Understanding Cyber Threats: How Attackers Target People, Systems, and Organizations

 Understanding Cyber Threats: How Attackers Target People, Systems, and Organizations

By Heather Lange-Wilson

Cybersecurity incidents do not always begin with sophisticated hackers breaking through complex security systems. Many attacks begin with something surprisingly ordinary: an employee receives a phishing email, someone uses a compromised password, a computer misses an important security update, or a user approves an unexpected multifactor authentication request.

These situations demonstrate an important cybersecurity principle: attackers look for opportunities.

Understanding those opportunities is a major part of CompTIA Security+ Domain 2: Threats, Vulnerabilities, and Mitigations. This domain focuses on identifying threats, recognizing vulnerabilities, understanding common attacks, and implementing protections that reduce risk.

Employees do not need to become cybersecurity experts to contribute. Understanding a few fundamental concepts can significantly improve an organization's overall security.

Threats, Vulnerabilities, and Risk

Three terms are important to understand: threat, vulnerability, and risk.

A threat is something capable of causing harm. Cybercriminals, malicious insiders, malware, ransomware, and even accidental human actions can represent threats.

A vulnerability is a weakness that could be exploited. Examples include unpatched software, weak passwords, incorrect permissions, default credentials, and poorly configured systems.

Risk exists when a threat could take advantage of a vulnerability and negatively affect the organization.

Consider an employee account protected by a weak password. The weak password is a vulnerability. A cybercriminal attempting to compromise the account represents the threat. Unauthorized access to organizational systems or information represents the potential risk.

Security controls attempt to reduce that risk.

Why Attackers Target People

Organizations use sophisticated security technologies, including firewalls, endpoint protection, encryption, email filtering, and security monitoring.

Attackers know this.

Rather than attacking technology directly, they may attempt to manipulate the person using it.

This is known as social engineering.

Social engineering relies on human emotions and behavior. Attackers frequently create:

• Urgency
• Fear
• Curiosity
• Authority
• Trust

An employee might receive an email claiming:

“Your account will be disabled today unless you verify your password immediately.”

The attacker wants the employee to react before thinking.

A useful security habit is simple:

Stop. Look. Verify.

If a request is unexpected, especially one involving passwords, money, sensitive information, or system access, verify it through an established method before taking action.

Phishing and Targeted Attacks

Phishing uses deceptive communications to convince victims to perform an action.

Attackers may want employees to:

• Click malicious links
• Open attachments
• Enter credentials
• Provide sensitive information
• Send money
• Approve authentication requests

Not all phishing attacks are generic.

Spear phishing targets specific individuals or organizations. Attackers may research employees, job titles, vendors, and organizational relationships to make their messages more convincing.

Whaling is targeted phishing directed at executives or other high-value individuals.

Phishing can also occur outside email.

Smishing uses text messages.

Vishing uses telephone or voice communication.

Regardless of the communication method, the basic defense remains similar: unexpected requests should be independently verified.

Multifactor Authentication Attacks

Multifactor authentication, or MFA, provides important protection when passwords are compromised.

However, attackers sometimes attempt to manipulate MFA users.

Suppose an attacker already has an employee's password. The attacker repeatedly attempts to log in, generating authentication notifications on the employee's phone.

Eventually, the employee may approve one simply because the notifications are annoying.

This technique is often called MFA fatigue or MFA push bombing.

If you receive an authentication request you did not initiate:

Do not approve it.

Deny the request and report it through your organization's established security process.

An unexpected MFA request may indicate that someone already possesses your password.

Password Attacks

Passwords remain attractive targets.

Attackers may use several methods to compromise them.

A brute-force attack attempts many password combinations until the correct one is discovered.

A password-spraying attack takes a different approach. Instead of trying thousands of passwords against one account, the attacker tries a commonly used password against many accounts.

Credential stuffing occurs when attackers take usernames and passwords exposed in one breach and attempt to use them on other services.

This is one reason password reuse is dangerous.

If the same password is used for several services, one compromised account could potentially expose several others.

Unique passwords and multifactor authentication significantly reduce this risk.

Malware and Ransomware

Malware is malicious software designed to perform harmful or unauthorized activities.

Common types include viruses, worms, Trojans, spyware, and ransomware.

A Trojan disguises itself as legitimate software.

A worm can spread between systems with limited user interaction.

Spyware attempts to monitor activity or collect information.

Ransomware commonly encrypts files or systems and demands payment for their recovery. Some ransomware groups also steal information before encryption and threaten to release it publicly.

Organizations defend against malware using multiple controls, including:

• Endpoint protection
• Email filtering
• Security updates
• Restricted administrative privileges
• Network segmentation
• Security monitoring
• Backups
• Employee security awareness

Employees contribute by avoiding unknown downloads, using approved software, and reporting suspicious activity.

Unpatched Systems and Misconfigurations

Not every vulnerability involves a sophisticated attack.

Sometimes systems simply have not been updated.

Software vendors regularly release security patches that correct known vulnerabilities. When systems remain unpatched, attackers may exploit weaknesses for which fixes already exist.

Employees can help by allowing approved updates to install and restarting computers when required.

Misconfiguration is another common source of vulnerability.

A system may have:

• Excessive permissions
• Default passwords
• Unnecessary services
• Open network ports
• Incorrect security settings

Organizations use security baselines and configuration-management processes to reduce these risks.

Insider Threats

Not every cybersecurity threat originates outside the organization.

An insider threat involves someone who has legitimate access to organizational systems or information.

Insider threats may be intentional or accidental.

A malicious insider may deliberately steal information.

A careless employee may accidentally send sensitive information to the wrong person.

A legitimate employee account may also be compromised by an external attacker.

This is why organizations use controls such as least privilege, logging, access reviews, and security monitoring even for internal accounts.

Physical Security Matters

Cybersecurity also includes physical security.

An attacker who gains physical access to a restricted area may be able to access unattended computers, steal equipment, photograph confidential information, or connect unauthorized devices.

One common physical social-engineering technique is tailgating.

Tailgating occurs when an unauthorized person follows an authorized employee through a secured entrance.

Employees should follow visitor and badge procedures rather than allowing unknown individuals to bypass access controls.

The same caution applies to unknown USB drives and removable media. Never connect an unknown device to an organizational computer simply to see what it contains.

Mitigation and Defense in Depth

Identifying threats is only part of cybersecurity.

Organizations must also reduce the likelihood or impact of successful attacks.

This is known as mitigation.

One of the most important cybersecurity strategies is defense in depth.

Defense in depth means using multiple security controls rather than depending on one.

Consider a phishing attack.

An email security system may block the message.

If it does not, employee awareness may prevent the user from clicking the link.

If credentials are stolen, MFA may prevent account access.

If an account is compromised, least privilege may restrict what the attacker can reach.

If malicious activity occurs, monitoring systems may detect it.

Each layer provides another opportunity to stop the attack.

Least Privilege

The principle of least privilege means users should receive only the access necessary to perform their responsibilities.

An employee who does not require administrator privileges should not have them.

A vendor that only requires access to one application should not automatically receive access to the entire network.

Least privilege reduces the potential impact of compromised accounts, malware, mistakes, and insider threats.

Employees Are Part of the Defense

Cybersecurity technology is important, but employees remain an essential security layer.

Every employee can reduce risk by following a few basic practices:

• Think before clicking links or attachments.
• Verify unusual requests.
• Protect passwords and authentication information.
• Never approve unexpected MFA requests.
• Use approved software and services.
• Keep organizational information in approved locations.
• Lock unattended computers.
• Follow physical access requirements.
• Allow approved security updates to install.
• Report suspicious activity quickly.

Employees are not expected to investigate cybersecurity incidents themselves.

When something seems unusual, report it and allow the appropriate IT or security team to investigate.

Why Reporting Matters

Imagine receiving a phishing email and recognizing it immediately.

You delete it without clicking anything.

You protected yourself, but the attack may not be over.

Hundreds of other employees may have received the same message.

Reporting the phishing attempt gives security personnel an opportunity to identify similar messages, block malicious links, warn employees, and determine whether anyone else interacted with the attack.

Reporting suspicious activity can therefore protect more than one person.

It can protect the entire organization.

Final Takeaway

Attackers look for opportunities. Sometimes those opportunities are technical vulnerabilities. Other times they involve passwords, physical access, misplaced trust, or simple human mistakes.

Strong cybersecurity therefore requires more than security software.

It requires people, processes, and technology working together.

Employees do not need to recognize every cybersecurity technique. They need to recognize when something appears unusual, stop before acting, verify unexpected requests, follow established security procedures, and report concerns quickly.

Every suspicious email reported, every unexpected MFA request denied, every computer kept updated, and every unusual situation questioned removes another opportunity an attacker might otherwise exploit.

Cybersecurity is everyone's responsibility - and awareness is one of our strongest defenses.

 -  Heather Lange-Wilson