Cyber Threats and Attacks

Syllabus
● Types of cyber threats: internal and external threats
● Types of attackers: script kiddies, insiders, hacktivists, cybercriminals
● Malware types: virus, worm, trojan, ransomware, spyware, adware
● Phishing, social engineering, and identity theft
● Denial of Service (DoS) and Distributed DoS (DDoS) attacks
● Man-in-the-middle (MitM) attacks and session hijacking
● Case studies of recent cyberattacks

1. Cyber Threats

A cyber threat is a malicious attempt to disrupt digital life, steal sensitive data, or
damage information systems, networks, or devices. These threats exploit vulnerabilities in
software, hardware, or human behavior. They are a major concern in cybersecurity as they
can cause financial losses, reputational damage, and even national security risks.

In today’s interconnected world, the scale and sophistication of cyber threats are
constantly increasing due to rapid digital transformation, cloud adoption, and the growth of
Internet of Things (IoT) devices. Attackers are leveraging advanced technologies such as
artificial intelligence and automation to launch more targeted and complex attacks. As a
result, organizations and individuals must adopt proactive cybersecurity measures, including
continuous monitoring, threat intelligence, and regular security awareness training, to stay
resilient against evolving cyber risks.

1.1 Types of Cyber Threats

Cyber threats can originate from within an organization or from external sources. They are
broadly classified into internal threats and external threats based on the origin of the attack.
Both of them pose serious risks, but their nature causes, and prevention strategies differ.

1. Internal Threats

Internal threats come from people inside the organization, such as employees,
contractors, or business partners who have legitimate access to systems and networks.
These threats may be intentional (malicious activity) or unintentional (due to negligence or
lack of awareness).

 Examples:
o Disgruntled employees stealing sensitive company data.
o Accidental deletion or leakage of confidential files.
 o Weak passwords or careless sharing of login credentials.
 Impact: Loss of intellectual property, insider fraud, data breaches, reputational
harm.
 Prevention: Role-based access control, monitoring employee activity, cybersecurity
awareness training, and enforcing strict policies.

2. External Threats

External threats originate from outside the organization, typically by hackers,

cybercriminals, or state-sponsored groups trying to exploit system vulnerabilities. These
threats are often more sophisticated and targeted.

 Examples:
o Phishing emails tricking users into sharing credentials.
o Malware attacks such as viruses, ransomware, or trojans.
o Distributed Denial of Service (DDoS) attacks on websites or servers.
 Impact: Service disruption, financial fraud, theft of sensitive information, large-scale
data breaches.
 Prevention: Firewalls, intrusion detection/prevention systems (IDS/IPS), regular
patch updates, endpoint protection, and incident response plans.

1.2 Difference between Internal and External Threats

Aspect Internal Threats External Threats

Originate from inside the Originate outside the organization
Source organization (employees, (hackers, cybercriminals, competitors,
contractors, and partners). etc.).
Perpetrators attempt to gain
Perpetrators usually have legitimate
Access unauthorized access through
access to systems and data.
exploitation or attacks.
Can be malicious (data theft, Primarily malicious, aimed at stealing
Intent sabotage) or accidental data, disrupting services, or causing
(carelessness). harm.
Disgruntled employee leaking data, Malware attacks, phishing emails,
Examples
careless user clicking phishing link. DDoS attacks, SQL injection.
Harder to detect because insiders
Easier to detect with firewalls, IDS/IPS,
Detection are trusted users with authorized
and monitoring external connections.
privileges.
Service disruption, large-scale
Data theft, insider fraud, misuse of
Impact breaches, financial losses, national
resources, reputational damage.
security risks.
Role-based access control, user Firewalls, antivirus, IDS/IPS, patch
Prevention
monitoring, awareness training, management, multi-factor
Measures
strict policies. authentication.
2. Types of Attackers

In the field of cybersecurity, understanding the types of attackers is just as important

as understanding the threats themselves. Attackers can differ in their skills, motivations, and
methods, ranging from inexperienced individuals experimenting with ready-made tools to
highly organized groups targeting financial or political gains. By classifying attackers into
categories such as script kiddies, insiders, hacktivists, and cybercriminals, organizations can
better anticipate potential risks and design appropriate defense strategies.

Types of
Attackers

Script Kiddies Insiders Hacktivists Cybersriminals

1. Script Kiddies

Script kiddies are amateur attackers who lack advanced technical skills and rely on
pre-written tools, scripts, or malware created by skilled hackers. They use these tools to
exploit known vulnerabilities in systems without fully understanding how the attack works.
Their motivation is often curiosity, fun, thrill, or to gain recognition among peers.

While script kiddies may not be as sophisticated as professional hackers, they still pose a
significant risk because the tools they use can cause system disruptions, website
defacements, or data breaches. Since these tools are easily available online, script kiddie
attacks are common, unpredictable, and can sometimes unintentionally cause severe
damage.

2. Insiders

Insiders are individuals within an organization, such as employees, contractors, or

business partners, who misuse their legitimate access to systems and data. They already
have knowledge of the internal network and may exploit this privilege to steal sensitive
information, sabotage operations, or share data with competitors.

Insider attacks are particularly dangerous because they are harder to detect compared to
external threats. The motivation behind insider threats can include personal gain (e.g.,
selling data), revenge due to dissatisfaction, or even unintentional mistakes such as
mishandling confidential information. Effective monitoring, strict access controls, and
employee training are crucial to mitigating insider risks.
3. Hacktivists

Hacktivists are attackers who combine hacking with activism, often targeting
organizations, governments, or corporations to promote political, social, or ideological
causes. Their attacks are not primarily motivated by financial gain but rather by the desire to
spread a message, protest, or embarrass their target.

Common tactics of hacktivists include website defacement, Distributed Denial of

Service (DDoS) attacks, and leaking sensitive information to the public. While hacktivist
attacks may not always cause financial loss, they can severely damage the reputation of
organizations and governments. A well-known example is the activities of the group
“Anonymous.”

4. Cybercriminals

Cybercriminals are professional attackers motivated primarily by financial gain. They

use sophisticated techniques such as phishing, ransomware, identity theft, and online
banking fraud to steal money or sell stolen data in black markets. Cybercriminals often
operate in organized groups and may target both individuals and large organizations.

Because they are financially motivated, cybercriminals tend to continuously innovate

their methods to bypass security systems. Their attacks can cause enormous financial losses,
legal issues, and reputational damage. Defences such as encryption, fraud detection
systems, and strong authentication are critical in minimizing risks posed by cybercriminals.

Aspect Script Kiddies Insiders Hacktivists Cybercriminals

Low – rely on Medium to High
Medium to High – High – highly skilled,
ready-made tools – understand
often skilled often part of
Skill Level and scripts without internal systems
hackers driven by organized
much technical due to legitimate
ideology cybercrime groups
knowledge access
Revenge,
Curiosity, fun, peer Political, social, or
Motivation financial gain, or Financial profit
recognition ideological causes
negligence
Downloaded Misuse of access Website
Phishing,
Techniques malware, DoS rights, stealing defacement, data
ransomware,
Used tools, automated sensitive info, leaks, DDoS
identity theft, APTs
exploits sabotage attacks
Medium to High –
High – trusted Severe – causes
Usually low but can damages
access makes financial loss, major
Impact disrupt systems or reputation, leaks
them dangerous, data breaches, long-
expose minor data data, disrupts
harder to detect term damage
services
3. Types of Attacks

Cybersecurity attacks are deliberate attempts by attackers to compromise the

confidentiality, integrity, or availability of digital resources. These attacks can come from
various sources and target different layers of technology, including networks, applications,
users, and even entire organizations. To understand them better, they can be broadly
categorized into Network-based attacks, Application-based attacks, Human-based attacks,
and Malware-based attacks.

Types of
Attacks

Network Application Human Based Malware

Based Attacks Based Attacks Attacks Based Attacks

1. Network-Based Attacks

Network-based attacks exploit vulnerabilities in network infrastructure,

communication protocols, or connected devices. Attackers typically aim to intercept,
disrupt, or flood communication channels to either steal information or deny access to
legitimate users. These attacks are often executed remotely and can have large-scale
impacts, especially on organizations that rely heavily on internet-based services.

One common network-based attack is the Denial of Service (DoS) or Distributed

Denial of Service (DDoS), where attackers overwhelm a server or network with excessive
traffic, making it inaccessible to users. Such attacks are disruptive and can lead to financial
losses, downtime, and reputational damage. Another example is Man-in-the-Middle (MitM)
attacks, where attackers intercept communication between two parties to steal sensitive
data like login credentials or credit card details.

Network-based attacks also include IP Spoofing and DNS Poisoning, where attackers
forge IP addresses or corrupt DNS tables to redirect traffic to malicious sites. These
techniques are often precursors to more advanced exploits, enabling hackers to set up
phishing pages or malware injection points. Since networks serve as the backbone of digital
communication, compromising them can have severe consequences.

To defend against network-based attacks, organizations implement firewalls,

Intrusion Detection and Prevention Systems (IDPS), Virtual Private Networks (VPNs), and
encryption techniques. Regular monitoring of network traffic and anomaly detection are
also critical in identifying potential threats before they cause large-scale damage.
2. Application-Based Attacks

Application-based attacks target software and web applications by exploiting

vulnerabilities in code, input validation, or security misconfigurations. Since applications
handle sensitive data like personal information, banking credentials, and business records,
they are prime targets for cybercriminals. Attackers often exploit weak coding practices or
unpatched software to infiltrate systems.

One of the most common application-based attacks is SQL Injection, where malicious
queries are inserted into input fields, allowing attackers to manipulate or extract data from
backend databases. Similarly, Cross-Site Scripting (XSS) allows attackers to inject malicious
scripts into trusted websites, which then execute in user browsers, stealing session data or
spreading malware.

Other critical application-based attacks include Zero-Day Exploits, where hackers

take advantage of newly discovered vulnerabilities before developers can patch them, and
Remote Code Execution (RCE), which allows attackers to run unauthorized code on a
victim’s system. These attacks can result in full system compromise and unauthorized access
to sensitive data.

To mitigate application-based attacks, developers follow secure coding practices,

regular patching, vulnerability testing, web application firewalls (WAFs), and code audits.
Adopting frameworks like OWASP Top 10 also helps organizations focus on critical security
risks in web applications.

3. Human-Based Attacks

Human-based attacks exploit psychological manipulation rather than technical flaws.

Since humans are often considered the "weakest link" in cybersecurity, attackers focus on
tricking individuals into revealing confidential information, granting access, or performing
risky actions. These attacks bypass advanced security technologies by targeting human trust
and behavior.

Phishing is the most common human-based attack, where fraudulent emails or

messages trick users into clicking malicious links or entering login credentials. More
advanced forms include Spear Phishing (personalized attacks on specific individuals) and
Whaling (targeting executives or high-profile leaders). Attackers may also use Vishing (voice
phishing) and Smishing (SMS phishing) for social engineering.

Another example is Insider Attacks, where employees or trusted individuals misuse

their access rights to steal or leak sensitive data. Insiders may act maliciously for personal
gain or unintentionally by falling victim to phishing or social engineering. These attacks are
particularly dangerous because insiders already have legitimate access to systems.
 Preventing human-based attacks requires cybersecurity awareness training, multi-
factor authentication (MFA), strict access control policies, and regular monitoring of
employee activities. Encouraging a culture of security, where employees report suspicious
activities, also reduces the risk of such attacks.

4. Malware-Based Attacks

Malware (malicious software) is one of the most common and dangerous forms of
cyberattacks. It is designed to infiltrate systems, disrupt operations, steal data, or demand
ransom. Malware can spread through infected files, email attachments, malicious websites,
or removable devices, making it highly versatile and difficult to detect without proper
defense.

Viruses are malware programs that attach themselves to files and spread when the
infected file is executed, while Worms replicate themselves across networks without user
interaction. Trojans disguise themselves as legitimate software but secretly perform
malicious actions, such as stealing data or providing backdoor access to attackers.

A particularly damaging type of malware is Ransomware, which encrypts files and

demands payment for decryption keys. High-profile ransomware attacks like WannaCry and
Petya have disrupted hospitals, businesses, and governments worldwide. Similarly, Spyware
secretly monitors user activities, recording keystrokes or stealing sensitive information,
while Adware bombards users with unwanted advertisements that may also serve as
gateways to further infections.

To protect against malware, organizations use antivirus software, intrusion

prevention systems, regular patching, endpoint protection, and backup strategies. Educating
users about suspicious attachments and downloads is equally critical, as many malware
infections begin with human error.
4. Malware

Malware (short for malicious software) is a broad category of software specifically

designed to infiltrate, damage, or gain unauthorized access to systems. Unlike general
software, malware operates secretly and often without the user’s consent, making it one of
the most dangerous forms of cyber threats. It can spread through email attachments,
malicious download, compromised websites, or infected storage devices. Once inside a
system, malware can steal data, disrupt operations, monitor activities, or even demand
ransom. The most common types of malware are viruses, worms, trojans, ransomware,
spyware, and adware. Each type functions differently but shares the common goal of
exploiting vulnerabilities for malicious gain.

1. Virus

A virus is one of the earliest and most well-known forms of malware. Much like a
biological virus, it attaches itself to files, programs, or boot sectors and spreads when the
infected file is executed. Viruses usually require human action (such as running an
application or opening an infected file) to activate and propagate.

Viruses can perform various harmful actions such as corrupting files, deleting data,
or slowing down system performance. Some viruses are relatively harmless, while others
can cause massive destruction by wiping out hard drives or making systems inoperable.
 A classic example is the ILOVEYOU virus (2000), which spread via email attachments
and caused billions of dollars in damages worldwide by overwriting files. Modern viruses are
often combined with other malware techniques to increase their effectiveness and stealth.
Prevention measures include updated antivirus software, email scanning tools, and user
training to avoid suspicious attachments.

2. Worm

Unlike viruses, worms are self-replicating malware that do not need user interaction
to spread. They exploit vulnerabilities in operating systems or networks, allowing them to
propagate rapidly across devices once they infect a single system. Worms are particularly
dangerous because of their ability to spread quickly through networks, consuming
bandwidth, and overwhelming servers. This can lead to Denial of Service (DoS)-like
situations even without direct malicious intent. Additionally, worms often carry "payloads"
such as ransomware or spyware, amplifying their damage.

One of the most infamous worms was the Conficker worm (2008), which infected
millions of computers globally and created massive botnets. Another example is the SQL
Slammer worm, which spread worldwide in minutes, disrupting banking, government, and
airline systems. Defense strategies include timely patching of systems, intrusion detection
systems, and network monitoring.

3. Trojan

A Trojan horse (Trojan) is a type of malware that disguises itself as legitimate

software or files to trick users into installing it. Unlike viruses and worms, Trojans do not
self-replicate but rely heavily on deception. Once installed, Trojans can create backdoors in
systems, giving attackers remote control over the device. This can be used to steal data,
install additional malware, or monitor user activity. For instance, banking Trojans are
designed specifically to steal online banking credentials.

The term “Trojan” originates from the Greek myth of the Trojan Horse, where
attackers hid inside a seemingly harmless wooden horse to infiltrate Troy. Similarly, cyber
Trojans appear benign but unleash destructive activity once inside. Prevention involves
downloading software only from trusted sources, using endpoint security, and avoiding
cracked/pirated software.

4. Ransomware

Ransomware is one of the most damaging and widely reported forms of malware in
recent years. It encrypts the victim’s files or locks their system, demanding payment (usually
in Cryptocurrency) in exchange for a decryption key or system access. There are two main
types of ransomware:

 Locker ransomware: locks the user out of the device entirely.

 Crypto ransomware: encrypts files and demands ransom for decryption.
 High-profile attacks like WannaCry (2017) and Petya/NotPetya have crippled
hospitals, businesses, and government organizations, highlighting ransomware’s destructive
power. Paying the ransom does not guarantee data recovery, and it encourages further
attacks. Defenses include maintaining offline backups, updating security patches, and using
strong email filtering systems. Awareness training to avoid clicking suspicious links is also
vital.

5. Spyware

Spyware is malware designed to secretly monitor user activities and collect sensitive
information without consent. It can log keystrokes (keyloggers), track browsing habits, steal
credentials, or even record audio and video from devices. Spyware often enters systems
bundled with free software, infected attachments, or malicious websites. Since it operates
in the background, it is difficult to detect without security tools. The stolen information may
be used for identity theft, financial fraud, or corporate espionage.

For example, CoolWebSearch spyware hijacked browsers and redirected users to

unwanted sites. Similarly, advanced spyware has been used by state actors for surveillance
purposes. Protection strategies include anti-spyware software, firewalls, and exercising
caution with downloads and browser extensions.

6. Adware

Adware is malware that automatically displays or downloads unwanted

advertisements on a user’s system. While not always as destructive as ransomware or
spyware, it can be highly intrusive and reduce system performance. Some adware also acts
as a gateway for more harmful malware infections.

Adware often comes bundled with freeware or shareware, where users unknowingly agree
to its installation. Once active, it floods browsers with pop-ups, redirects searches, or
collects user data for targeted advertising. Though sometimes dismissed as a nuisance,
adware can compromise privacy and open doors to phishing and spyware.

For instance, Fireball adware (2017) affected millions of computers worldwide,

hijacking browsers and installing other malicious components. Prevention involves using ad-
blockers, reviewing installation agreements carefully, and keeping systems updated.

5. Phishing

Phishing is a type of cyberattack in which attackers trick individuals into revealing

sensitive information such as usernames, passwords, banking details, or credit card
numbers by pretending to be a trustworthy entity. It is one of the most common social
engineering attacks, exploiting human psychology rather than technical vulnerabilities.
Phishing usually occurs through emails, text messages (smishing), phone calls (vishing), or
fake websites. Attackers design messages that look genuine, often imitating banks, e-
commerce platforms, government agencies, or even colleagues within an organization.

The message typically urges the victim to click on a malicious link, download an
infected attachment, or provide personal information directly. Once the victim complies,
attackers can gain access to accounts, steal money, or launch further attacks using the
compromised credentials.

Types of Phishing

1. Email Phishing – Fake emails that appear to come from trusted sources.
2. Spear Phishing – Targeted phishing aimed at specific individuals or organizations.
3. Whaling – A type of spear phishing aimed at high-profile targets such as CEOs or
executives.
4. Smishing – Phishing through SMS messages.
5. Vishing – Phishing through voice calls.
6. Clone Phishing – Attackers resend a legitimate email with a malicious link or
attachment added.
6. Social Engineering
A social engineering attack is a manipulation technique that exploits human
psychology to trick individuals into revealing confidential information, granting
unauthorized access, or performing harmful actions. Unlike technical attacks that target
systems and software, social engineering targets human behavior, making it one of the most
effective forms of cyberattacks.

Attackers use deception, persuasion, and psychological manipulation to create a

false sense of trust, urgency, or fear in the victim. By doing so, they make the victim willingly
share sensitive information or perform tasks that compromise security. For example, an
attacker may pretend to be a company’s IT support asking an employee for their password
“to fix a problem.”

Social engineering attacks are particularly dangerous because they bypass technical
defense like firewalls and antivirus software by targeting the human factor. Even the most
secure systems can be compromised if an employee is tricked into revealing their password
or clicking on a malicious link. Attackers often exploit emotions such as fear (“your account
will be blocked”), curiosity (“see who viewed your profile”), or urgency (“act now to avoid
penalty”) to pressure victims into quick decisions without verifying authenticity.

Another important aspect of social engineering is that it is not limited to the digital
world—it can also occur in physical environments. For instance, an attacker might dress as a
delivery person or technician to gain physical access to a restricted office space. Once inside,
they can steal sensitive information, install malware, or connect rogue devices to the
network. This shows that social engineering is a blended threat combining psychological
manipulation with both digital and physical tactics, making it one of the most challenging
cyber threats to defend against.

7. Identity Theft

Identity theft is a cybercrime in which an attacker illegally obtains and uses another
person’s personal information, such as name, Social Security number, bank account details,
or credit card numbers, to commit fraud or other crimes. Unlike direct financial theft,
identity theft allows criminals to impersonate victims, making it harder to detect and often
causing long-term consequences. Attackers use various techniques to steal personal
information, such as phishing emails, fake websites, malware infections, data breaches, and
social engineering attacks. For example, a hacker might send a fraudulent email asking the
victim to update their banking information, or breach an organization’s database to steal
thousands of users’ records. Once obtained, this information is sold on the dark web or used
directly for financial gain.

Victims of identity theft may suffer from unauthorized financial transactions,

damaged credit history, or even false criminal charges if their identity is misused. Businesses
also face reputational damage, legal liabilities, and loss of customer trust. Recovering from
identity theft is time-consuming, as victims must prove their innocence, restore financial
records, and secure their accounts. To prevent identity theft, individuals should use strong
passwords, enable multi-factor authentication (MFA), avoid sharing sensitive information on
unsecured platforms, and regularly monitor financial statements. Organizations must
enforce strict data protection policies, encrypt sensitive information, and educate
employees about phishing and social engineering risks. Governments also play a role by
creating laws and regulations to protect citizens from such crimes.

8. Denial of Service (DoS)

A Denial of Service (DoS) attack is a type of cyberattack in which an attacker floods a
target system, server, or network with excessive requests, overwhelming its resources and
making it unavailable to legitimate users. The main goal of a DoS attack is not to steal
information but to disrupt services and cause downtime, which can lead to financial losses
and reputational damage.

How it Works:

 The attacker sends a large number of fake requests to a server.

 The server tries to respond but becomes overloaded.
 As a result, legitimate requests from real users cannot be processed.

Example:
If a website is flooded with millions of fake login requests, it may crash and prevent genuine
users from accessing their accounts.
Distributed Denial of Service (DDoS) Attack

A Distributed Denial of Service (DDoS) attack is a more advanced and powerful

version of a DoS attack. Instead of a single system launching the attack, multiple
compromised systems (often part of a botnet) are used to flood the target simultaneously.
This makes the attack harder to stop because it originates from thousands or even millions
of devices spread across the world.

How it Works:

 The attacker infects devices (computers, IoT devices, smartphones) with malware.
 These infected devices, known as bots or zombies, form a botnet.
 The attacker controls the botnet remotely and commands all infected devices to
send requests to the target.
 The target becomes overwhelmed and crashes or becomes unavailable.

Example:
The 2016 Mirai Botnet Attack used infected IoT devices to launch one of the largest DDoS
attacks in history, disrupting services like Twitter, Netflix, and Reddit.

Key Differences Between DoS and DDoS

Aspect DoS Attack DDoS Attack

Origin Single system Multiple systems (botnet)

Power Limited impact Very powerful and widespread

Detection Easier to trace and block Harder to trace due to multiple sources

Cost of Execution Relatively low Higher due to botnet creation

9. Man in the Middle

A Man-in-the-Middle (MitM) attack is a type of cyberattack where an attacker

secretly intercepts and possibly alters the communication between two parties without
their knowledge. The attacker positions themselves between the sender and receiver,
making it seem as though they are communicating directly with each other, while in reality,
the attacker controls or monitors the traffic.

The purpose of MitM attacks can vary — attackers may want to steal sensitive
information like login credentials, credit card numbers, or personal data, or they may
manipulate the communication for malicious purposes.
How MitM Attacks Work

1. Interception: The attacker first intercepts communication between two systems. This
can be done by exploiting unsecured Wi-Fi networks, DNS spoofing, or ARP spoofing.
2. Decryption/Modification: Once the data is captured, the attacker can read, steal, or
even alter the information being exchanged.
3. Relay: The attacker forwards the modified or original data to the receiver, so neither
party suspects the communication is compromised.

Examples of MitM Attacks

 Wi-Fi Eavesdropping: Attackers set up a fake Wi-Fi hotspot in a public place. When
users connect, all data they send (like passwords and credit card details) can be
intercepted.
 HTTPS Spoofing: Replacing secure HTTPS websites with fake HTTP sites to steal login
information.
 Email Hijacking: Attackers intercept business email exchanges (like financial
transactions) and alter bank details to redirect payments to their own accounts.

10. Session Hijacking

Session hijacking is a type of cyberattack in which an attacker takes control of a

user’s active session with a trusted system or application. Once the attacker gains access to
the session, they can impersonate the user and perform unauthorized actions, such as
accessing confidential information, initiating transactions, or changing account settings.
Since many applications use sessions to maintain user login states, compromising them can
be highly damaging.

How Session Hijacking Works

1. Session Token Theft: When a user logs into a website or application, the server
issues a unique session ID (token) to maintain the login state. Attackers steal this
token using techniques like packet sniffing, cross-site scripting (XSS), or malware.
 2. Session Replay: Attackers reuse the stolen session ID to impersonate the legitimate
user.
3. Full Account Control: Once inside, attackers can access sensitive data, perform
malicious transactions, or change passwords.

Techniques of Session Hijacking

 Session Fixation: Forcing a user to use a known session ID so the attacker can hijack
it later.
 Cross-Site Scripting (XSS): Injecting malicious scripts to steal session cookies.
 Man-in-the-Browser (MitB): Malware running inside the victim’s browser modifies
session communication.
 Network Sniffing: Intercepting unencrypted session data over insecure networks.

11. Case studies of recent cyberattacks

1. Jaguar Land Rover Ransomware Attack

In September 2025, Jaguar Land Rover (JLR) was crippled by a ransomware attack
orchestrated by a teenager-led group called Scattered Lapsus$ Hunters, a coalition of
notorious hacking collectives. The attack led to the global shutdown of JLR’s IT systems,
halting vehicle production and service operations. Dealerships were unable to order parts or
provide service quotes, leaving many vehicles undrivable. Recovery efforts forced
employees to stay home and operations remained suspended for days. The attack
underscores how even global enterprises with robust defenses can be paralysed by
ransomware.

2. Co-op Retail Data Breach

In mid-2025, UK retailer Co-op suffered a major cybersecurity breach that leaked personal
data of all 6.5 million members. While financial details weren’t exposed, the breach
included names, addresses, and contact information—course-corrected by the CEO’s public
apology. This incident not only disrupted services and supply chains but also deeply
impacted customer trust, highlighting the emotional and operational burden a data breach
brings.
1.2 Key Reasons for the Need of Cybersecurity

1. Protection of Sensitive Data

o Prevents misuse of personal data such as bank details, passwords, and
medical records.
2. Prevention of Financial Loss
o Cybercrimes like phishing, credit card frauds, and ransomware cause huge
monetary losses to individuals and organizations.
3. Ensuring Privacy
o Protects users’ private communications and social media data from being
stolen or misused.
4. Business Continuity
o Organizations need cybersecurity to prevent downtime caused by malware or
DDoS attacks, ensuring services are always available.
5. National Security
o Defense, power grids, transport, and communication systems are critical
infrastructures that require strong protection against cyberterrorism and
espionage.
6. Growth of Cybercrime
o Increasing cases of cyberbullying, hacking, identity theft, and online fraud
make cybersecurity more important than ever.
7. Legal and Ethical Compliance
o Governments and industries have introduced cybersecurity laws and
standards that organizations must follow to avoid penalties.
12. CIA Triad

The CIA Triad is an information security model consisting of three fundamental

principles: Confidentiality, Integrity, and Availability. This framework guides organizations in
protecting data by ensuring information is kept private (Confidentiality), accurate and
trustworthy (Integrity), and accessible to authorized users when needed (Availability). It's a
foundational concept in cybersecurity, used to develop and evaluate security policies and
controls to mitigate risks and enhance resilience.

Cybersecurity is built on three key principles, commonly known as the CIA triad:

1. Confidentiality
o Ensures that only authorized users can access information.
o Prevents sensitive data from being disclosed to unauthorized people.
o Example: Using passwords, encryption, and access control to keep personal
bank details private.
2. Integrity
o Ensures that information is accurate, consistent, and not altered without
authorization.
o Protects data from being changed, deleted, or corrupted by malicious actors.
o Example: Digital signatures, hashing, and checksums are used to maintain
data integrity.
3. Availability
o Ensures that information and resources are available when needed.
o Protects against disruptions such as hardware failures, cyberattacks, or
power outages.
o Example: Backups, firewalls, and disaster recovery plans help maintain
availability.

All three principles of the CIA triad—confidentiality, integrity, and availability—must

work together, as focusing too much on one may weaken the others. For instance, while
strong encryption ensures confidentiality, it may reduce availability if the system becomes
slow or difficult to access. Similarly, making data widely available may improve availability
but can reduce confidentiality by exposing information to unauthorized users. Therefore,
cybersecurity professionals aim to design systems with a balanced approach to the CIA triad,
ensuring that security, reliability, and accessibility are maintained simultaneously.

A balanced CIA triad also helps organizations build trust with users and stakeholders.
When confidentiality protects sensitive data, integrity ensures that the information is
accurate and reliable, and availability guarantees timely access, users feel confident in
relying on the system. Any imbalance—such as frequent downtime, data leaks, or
tampering—can damage this trust and lead to financial, legal, and reputational losses.
Hence, maintaining equilibrium among the three principles is not just a technical
requirement but also a business and ethical necessity in cybersecurity.

13. Basic terminologies

 Vulnerability
A vulnerability is a weakness or flaw in a computer system, software, or network that
can be taken advantage of by attackers. It acts like an open door for cybercriminals to
enter and cause harm. Vulnerabilities may arise due to poor design, lack of security
updates, weak passwords, or misconfigured systems. For example, using outdated
software without patches is a vulnerability that attackers can easily exploit.

 Threat
A threat is anything that has the potential to cause harm by exploiting a vulnerability.
Threats can be intentional, like hackers and malware, or unintentional, such as natural
disasters or human errors. For example, a cybercriminal trying to steal login details is a
threat to the system. In simple terms, a threat is a possible danger that puts digital
assets at risk.

 Risk
Risk refers to the possibility that a threat will exploit a vulnerability and cause damage to
the organization or individual. It combines the likelihood of an attack happening with the
potential impact of the damage. For instance, if sensitive data is stored without
encryption, there is a high risk of data theft if a hacker gains access. Managing risk is a
key part of cybersecurity, as it helps prioritize which vulnerabilities to fix first.
 Exploit
An exploit is the actual method or tool used to take advantage of a vulnerability in order
to carry out an attack. Exploits can be in the form of malicious software, scripts, or
techniques that attackers use to gain unauthorized access. For example, ransomware
can exploit an unpatched security flaw in an operating system to lock files and demand
money from the user. Simply put, while vulnerabilities are weaknesses, exploits are the
weapons used to attack them.

In cybersecurity, vulnerability, threat, risk, and exploit are interdependent concepts

that together define how secure or insecure a system is. Vulnerability is the weakness, a
threat is the potential cause of harm, an exploit is the actual method of taking advantage of
that weakness, and risk is the overall likelihood and impact of this exploitation. Without a
vulnerability, an exploit cannot occur; without a threat, there is no risk. Understanding this
chain helps in identifying where defences should be applied — whether in fixing
vulnerabilities, reducing threats, or minimizing risks.

Therefore, cybersecurity professionals focus on managing risks by addressing

vulnerabilities and controlling threats. Risk assessment techniques are used to prioritize
which vulnerabilities must be patched first and which threats pose the greatest danger. At
the same time, monitoring for exploits ensures that even if vulnerabilities exist, timely
action can prevent damage. By studying these terms collectively, students can appreciate
the holistic approach needed to secure digital systems effectively.

14. Cybercrime and its classification

Cybercrime refers to illegal activities carried out using computers, networks, or the
internet. It targets individuals, organizations, or governments with the intention of stealing
data, disrupting systems, or causing harm. Cybercrimes can range from small-scale fraud to
large-scale attacks threatening national security.

Traditional crimes usually occur in the physical world, such as theft, robbery, assault, or
fraud. They require the criminal to be physically present at the location of the crime and
often leave behind physical evidence. The impact is generally limited to a particular person,
group, or place.

On the other hand, cybercrimes take place in the digital world using computers, networks,
or the internet. The criminal can act remotely without being physically present, often
remaining anonymous. Cybercrimes can affect thousands of people across different
countries simultaneously, making them more widespread and harder to trace. Unlike
traditional crimes, evidence in cybercrime is digital in nature (logs, emails, malicious code),
requiring special forensic techniques to investigate.

14.1 Types of Cybercrimes

1) Cyberterrorism

Cyberterrorism refers to the use of the internet and digital tools to launch politically
or ideologically motivated attacks that cause fear, disruption, or damage. Targets often
include critical infrastructures such as power grids, water supplies, transportation systems,
and government databases. Unlike traditional terrorism, cyberterrorism can be executed
remotely, making it harder to detect and prevent. For example, attackers may hack into
defense networks to steal sensitive information or disrupt communication systems during
emergencies, which can paralyze a nation’s functioning.

The impact of cyberterrorism goes beyond technical disruption. It creates psychological fear
among citizens, undermines trust in public institutions, and may even destabilize national
security. Countries must invest in advanced cybersecurity strategies and international
cooperation to prevent and mitigate such threats. Governments also need to train
cybersecurity professionals who can detect early warning signals and respond quickly to
safeguard critical infrastructures.

2) Cyberbullying

Cyberbullying is the act of harassing, threatening, or humiliating someone through digital

platforms such as social media, online forums, or messaging apps. Unlike traditional
bullying, it can occur anytime, anywhere, and often leaves victims feeling helpless. Common
forms include spreading false rumors, sending abusive messages, creating fake profiles, or
sharing private images without consent. These actions can seriously affect a victim’s mental
health, leading to anxiety, depression, or social withdrawal.

Another concerning aspect of cyberbullying is its long-lasting digital footprint. Once harmful
content is shared online, it can spread rapidly and be difficult to remove completely. This
amplifies the victim’s distress and damage to reputation. Educational institutions, parents,
and law enforcement agencies need to work together to create awareness and establish
strong reporting mechanisms. Promoting responsible digital behavior and empathy among
young users is equally important to curb the rise of cyberbullying.
3) Financial Frauds

Financial frauds are cybercrimes where attackers deceive individuals or organizations to

steal money or sensitive financial information. Common examples include phishing emails
that trick users into sharing bank account details, fake investment schemes, and online
banking frauds. Attackers may also use malware to steal credit card numbers or intercept
transactions. With the growth of online shopping and digital payments, such crimes have
become increasingly frequent and sophisticated.

The consequences of financial frauds are severe, causing both monetary losses and a decline
in public trust in digital systems. Victims may lose their savings, while businesses can face
reputational damage and legal issues. To counter this, financial institutions implement
security measures like two-factor authentication, encryption, and fraud detection systems.
However, user awareness is equally critical—people must learn to recognize suspicious links,
avoid sharing personal details, and verify the authenticity of websites before making
transactions.

15. Difference between IT security and cybersecurity

IT Security (Information Technology Security) refers to the protection of information

systems—including hardware, software, and data—from unauthorized access, damage, or
misuse. Its scope is broader, covering both digital and physical aspects of safeguarding
information. For example, IT security includes measures like securing servers in data
centers, managing access controls, creating backup systems, and protecting against internal
threats. The main objective is to ensure the confidentiality, integrity, and availability of
organizational information, regardless of whether the threats come from inside or outside
the system.

Cybersecurity, on the other hand, is a subset of IT security that focuses specifically

on protecting systems, networks, and digital data from cyber threats and attacks originating
in cyberspace. Its emphasis is on defending against hacking, malware, phishing,
ransomware, and other online attacks that exploit vulnerabilities. For example,
cybersecurity involves using firewalls, intrusion detection systems, encryption, and ethical
hacking to prevent external breaches.

In simple terms, IT security is the umbrella, ensuring the protection of all forms of
information, while cybersecurity is a focused branch that deals only with internet-based and
digital threats. Both are interdependent: a strong IT security framework must include
cybersecurity measures to ensure complete protection in today’s digital world. As
organizations and individuals increasingly rely on digital technologies, the distinction
between IT security and cybersecurity becomes critical. While IT security ensures the overall
safeguarding of information assets, cybersecurity acts as a specialized defense against
modern cyberattacks. Together, they form a comprehensive security strategy, making it
essential for professionals to understand both concepts and apply them in an integrated
manner.
16. Current trends in cybersecurity

With the rapid growth of digital technologies, cybersecurity is evolving continuously

to counter new and sophisticated threats. Organizations and individuals are adopting
advanced methods to protect sensitive data, critical systems, and online transactions. Some
of the important current trends in cybersecurity are:

1. Ransomware Attacks
Ransomware continues to be one of the biggest cyber threats. Attackers encrypt the
victim’s data and demand money for its release. Organizations are now focusing on
backup strategies, endpoint protection, and incident response to deal with such
attacks.

2. Internet of Things (IoT) Security

The increasing use of IoT devices like smart home appliances, wearables, and
industrial sensors has created new vulnerabilities. Cybersecurity solutions are being
developed to secure these devices and the networks they connect to.

3. Cloud Security
As businesses move their data and applications to cloud platforms, ensuring cloud
security has become critical. Cloud providers and users implement encryption, multi-
factor authentication, and continuous monitoring to secure data stored online.

4. Zero Trust Security Model

The Zero Trust approach assumes that no user or system, whether inside or outside
the organization, should be automatically trusted. Every access request is verified
before granting permission. This reduces the risk of insider threats and unauthorized
access.

5. Artificial Intelligence (AI) and Machine Learning (ML) in Security

AI and ML are increasingly used to detect and respond to threats faster. They
analyze huge volumes of network traffic, identify unusual patterns, and prevent
attacks before they occur. For example, AI-powered security tools can detect
phishing attempts or malware more effectively than traditional methods.

6. Cybersecurity Regulations and Compliance

Governments and regulatory bodies are introducing stricter laws and standards (like
GDPR, HIPAA, and India’s DPDP Act) to ensure organizations follow best practices in
data protection. Compliance with these laws has become a major trend.

7. Rise of Cybersecurity Workforce and Ethical Hacking

The demand for cybersecurity professionals is growing rapidly. Ethical hackers are
employed by companies to test their systems and identify vulnerabilities before
malicious hackers exploit them.
17. Role of cybersecurity professionals

Cybersecurity professionals play a critical role in protecting digital systems,

networks, and data from cyberattacks. Their main responsibility is to identify
vulnerabilities, monitor systems for suspicious activities, and prevent unauthorized
access to sensitive information. They design and implement security policies, use tools
such as firewalls, intrusion detection systems, and encryption, and respond quickly to
incidents like malware infections or data breaches.

In addition, cybersecurity professionals work to ensure compliance with national and

international regulations by conducting regular audits and risk assessments. They also
create awareness programs for employees and users to reduce the chances of phishing,
social engineering, and other human-related risks. Importantly, their work is not just
defensive—they actively test systems through penetration testing and ethical hacking to
strengthen overall security. In today’s digital world, where threats are growing in scale
and sophistication, cybersecurity professionals are considered the first line of defense.
Their role is vital in safeguarding personal privacy, maintaining trust in digital services,
and protecting critical infrastructures such as banking, healthcare, and government
systems.

17.1 Roles of Cybersecurity Professionals

 Security Analyst – Monitors systems and networks for threats, investigates alerts, and
improves defences.
 Penetration Tester (Ethical Hacker) – Simulates attacks to identify system
vulnerabilities before real attackers exploit them.
 Incident Responder – Detects, analyzes, and responds to security incidents such as
breaches or malware attacks.
 Security Engineer – Designs and implements secure network architectures, firewalls,
and encryption mechanisms.
 Security Consultant – Advises organizations on best practices, policies, and
compliance with security standards.
 Forensic Analyst – Investigates cybercrimes, collects digital evidence, and supports
law enforcement.
 Chief Information Security Officer (CISO) – Leads the cybersecurity strategy, manages
teams, and aligns security with organizational goals.

17.2 Responsibilities of Cybersecurity Professionals

 Risk Assessment: Identify vulnerabilities, threats, and potential impacts on systems.

 Monitoring and Detection: Continuously monitor network traffic, logs, and alerts for
malicious activity.
 Threat Prevention: Implement security measures such as antivirus, IDS/IPS, firewalls,
and access controls.
 Incident Handling: Respond to attacks, contain damage, recover systems, and analyze
root causes.
 Compliance Management: Ensure adherence to legal, ethical, and industry standards
(e.g., GDPR, HIPAA, ISO 27001).
 Awareness and Training: Educate employees and users on safe digital practices to
minimize human error risks.
 Policy Development: Draft and enforce security policies, backup strategies, and disaster
recovery plans.
 Continuous Improvement: Stay updated with emerging cyber threats, new technologies,
and security trends.