Cybersecurity: Attack Types & Defenses (Security+ Style)

Confidentiality: only authorized people can read data (encryption, access control) Integrity: data is not altered undetected (hashing, signatures) Availability: systems are up when needed (redundancy, backups)

Phishing: mass fraudulent messages that trick people into clicking or sharing credentials. Spear phishing: targeted at a specific person or group. Whaling: spear phishing aimed at executives.

Phishing over voice calls

Phishing over SMS text messages

Pretexting: inventing a believable scenario (e.g. posing as IT support) to get information. Tailgating: following an authorized person through a secure door without badging in (piggybacking if they knowingly let you in).

Virus: attaches to a file and needs user action to spread. Worm: self-replicates across networks with no user action. Trojan: malware disguised as legitimate software.

Encrypts the victim's files (and often steals them) and demands payment for the key.

Rootkit: hides deep in the OS (often the kernel) to keep privileged, stealthy access. Keylogger: records keystrokes. Spyware: secretly collects user activity. Logic bomb: code that triggers when a condition is met (a date, a user being deleted).

A denial-of-service attack floods a target to make it unavailable. A distributed DoS comes from many machines at once, usually a botnet of compromised devices, which makes it hard to block.

The attacker secretly sits between two parties, reading or altering their traffic. Often enabled by ARP poisoning, rogue Wi-Fi access points or DNS spoofing.

ARP poisoning: fake ARP replies link the attacker's MAC address to another host's IP on the local network. DNS poisoning: corrupt DNS records send users to a malicious IP for a legitimate domain name.

Untrusted input is inserted into a SQL query and changes its logic (e.g. ' OR 1=1 -- ). Defense: parameterized queries (prepared statements), plus input validation and least-privilege database accounts.

The attacker injects script that runs in other users' browsers on a trusted site, e.g. to steal session cookies. Defenses: output encoding/escaping, input validation, Content Security Policy, HttpOnly cookies.

Tricks a logged-in user's browser into sending an unwanted request to a site that trusts it. Defenses: anti-CSRF tokens and SameSite cookies.

A program writes more data into a buffer than it holds, overwriting adjacent memory and possibly letting an attacker run code. Defenses: bounds checking, memory-safe languages, ASLR, DEP.

Brute force: try every combination. Dictionary: try common words and passwords. Spraying: try a few common passwords against many accounts (avoids lockouts). Credential stuffing: reuse username/password pairs leaked from other breaches.

A precomputed table of hashes for cracking password hashes quickly. Salting (a unique random value added to each password before hashing) defeats it.

A flaw unknown to the vendor, so no patch exists yet when attackers exploit it

Symmetric: one shared key for encryption and decryption; fast (AES). Asymmetric: a public/private key pair; slower, solves key exchange (RSA, ECC).

Hashing is one-way and fixed-length (SHA-256), used for integrity and password storage. Encryption is reversible with the right key, used for confidentiality.

The sender hashes the message and signs the hash with their private key. Anyone verifies it with the sender's public key, proving integrity, authenticity and non-repudiation.

It verifies identities and issues digital certificates binding a public key to a name (like a domain), signed with the CA's own key so browsers can trust them.

Something you know (password, PIN), something you have (phone, hardware key), something you are (fingerprint, face). Location (somewhere you are) is sometimes used as an extra signal.

Authentication (who are you?), Authorization (what may you do?), Accounting (what did you do? logging).

Give users and processes only the minimum access they need to do their job, and nothing more.

Defense in depth: multiple layered controls so one failure is not fatal. Zero trust: never trust by network location; verify every user, device and request every time.

An intrusion detection system monitors and alerts. An intrusion prevention system sits inline and can block traffic automatically.

A vulnerability scan is automated and identifies known weaknesses. A penetration test is an authorized simulated attack that actively exploits weaknesses to show real impact.

Avoid (stop the risky activity), Transfer (insurance, outsourcing), Mitigate (add controls to reduce it), Accept (live with it, documented).

Recovery point objective: the maximum acceptable data loss, measured in time (how old the last backup can be). Recovery time objective: the maximum acceptable downtime before service is restored.

Hot: fully equipped and synced, ready almost immediately (most expensive). Warm: hardware ready, data must be restored. Cold: space and power only (cheapest, slowest).

1. Preparation 2. Detection and analysis 3. Containment, eradication and recovery 4. Post-incident activity (lessons learned)