Network-Based Attacks
Evil Twin Attack
High SeverityA rogue WiFi access point that impersonates a legitimate network to intercept user data.
Defense Strategies:
- Use VPN when connecting to public WiFi
- Verify network authenticity
- Enable two-factor network authentication
- Monitor for suspicious access points
Man-in-the-Middle (MITM)
High SeverityAttackers intercept communications between two parties to steal or manipulate data.
Defense Strategies:
- Use HTTPS for all web traffic
- Implement strong encryption
- Use secure protocols (SSH, SFTP)
- Regular security audits
DDoS Attacks
High SeverityOverwhelming network resources to make services unavailable to legitimate users.
Defense Strategies:
- Use DDoS mitigation services
- Implement rate limiting
- Configure network filtering
- Monitor traffic patterns
Web Application Attacks
SQL Injection
High SeverityExploiting SQL queries to manipulate database operations and access unauthorized data.
Defense Strategies:
- Use parameterized queries
- Input validation and sanitization
- Principle of least privilege
- Regular security testing
Cross-Site Scripting (XSS)
High SeverityInjecting malicious scripts into web pages viewed by other users.
Defense Strategies:
- Content Security Policy (CSP)
- Output encoding
- Input validation
- Security headers
Session Hijacking
Medium SeverityStealing or predicting session tokens to gain unauthorized access.
Defense Strategies:
- Secure session management
- HTTPS implementation
- Session timeouts
- Token validation
Social Engineering Attacks
Phishing
High SeverityDeceptive attempts to obtain sensitive information by posing as trustworthy entities.
Defense Strategies:
Social Engineering
Medium SeverityManipulating people into divulging confidential information.
Defense Strategies:
Vishing
Medium SeverityVoice phishing attacks using phone calls to steal information or access.
Defense Strategies: