Hands on a laptop with a hologram of padlocks over the top

Cybersecurity threats and how to avoid them

/in , /

Issues of cybersecurity are issues for all of us, and exist at an individual, national and international level.

Our interconnected, digital world relies on technological and computer infrastructure. Almost every element of our lives – including how we bank, travel, communicate, work, shop and socialise – intersects with information technology and digital operating systems in some way. 

While such technological advances offer untold benefits and opportunities, they also carry with them the risk of presenting vulnerabilities to individuals and organisations who seek to benefit from disrupting these systems. 

We all know the importance of creating strong passwords, avoiding suspicious links and installing appropriate security software. However, good digital etiquette only gets us so far.

Cybercrime is increasing year on year. The following cyberthreat-related statistics demonstrate the scope and scale of the issue:

  • the global cost of online crime will reach $300 billion by 2024
  • a business falls victim to a ransomware attack every 14 seconds
  • phishing emails are used to launch 91% of cyber-attacks
  • small businesses are the target of 43% of all cyber-attacks
  • on average, it takes six months to detect a data breach.

What are cybersecurity threats?

A cybersecurity threat is any malicious, deliberate activity that targets computer systems, computer networks, information technology assets, intellectual property or sensitive data. The aim of such threats vary, but generally they seek to gain some benefit from the attack, such as disrupting digital life, gaining unauthorised access, or damaging or stealing data. While many cybersecurity attacks originate from unknown individuals or organisations in remote locations, they can also originate from insiders, within an organisation. All are labelled ‘threat actors’, with common types including:

  • Hostile nation-states, who engage in cyber warfare such as disruption of critical infrastructure, espionage, propaganda and website defacement.
  • Hackers, ranging from those who seek to steal data and confidential information, to those who gain access to systems as a challenge.
  • Hacktivists, who are pursuing a political agenda, generally through the sharing of propaganda.
  • Terrorist groups, who seek to damage national interests and national security.
  • Insiders and third-party vendors, who can deliberately expose sensitive data, or accidentally introduce malware that leads to a data breach.

It’s not just a pressing issue for large entities such as financial institutions, national governments and tech companies; small-to-medium-sized businesses, as well as individuals, are among the most vulnerable to cyberthreats and should take steps to defend themselves.

What are the most common threats to cyber security?

Common types of cyberthreats and cyber-attacks include:

  • Malware. Computer viruses, spyware, worms and ransomware are all forms of malicious software, known as malware. They target vulnerabilities in information systems and networks, typically via malicious links and email attachments that introduce dangerous software into the system. Malware can: render systems inoperable, install additional harmful software, obtain information covertly and block access to network components.
  • Phishing. Phishing attacks are an incredibly common cyberthreat. They use fraudulent communications (generally emails), that appear to come from a known or reputable sender to steal personal and sensitive data – such as credit card information, passwords and login information – or install malware onto a system. Spear phishing refers to a phishing attack that targets a specific individual or organisation.
  • Man-in-the-middle (MitM) attack. MitM attacks – also referred to as eavesdropping attacks – involve cybercriminals inserting themselves into a two-party transaction (and so becoming the ‘man in the middle’) to interrupt traffic,filter or steal data.
  • Denial-of-service attack. These attacks flood computer networks, servers and systems with traffic in a bid to cripple bandwidth and resources so legitimate requests cannot be fulfilled. There is also a Distributed-Denial-of-Service (DDoS) attack; a DDoS attack involves the use of multiple devices to stage a cyber-attack.
  • Structured Query Language (SQL) injection. Malicious code is ‘injected’ into a database in order to gain access to sensitive information or data. It’s an example of a ‘backdoor’ cyberthreat.
  • Zero-day exploit. These attacks exploit networks at times when they are vulnerable or compromised – crucially, before solutions or patches are introduced.
  • DNS tunnelling. These attacks re-route DNS requests to a cybercriminal’s server, providing them with a command, control channel and data extraction path in order to obtain data. They are notoriously tricky to detect.

This list is not exhaustive. Other types of cyber-attacks include Trojans, XSS attacks, drive-by attacks, brute force attacks, whale-phishing attacks, ransomware, data breaches and URL interpretation.

How can you protect networks from cyber security threats?

Every organisation should invest in protecting itself from cybercriminals and cyber protection should form part of any risk management plan. This can be achieved by implementing various security measures.

One is to ensure that all team members throughout the business are alert to the dangers of cyber security; they should be trained to prevent breaches and detect potential threats. 

As many issues of data security occur through accidental insider-user error, this is one of the most effective ways to combat digital vulnerability. Employees should be alert to malicious links, check sender information, maintain strong password etiquette – never share passwords and use two-factor authentication – and take care when handling sensitive information.

From a systems perspective, it’s critical that all hardware and software is up to date and fit for purpose. This includes:

  • supporting patch management systems
  • ensuring networks are behind firewalls
  • implementing endpoint protection
  • backing up data in a secure way
  • controlling and monitoring user access to all systems
  • securing wifi networks
  • establishing personal accounts for all employees.

Protect your systems from potential cyber-attacks

Cybersecurity risks aren’t going away, so individuals and security teams with the specialist skills and expertise to safeguard businesses from these attacks are in high demand. People with these skills can often choose from a wide range of rewarding careers.

Whether you have a computing background or not, you can develop the knowledge and skills to succeed in the industry with the University of York’s online MSc Computer Science programme. You’ll gain in-depth understanding in each of the main areas of computer science, learning how to apply your new skills to real-work environments. Through flexible modules, you’ll explore programming, software development, data analysis, computer networks and much more.