1.3 Types of Cyber Threats and Vulnerabilities

# 1.3 Types of Cyber Threats and Vulnerabilities

## Understanding Threat Landscapes

In the previous sections of this series we explored why cyber security matters and examined Advanced Persistent Threats in detail. Now we turn to the broader threat landscape — the full spectrum of cyber threats and vulnerabilities that organisations face every day.

Understanding this landscape is not just an academic exercise. It is the foundation of every effective security strategy. You cannot defend what you do not understand.

---

## Common Cyber Threats

### Malware

Malware — short for malicious software — is an umbrella term for any software intentionally designed to cause damage, disrupt operations, or gain unauthorised access to systems.

The main categories include:

- **Viruses** — self-replicating code that attaches itself to legitimate programmes and spreads when those programmes are executed

- **Worms** — similar to viruses but capable of spreading across networks without any user interaction

- **Trojans** — disguised as legitimate software to trick users into installing them, then executing malicious payloads in the background

- **Rootkits** — designed to conceal the presence of malware, giving attackers persistent, hidden access to a compromised system

- **Spyware** — silently monitors user activity and harvests sensitive data such as passwords, financial details, and browsing history

- **Adware** — delivers unwanted advertising, often bundled with free software, and can degrade system performance significantly

Modern malware is frequently polymorphic — it mutates its code to evade signature-based detection — making it a persistent challenge for security teams.

---

### Phishing Attacks

Phishing remains one of the most prevalent and effective attack methods in use today. Attackers impersonate trusted entities — banks, colleagues, government agencies — to trick individuals into revealing credentials or clicking malicious links.

Key variants:

- **Spear phishing** — highly targeted attacks tailored to a specific individual or organisation, using personalised information to increase credibility

- **Whaling** — spear phishing aimed specifically at senior executives or high-value targets

- **Vishing (voice phishing)** — attackers use phone calls to impersonate legitimate organisations and extract sensitive information

- **Smishing (SMS phishing)** — phishing conducted via text message, often directing victims to fraudulent websites

- **Clone phishing** — a legitimate email is copied and resent with a malicious link or attachment substituted in

The success of phishing lies in exploiting human psychology — urgency, authority, and fear are the primary levers attackers use to bypass rational decision-making.

---

### Ransomware

Ransomware has evolved from a nuisance into one of the most damaging threats facing organisations globally. It encrypts the victim's data and demands payment — typically in cryptocurrency — in exchange for the decryption key.

Notable developments in ransomware:

- **Double extortion** — attackers exfiltrate data before encrypting it, then threaten to publish it publicly if the ransom is not paid

- **Ransomware-as-a-Service (RaaS)** — criminal groups offer ransomware toolkits to affiliates, dramatically lowering the barrier to entry for attackers

- **Targeted attacks** — rather than mass distribution, modern ransomware campaigns target specific high-value organisations — healthcare, critical infrastructure, financial services

- **Living-off-the-land (LotL)** — attackers use legitimate system tools such as PowerShell and WMI to deploy ransomware, making detection significantly harder

Recovery from a ransomware attack without paying the ransom requires comprehensive, tested backups and a well-rehearsed incident response plan.

---

### Advanced Persistent Threats (APTs)

As explored in section 1.2, APTs are sophisticated, long-term attacks typically associated with nation-state actors or highly organised criminal groups. Their defining characteristics are patience, stealth, and persistence.

APT attackers often remain undetected within a network for months or even years, silently gathering intelligence, exfiltrating data, or positioning themselves for a future disruptive action.

Key sectors targeted by APTs include defence, government, critical national infrastructure, financial services, and technology companies.

---

## Attack Vectors

An attack vector is the pathway an attacker uses to gain initial access to a target system or network. Understanding common attack vectors is essential for prioritising your defensive efforts.

### Web Application Vulnerabilities

Web applications are a primary target for attackers because they are internet-facing and, in many cases, poorly secured. Common web application vulnerabilities include:

- **SQL Injection (SQLi)** — malicious SQL statements are inserted into input fields to manipulate database queries, potentially exposing or destroying data

- **Cross-Site Scripting (XSS)** — attackers inject malicious scripts into web pages viewed by other users, enabling session hijacking, credential theft, and more

- **Cross-Site Request Forgery (CSRF)** — tricks authenticated users into unknowingly submitting malicious requests

- **Broken Authentication** — weak or improperly implemented authentication mechanisms allow attackers to compromise accounts

- **Insecure Direct Object References (IDOR)** — attackers manipulate references to access unauthorised data or functions

The OWASP Top 10 is the definitive reference for web application security risks and should be familiar to every security professional.

---

### Email as an Attack Vector

Email remains the single most common initial access vector in cyber attacks. Beyond phishing, attackers exploit email through:

- **Malicious attachments** — documents, spreadsheets, and PDFs containing embedded macros or exploits

- **Business Email Compromise (BEC)** — attackers impersonate executives or suppliers to authorise fraudulent financial transfers

- **Email spoofing** — forging the sender address to make messages appear to come from a trusted source

- **Credential harvesting links** — URLs pointing to convincing fake login pages designed to capture usernames and passwords

Defending email requires a layered approach: SPF, DKIM, and DMARC records at the DNS level, combined with advanced threat protection at the email gateway.

---

### Unsecured Networks and Remote Access

The expansion of remote working has significantly increased the attack surface for most organisations. Key network-level vulnerabilities include:

- **Unencrypted Wi-Fi** — data transmitted over unsecured wireless networks can be intercepted through man-in-the-middle attacks

- **VPN vulnerabilities** — unpatched VPN appliances are a frequent target; several major ransomware campaigns have begun by exploiting VPN vulnerabilities

- **Exposed Remote Desktop Protocol (RDP)** — RDP ports left open to the internet are routinely scanned and brute-forced by attackers

- **IoT devices** — internet-connected devices with default credentials or no security updates provide easy footholds into networks

- **Third-party access** — vendors and contractors with network access who have poor security hygiene represent a significant supply chain risk

---

### Social Engineering

Social engineering exploits human psychology rather than technical vulnerabilities. Beyond phishing, attackers use:

- **Pretexting** — fabricating a scenario (a false identity or situation) to manipulate targets into divulging information or performing actions

- **Baiting** — leaving infected USB drives in car parks or other locations, relying on human curiosity to do the rest

- **Tailgating / Piggybacking** — gaining physical access to secure areas by following authorised personnel through access-controlled doors

- **Quid pro quo** — offering a service (such as IT support) in exchange for credentials or access

The human element is consistently identified as the weakest link in cyber security, which is why security awareness training is a non-negotiable investment for any organisation.

---

## Vulnerabilities: Understanding What Attackers Exploit

A vulnerability is a weakness in a system, application, network, or process that can be exploited to cause harm. Vulnerabilities fall into several broad categories:

### Software Vulnerabilities

- **Unpatched software** — the most common vulnerability. Many high-profile breaches exploit vulnerabilities for which patches have been available for months or years

- **Zero-day vulnerabilities** — previously unknown flaws for which no patch yet exists; these command significant value on both legitimate and criminal markets

- **Misconfigurations** — cloud storage buckets left publicly accessible, default credentials left unchanged, unnecessary services left enabled

### Human Vulnerabilities

- Lack of security awareness

- Weak or reused passwords

- Failure to follow security policies

- Susceptibility to social engineering

### Process Vulnerabilities

- Inadequate change management

- Insufficient access controls and least-privilege implementation

- Lack of security testing in software development lifecycles

- Poor incident response planning

---

## Defence Strategies

### Vulnerability Assessments

A vulnerability assessment is a systematic review of security weaknesses in an information system. It evaluates whether the system is susceptible to known vulnerabilities, assigns severity levels, and recommends remediation.

Vulnerability assessments should be conducted:

- Regularly (at minimum quarterly for most organisations)

- After significant changes to the IT environment

- As part of onboarding new systems or applications

Automated scanning tools such as Nessus, Qualys, and OpenVAS are widely used, but they must be complemented by expert analysis to prioritise findings meaningfully.

---

### Penetration Testing

Penetration testing (pen testing) goes beyond vulnerability assessment — it involves actively attempting to exploit identified vulnerabilities to determine their real-world impact.

Types of penetration testing:

- **Black box** — the tester has no prior knowledge of the target environment, simulating an external attacker

- **White box** — the tester has full knowledge of the environment, allowing for a more thorough and efficient assessment

- **Grey box** — a hybrid approach, reflecting the position of an attacker who has gained limited internal access (for example, a malicious insider or a compromised account)

Penetration testing should be conducted by certified professionals (CREST, CHECK, or OSCP-qualified testers) and the results used to drive remediation activity rather than simply tick a compliance box.

---

### Multi-Factor Authentication (MFA)

MFA is one of the highest-return security investments an organisation can make. By requiring users to verify their identity through two or more factors, MFA dramatically reduces the risk of account compromise even when credentials have been stolen.

The three factor types are:

1. **Something you know** — a password or PIN

2. **Something you have** — a hardware token, authenticator app, or SMS code

3. **Something you are** — biometrics such as fingerprint or facial recognition

Microsoft research indicates that MFA blocks over 99.9% of automated account compromise attacks. Despite this, MFA adoption remains incomplete across many organisations.

---

### Additional Defence Priorities

- **Patch management** — maintain a disciplined patching programme, prioritising critical and high-severity vulnerabilities

- **Network segmentation** — limit the blast radius of a breach by dividing networks into segments with controlled access between them

- **Security awareness training** — regular, engaging training that keeps staff alert to current threats and social engineering techniques

- **Endpoint Detection and Response (EDR)** — go beyond traditional antivirus with tools that monitor endpoint behaviour and enable rapid incident response

- **Principle of least privilege** — ensure users and systems have only the access they need to perform their function, nothing more

- **Zero Trust Architecture** — adopt the position that no user or device should be trusted by default, whether inside or outside the network perimeter

---

## Summary

The threat landscape is broad, constantly evolving, and unforgiving of complacency. From opportunistic malware campaigns to highly targeted APT operations, organisations of all sizes face a diverse and growing array of threats.

Effective defence requires more than technology. It demands a clear understanding of the threats you face, the vulnerabilities in your environment, and a layered strategy that combines technical controls, robust processes, and a security-conscious workforce.

In the next section of the Cyber Security Advanced series, we will explore the frameworks and standards — such as NIST, ISO 27001, and Cyber Essentials — that provide the structure for building and maturing an information security programme.

---

*Mark Hayward is a UK cyber security expert, published author of over 130 books, and former UK Armed Forces professional. The Cyber Security Advanced series is designed for practitioners, IT professionals, and anyone pursuing a career in information security.*