make a system or service unavailable by overwhelming it with traffic or requests. A DDoS attack uses many devices to generate the traffic.
• Warning sign: A website or server suddenly becomes extremely slow or unavailable because of unusually high traffic.

Zero-Day Attack

• What it is: A zero-day attack exploits a software vulnerability before a security patch or fix is available.
• Warning sign: Unexpected or unusual system behavior occurs even though the software is fully updated.

SQL Injection

• What it is: SQL injection occurs when an attacker inserts malicious SQL commands into an application's input fields to access or manipulate database information.
• Warning sign: Unexpected database errors or unusual database activity appear after user input is submitted.

XSS (Cross-Site Scripting)

• What it is: XSS occurs when an attacker injects malicious scripts into a website so that the script runs in another user's browser.
• Warning sign: Unexpected pop-ups, redirects, or suspicious scripts appear when viewing a webpage.

Password Attack

• What it is: A password attack attempts to discover or obtain a user's password through methods such as guessing, brute force, or stolen credentials.
• Warning sign: Many failed login attempts or unusual login attempts appear on an account.

Spoofing

• What it is: Spoofing occurs when an attacker pretends to be a trusted person, device, website, email address, or network to deceive the victim.
• Warning sign: An email, website, or network appears legitimate but has a suspicious address, sender, or unexpected request.

2. Social Engineering Awareness

What is social engineering?

Social engineering is a technique where attackers trick or manipulate people into giving away sensitive information or performing an unsafe action. Instead of attacking a computer directly, the attacker targets human behavior and trust.

Four types of social engineering attacks

1. Phishing: Attackers send fake emails or messages that appear legitimate and try to make you click a link, open an attachment, or provide sensitive information.
2. Vishing: Attackers use phone calls or voice messages while pretending to be someone trustworthy, such as a bank employee or company staff member.
3. Smishing: Attackers send fraudulent SMS or messaging-app messages containing suspicious links or requests for personal information.
4. Pretexting: An attacker creates a believable story or pretends to be a trusted person to convince you to reveal information or perform an action.

Three rules to always follow

1. Stop and verify: If a request seems unusual or urgent, verify the person's identity through a trusted method before taking action.
2. Never share sensitive information: Do not share passwords, OTPs, security codes, or confidential company information through unexpected emails, calls, or messages.
3. Report suspicious activity: If you suspect a social engineering attempt, do not respond or click anything suspicious. Report it immediately to your company's IT or security team.

Final Thoughts

Technical attacks target systems, and social engineering targets people. Knowing the warning signs of both makes you much harder to fool.

Think before you click. Verify before you trust. Report when you are unsure.

Thanks for reading! If you found this useful, follow for more cybersecurity basics.