Critical Infrastructure Resilience and Sustainability Reader

9Cyber Threats

CHAPTER MENU

• 9.1 Threat Surface
  • 9.1.1 Script‐kiddies
  • 9.1.2 Black Hats
  • 9.1.3 Weaponized Exploits
  • 9.1.4 Ransomware and the NSA
• 9.2 Basic Vulnerabilities
  • 9.2.1 The First Exploit
  • 9.2.2 TCP/IP Flaws
  • 9.2.3 Open Ports
  • 9.2.4 Buffer Overflow Exploits
  • 9.2.5 DDoS Attacks
  • 9.2.6 Email Exploits
  • 9.2.7 Flawed Application and System Software
  • 9.2.8 Trojans, Worms, Viruses, and Keyloggers
  • 9.2.9 Hacking the DNS
  • 9.2.10 Hardware Flaws
  • 9.2.11 Botnets
• 9.3 Cyber Risk Analysis
  • 9.3.1 Kill Chain Approach
  • 9.3.2 Machine‐learning Approach
• 9.4 Analysis
• 9.5 Discussion
• References

A cyber threat is a computer or computer network hazard. It is a potential attack that preys on weaknesses or flaws in hardware and software systems. An exploit is defined as an unauthorized action performed on an information system such as a corporate network, desktop PC, enterprise server, website, factory control systems, SCADA network, or home computer. A zero‐day exploit is a previously unknown or unrecognized exploit. A remote exploit is an unauthorized access to an information system from a distance – from across a network. A person or group that carries out exploits is called an actor, black hat, or just plain criminal.

There are a number of highly varied types of threats ranging from malicious software designed to penetrate entire systems to phishing email exploits, designed to betray users into giving out personal information, and numerous other types of threats designed to cause a nuisance ...