Types of cyber threats and countermeasures
1. How Threats Are Classified
Threats are grouped by how they arrive (attack vector), what they damage, and who launches them. The main families are: malware, network attacks, web/application attacks, human/social-engineering attacks, credential attacks, insider and supply-chain threats, and physical attacks. A single real-world incident usually mixes several — a phishing mail (human) delivers a trojan (malware) that opens a backdoor (network) and exfiltrates data.
2. Malware
| Type | Behaviour | Example | Countermeasure |
|---|---|---|---|
| Virus | Attaches to a host file/program and spreads when it runs; needs user action | Boot-sector, macro and file viruses | Antivirus, disable macros, patching, least privilege |
| Worm | Self-replicating, spreads across networks with no user action | Morris worm; WannaCry via the EternalBlue exploit | Patching (SMB), network segmentation, firewalls |
| Trojan / RAT | Disguised as useful software; provides remote control | Fake "free" downloaders, banking trojans | Whitelisting, download only from trusted sources, EDR |
| Ransomware | Encrypts files and demands payment; modern variants also steal data (double extortion) | WannaCry, Petya, LockBit, REvil | Tested offline backups, patching, EDR, segmentation, user training |
| Spyware / keylogger | Secretly collects keystrokes, screenshots, credentials | Pegasus-style spyware, hardware keyloggers | Anti-malware, MFA, encrypted channels, physical checks |
| Adware | Forced advertisements, browser hijacking | Pop-up injectors | Clean browser extensions, ad-blockers, uninstall |
| Rootkit | Hides itself and other malware deep in the OS/firmware | Kernel rootkits | Secure boot, integrity checks, firmware updates, reinstall |
| Botnet / zombie | Infected devices obey a remote C&C to send spam or DDoS | Mirai (IoT cameras), Emotet | IoT hardening, default-password change, egress filtering |
| Logic bomb / fileless malware | Triggers on a condition; lives in memory and uses legitimate tools | Disgruntled-employee time bombs | Behavioural monitoring, change control, PowerShell logging |
Common malware countermeasures: patch management, antivirus/EDR, application whitelisting, sandboxing of attachments, e-mail/web filtering, least-privilege accounts, network segmentation, and — above all — backups that are tested and kept offline.
3. Network Attacks
| Attack | What it does | Countermeasure |
|---|---|---|
| DoS / DDoS | Floods a service until it is unusable, often via a botnet | Rate limiting, scrubbing services, CDN, autoscaling, ISP filtering |
| MITM | Sits between two parties and reads/alters traffic | TLS with certificate validation, HSTS, VPN, certificate pinning |
| ARP spoofing / poisoning | Fakes ARP replies so traffic is redirected through the attacker | Dynamic ARP inspection, DHCP snooping, static ARP for critical hosts |
| DNS spoofing / cache poisoning | Returns a fake IP for a domain name | DNSSEC, DNS-over-HTTPS/TLS, trusted resolvers |
| Packet sniffing | Captures unencrypted traffic on the network | Encryption (HTTPS/SSH), switched networks, 802.1X |
| IP/session hijacking, replay | Impersonates a host or replays a captured session | Nonces/timestamps, encryption, session expiry, MFA |
| Port scanning / fingerprinting | Discovers open services to exploit | Close unused ports, firewall, IDS alerting, hardening |
| Rogue DHCP/AP, evil twin | Offers a fake network service or Wi-Fi hotspot | DHCP snooping, 802.1X, WIPS, user training |
| Brute force / credential stuffing | Guesses passwords or reuses leaked pairs | MFA, lockout/throttling, breached-password checks, unique passwords |
4. Web and Application Attacks (OWASP-style)
SQL injection — malicious SQL typed into a form is executed by the database (' OR '1'='1); prevented by prepared statements/parameterised queries, input validation, least-privilege DB accounts. Cross-Site Scripting (XSS) — attacker's JavaScript runs in another user's browser; prevented by output encoding, Content Security Policy, framework escaping. CSRF — a logged-in user's browser is tricked into sending an unwanted request; prevented by anti-CSRF tokens, SameSite cookies. Broken access control / IDOR — changing an ID exposes another user's data; prevented by server-side authorisation for every request. Also: file inclusion, command injection, insecure deserialisation, directory traversal, security misconfiguration, vulnerable dependencies, insufficient logging. General defences: secure coding and code review, a WAF, dependency scanning, penetration testing, error handling that leaks nothing, and monitoring.
5. Human / Social-Engineering Attacks
Phishing (mass e-mail), spear phishing (targeted), whaling (targets executives), vishing (phone), smishing (SMS), clone phishing (copy of a real mail), QR phishing (quishing), pretexting (a believable story), baiting (infected USB drives), tailgating (following someone through a door), shoulder surfing, fake IT-support calls, business e-mail compromise/invoice fraud, and now deepfake voice/video (cloned executive voice instructing a transfer). Countermeasures: continuous awareness training and simulated phishing, "verify through a second channel" policy for payments and credentials, MFA (which defeats most credential phishing), e-mail authentication (SPF, DKIM, DMARC), mailbox-rule monitoring, an easy incident-reporting button, and a culture where reporting a mistake is safe.
6. Credential and Identity Attacks
Brute force, dictionary attacks, credential stuffing (reusing passwords leaked from another site), password spraying (one weak password against many accounts), rainbow-table cracking of unsalted hashes, keylogging and session-token theft. Countermeasures: long unique passphrases with a password manager, MFA everywhere (especially e-mail and admin accounts), throttling and lockouts, salted slow hashes (bcrypt/Argon2), breach monitoring, and least privilege so a stolen account cannot do much.
7. Insider, Supply-Chain and Emerging Threats
Insider threat — a trusted employee, contractor or vendor misuses access (data theft, sabotage, negligence); countered by least privilege, separation of duties, monitoring/UEBA, exit procedures. Supply-chain attacks — a trusted supplier, update mechanism or open-source dependency is compromised (SolarWinds, NotPetya via accounting software, malicious npm/PyPI packages); countered by vendor assessment, SBOM and dependency scanning, code signing, network monitoring. Emerging: ransomware-as-a-service with affiliate gangs, zero-day exploits in APT campaigns, IoT botnets, cryptojacking, AI-generated phishing and deepfakes, attacks on APIs and cloud misconfigurations, and RDP/VPN edge-device exploitation.
8. Countermeasure Layers — Preventive, Detective, Corrective
| Category | Preventive | Detective | Corrective |
|---|---|---|---|
| Technical | Firewall, MFA, encryption, patches, WAF, segmentation | IDS/IPS, SIEM, EDR, log monitoring, file-integrity monitoring | Backup restore, isolation/reimaging, failover, key rotation |
| Administrative | Policies, training, least privilege, change and vendor management, IR plan | Audits, vulnerability scans, penetration tests, phishing simulations | Incident response, forensics, lessons learned, patching |
| Physical | Locks, guards, CCTV, badge access, locked racks | Motion alarms, access logs, environmental sensors | Evacuation procedures, spares, recovery site |
Incident response steps: Prepare → Identify → Contain → Eradicate → Recover → Lessons learned. Backups, MFA and patching are the three measures that neutralise the largest share of real-world attacks.
9. Exam Points
- Classify cyber threats (malware, network, web, social engineering, insider, supply chain) and give two countermeasures for each family — 5-7 marks, very frequent.
- Differentiate virus, worm, trojan and ransomware — 5 marks, almost certain.
- Explain phishing and its variants with countermeasures — 5 marks, frequent.
- Explain SQL injection and XSS with prevention — 5 marks.
- Explain DoS/DDoS, MITM, ARP/DNS spoofing and their mitigation — 5 marks.
- What is a supply-chain attack? Give a real example — 3-5 marks.
- Explain the three categories of countermeasures (preventive/detective/corrective) with examples — 5 marks.
- List the incident-response steps — 3 marks.