CYBER SECURITY THREATS AND ATTACKS

BY KHUSHAL KAUSHIK 

As Caliphates Compete, Radical Islam Will Eventually Weaken

The rise of the Islamic State will inspire other jihadist groups to claim their own caliphates and emirates. In the long run, the extremism of these contrived dominions and the competition among them will undermine the jihadist movement. However, before that happens, the world will witness much upheaval. 

In a 52-minute video that surfaced in late August, Abubakar Shekau, the head of Nigerian jihadist group Boko Haram, spoke of an Islamic State in northeastern Nigeria. The statement came two months after Abu Bakr al-Baghdadi, the chief of the transnational jihadist movement in Syria and Iraq, declared the re-establishment of the caliphate, renaming the group the Islamic State. Though likely inspired by the Islamic State, Boko Haram is not simply mimicking its more powerful Syrian-Iraqi counterpart; it is taking its cue from the Nigeria-based Sokoto Caliphate, which was established in the early 1800s and existed for almost a century until Britain gained control of the region. 

According to classical Muslim political theorists, there can be only one caliphate for the entire Muslim global community, or ummah. In practice, though, there have been rival claimants to authority and even competing caliphates throughout the history of Islam. In our July 1 analysis on the subject, Stratfor explained not only how multiple emirates and sultanates emerged independently of the caliphate but also that there were rival caliphates -- for example, the Abbasid in Baghdad (749-1258), Umayyad in the Iberian Peninsula (929-1031) and Fatimid in Cairo (909-1171). 

These medieval-era caliphates were not just the byproduct of geographical constraints facing the original caliphate but also heavily shaped by political and religious rivalries and political evolution. These dynastic empires were the building blocks of the Muslim world, not unlike the wider international system of the time. For this reason, they endured for centuries until Europe's geopolitical push into the Muslim world in the 18th century. 

In the past two centuries, the medieval caliphates, emirates and sultanates have been replaced by nation-states. Though artificially created and weak, these modern Muslim polities are unlikely to be swept away by radical Islamists seeking to re-establish caliphates and emirates. Although nationalism was initially a European import into the Arab/Muslim world and continues to face competition from religious and tribal identities, it is well established in the public psyche. 

This can be seen in the organization of most Islamists along national lines. 

In this article, you will learn about the different threats to the IT Infrastructures, further you will learn about the various approaches that can be carried out against Network, and Software components. And finally, you will read about the major protections against the threats. 

Normal Threats 

To secure your IT infrastructure, you can manage remaining secure against various known threats. However, you cannot protect your infrastructures against threats that you do not recognize yet. Therefore, you should adopt a proactive approach in order to identify the types of threats that may cause harm to the IT resources in your organization. You have to properly develop and maintain a plan, you need to understand the different types of incoming threat and how can a threat affect your organization IT setup.

The normal major threats against IT infrastructures are classified in three categories as: 

o Unauthorized Access 

o Data Theft

o Hacking

Unauthorized Access 

Financial data is being stored in the organization servers. No one in the organization is mindful of this act of unauthorized access. Now, if during the Annual General Meeting of the organization, the finance manager shows the finance data that data does not reflect on the situation as per the organizations past performance. Because of these discrepancies, in fact, the shareholders will have trouble believing the truth causing irreparable loss to the goodwill to the organization. 

In the previous figure, the attacker, who is an outsider and is linked to a different network than the organization's network, accesses an organization‘s network. Once then is breached, an attacker can access the information stored by the users on the network resource, in fact, an employee of the organization can also use his or her privilege to access the data.

Countermeasures To Unauthorized Access 

o Checking your financial statements regularly

o keeping an eye out for any unfamiliar activity 

o Assign a strong or difficult to guess passwords for your system

o Always employ a firewall, antimalware and antivirus software

o Allow regular updates and patch your OSs

Data Theft 

Data theft is a type of attack which unauthorized access is used to obtain secret information. The attacker can easily steal user credential to authenticate himself to the organization’s server and to read & copy confidential data stored in files. The credentials can be stolen by the internal users, and by using various applications, such as a malware installed on the system. Such application maintains a log of all the keystrokes on the system, and then an attacker can get all the user system credential information without the knowledge of the legitimate user. Example for this, – a malware is an application that is developed to damage a computer of certain user. Such application is usually programmed to collect and send data from the computer where it is installed to the creator of the program without the knowledge of the user of the computer.

In the previous figure, the attacker authenticates himself on the network by using the stolen credentials. Once authenticated, attacker sends a malicious content to the user and spiteful content that will affect the user system and provide an attacker with full access to the user system after that attacker can access the confidential data on the user system.

Countermeasures To Data Theft 

o Install security updates to web browser, operating system and antivirus software as soon as they become available. 

They contain “patches” that address security vulnerabilities within the software and are considered as your first line defense against online threats.

o Install and use antivirus and antispyware software on all of your business computers. 

o Don’t open email attachments or other downloads unless you’re sure they’re from a trusted source. 

o And finally, password protects your business computers – including laptops and smart phones – and access to your network and accounts. hence, force your employees to have a unique user name and a strong password that is changed at least quarterly.

Hacking 

Hackers are computer experts and have the skills to gain unapproved access to a computer system. Hacking was a natural term for a user who is excellent at computer programming and computer's networking, system administration. A Hacking into a system is a sign of a capable technical skill set and creativity that gradually becomes associated with illegal or malicious system intrusions. Hackers are highly skilled; they use complicated techniques that are not easily detected. A hacker can be an employee of your organization or an outsider who is engaged in an unauthorized activity during or after working hours. However, attacking your system does not always require implementation of sophisticated technologies. The attacks can be performed by using deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines. Such attacker is known as social engineering attacks.

Social Engineering

Cyber security policy and vulnerability check can provide only limited shelter for Data. The most critical part of the security of the any system is its users. Most users trust each other. However, this makes them the most vulnerable part of the security. A Hacker can use this tendency of a user to extract valuable information. They use social engineering as a hacking technique that exploits user’s trust and uses physical method and psychological tricks, to gather information. The success of social engineering depends on the ability of hackers to manipulate human psychology, contact, and mortal workstation.

Commutations medias that are used in a social engineering attack are as follows: 

o Telephone

o Snail-mail

o E-mail

o Internet

Telephone

The Telephone is the cheapest way to contact with the Multitude. It is also an easy to imitate and impersonate over the telephone. In a telephone based social engineering, the most important factor is the voice of the social engineer. The Quality voices depend on the quality of telephone device and the location. Where is the call made? Telephone techniques are mostly using the help desk of the target system. Help desk is most vulnerable for telephone based social engineering because the prime aim of the helpdesk provides information to people. Loosely, the help desk employee gives the answer without seeking too much identification details from the company. It is very difficult to identify the caller over the telephone.

Snail-Mails

Snail mail or regular postal is also a power full weapon of social engineering, they utilizes this proficiency to gather personal data about the user, Such as a social security number, social engineering generally uses the professionally designed forms, which they create collecting information. The professional aspect of the frame creates a notion as it is from a legitimate governing body. In a typical snail mail based technique. Social engineers send the form along with a letter to the user. Usually, the mails, also declare that the receiver of the letter is eligible for a prize, and some verification is required to deliver it. The letter prompts the receiver to fill out personal details in the attached form. The details include cuticle information, such as the social security number.

Spam E-mails

Social engineers use email for two roles. One is to send an email message by using legislate email accounts. For example, a social engineer can use a spam email and spamming techniques to send messages to the users of an organization from the system administrator’s email address. In such messages, The social engineer asks the recipient to send their password for correcting some problems in their accounts and some users may charge back the required information, without thinking much about the consequences. Social engineers can also employ the email messages to send invitation for joining an online competition for receiving Prizes, in such a case a social engineer attaches a form that must be filled out by the user for joining the contest. These forms ask for desired user's name and passwords. Users, who may fail with this trick, may provide their names and password for multiple on-line accounts having acquired the information. Social engineers try the user name and password to use possible connected accounts of user to extract valuable information.

Internet

Engineer creates a website that allows users to participate in an online quiz competition. These websites ask the users to create an account. A User must provide personal information, such as the password, phone number, and other things. After a user creates an account, the attacker uses this information to steal valuable information from other online accounts of the user. There are several other techniques that are used to gather information. Example for this - you may receive an email message supposedly from a bank starting that due to some technical problems at their side, they have misplaced all the data of the users and are in the process of collecting information a fresh such as the message carries a hyperlink that brings the user to the home page of the bank in reality, such messages are definitely spam messages. The credentials are forwarded to the spammer’s email address. 

Finally, to show that the website is actually authentic, a web page may be displayed starting some error, such as the service is presently an unavailable or connectivity problem you may, therefore, end up losing your credential in the process, all the saving in your account. A fake website can never have an identical address as that of the actual or intended website. You should also look out for digital certification on such a website that involves sending confidential data.

Countermeasures To Social Engineering

o Never give out any confidential information or even seemingly non-confidential information about you or your company whether it's over the phone, online, or in-person

Unless you can first verify the identity of the person asking and the need for that person to have that information. You get a call from your credit card company saying your card has been compromised? Say okay, you'll call them back, and call the number on your credit card rather than speaking to whoever called you. 

Always remember that real IT departments and your financial services will never ask for your passwords or other confidential information over the phone. 

Attacking Networks 

A network-based attack is a type of attack that is targeted towards getting access to or breaking into a network to disrupt the network connectivity and delay access to the network. It may also be targeted to disable the network activity and traffic by affecting the performance of the network devices. There are lots of techniques that can be used to carry out the attacks on the network.

IP Spoofing Attack 

Spoofing is a technique in which hacker gains unauthorized access to the target computer though a fake IP address. Spoofing enables the hacker to view confidential information; it is a method in which false information is used to access data from a specific network. Example - a hacker can access the network by spoofing the IP address of the system. Once the access is granted, the attacker can access all resources over the network that can be accessed by the actual administrator.

Countermeasures To IP Spoofing

o Use authentication based on key exchange between the machines on your network; something like IPSEC which will significantly trim down on the risk of spoofing. 

o Use an access control list to deny private IP addresses on your downstream interface. 

o Configure your routers and switches if they support such configuration, to reject packets originating from outside your local network that claim to originate from within 

o Enable encryption sessions on your router so that trusted hosts that are outside your network can securely communicate with your local hosts.

o Implement filtering of both inbound and outbound network traffic.

Denial of Service Attack (DOS)

A Dos attack is the type of software or network attack in which an attacker attempts to disable system that provides network service by flooding a communication media with so many data to consume all available bandwidth. Or, sending data designed to exploit known flaws in an application. However, sending multiple service requests to the network to consume a network resource, A DOS attack is usually carried out against devices such as servers or routers, stopping them from responding to legitimate network request.

Countermeasures To DOS

Whether you are at risk from DOS attacks will depend on your Internet connection configuration and what services you are making available to remote sources. Even with an advanced firewall system, you may still be susceptible to attack. The short answer is that the more services you make available to the outside, the more susceptible you are to the various types of DoS attacks. And you can also use some of DoS tools and you can install on your systems. These tools only have the ability to detect known DoS tools. Then protecting yourself from most DoS attacks should not be that difficult.

Man In The Middle Attack (MITM)

A man in the middle attack is an attack where an attacker places himself between two computers on the network or in between two networks to intercept their data interchange. The attacker captures and record each packet, respond to it, and forwards it to the intended host, so that both the sender or receiver believe that they are communicating with each other. This deception allows an attacker to control the communication directly with each side of the legitimate communications'. 

Countermeasures To MITM

Protecting against MITM attacks mostly depends on your CA certificate. And it needs to be establishing a strong connection environment between end user and server and server have to be sending all sensitive data with encrypted format. And you can also download the latest version of high security Web browsers and then choose always the HTTPS setting, additionally you can also download some tools like sslstrip that prevent the user to get to the HTTPS secure page.

Software and Malicious Code Attacks

A software attack is an attempt against the software resources. Such as an operating system and software based application. An individual that performs attacks on the IT infrastructure usually does so in order to advance acknowledgment and to prove others that he or she is more adept than the best further; on that point, they may be employees who are not blocked with their earnings under which they are prepared to run. They may as well act as attackers and cause harm to the organization’s IT resources. Many software attacks are designed to acquire mastery of a computer so that the attacker can make use of that computer in the future, often for profit or further malicious actions, such as to harm the target computer or the application residing on the data processor.

Countermeasures To Software Attacks

If you are using the Internet with any software or Windows operating system, or your mobile operating system and you want to protect against malware and possible software based attack. So you can use firewall and antivirus or anti malware software should be installed. This need not cost the earth as some very salutary but some free applications are available. Even if you want the extra protection, all these software providers have upgradable options that cost the equivalent of more established products and may be worth the investment for complete peace of mind.

Software Exploitation Attack

A software exploitation attack is a type of attack where an assailant tries to exploit a known defect or feature in an application, such as an electronic mail application or operating system. A software exploitation attack is evident when an application stops functioning by it stored by a user become corrupt or go missing. Such approach may also cause the operating system to malfunction regularly, resulting in loss of information.

Countermeasures To Software Exploitation Attack

You can block malicious traffic that does not conform to established protocol standards Flags And removes high-risk files, such as .exe and scripting files, viruses, spyware, and Trojans from the system by fully inspecting the entire packet, then identify and stop traffic from hosts exhibiting suspicious behaviors. 

Consolation 

In today’s digital world, computers and internet users increase very extremely so that’s why dozens of users have become exposed to various kinds’ of cyber security threats and attacks. The user needs to implement a security measure. Bringing out and implementing cyber security in an organization is a challenge today as it necessitates a well defined and methodical plan of approach. Hence, that’s why increased the requirement of competent and skilled professionals who can implement cyber security in order to counter security breaches. This article increases readers awareness about the cyber security attacks & threats and how they can fix his or her own self with this kind of attacks. 

Author Bio

Khushal Kaushik is founder & CEO of LISIANTHUS TECH and cyber security specialist or ethical hacker. He holds a degree in computer science with 12 computer certification such as MCP, MCTS, DIGITAL FORENSIC and many further he has been working in The IT industry for the last four years, and he has an experience in Cyber Security and cyber forensic, also he was involved in a number of projects like web security vulnerability, Hospital management, insecure cryptography storage, network security and many more. 

U.S. President Barack Obama said recently that he had no strategy as yet toward the Islamic State. It is important for a president to know when he has no strategy. It is not necessarily wise to announce it, as friends will be frightened and enemies delighted. A president must know what it is he does not know, and he should remain calm in pursuit of it, but there is no obligation to be honest about it.

This is particularly true because, in a certain sense, Obama has a strategy, though it is not necessarily one he likes. Strategy is something that emerges from reality, while tactics might be chosen. Given the situation, the United States has an unavoidable strategy. There are options and uncertainties for employing it. Let us consider some of the things that Obama does know.

There are serious crises on the northern and southern edges of the Black Sea Basin. There is no crisis in the Black Sea itself, but it is surrounded by crisis. The United States has been concerned about the status of Russia ever since U.S. President Theodore Roosevelt negotiated the end of the Russo-Japanese war in 1905. The United States has been concerned about the Middle East since U.S. President Dwight D. Eisenhower forced the British to retreat from Suez in 1956. As a result, the United States inherited -- or seized -- the British position.

A national strategy emerges over the decades and centuries. It becomes a set of national interests into which a great deal has been invested, upon which a great deal depends and upon which many are counting. Presidents inherit national strategies, and they can modify them to some extent. But the idea that a president has the power to craft a new national strategy both overstates his power and understates the power of realities crafted by all those who came before him. We are all trapped in circumstances into which we were born and choices that were made for us. The United States has an inherent interest in Ukraine and in Syria-Iraq. Whether or not we should have that interest is an interesting philosophical question for a late-night discussion, followed by a sunrise when we return to reality. These places reflexively matter to the United States.

The American strategy is fixed: Allow powers in the region to compete and balance against each other. When that fails, intervene with as little force and risk as possible. For example, the conflict between Iran and Iraq canceled out two rising powers until the war ended. Then Iraq invaded Kuwait and threatened to overturn the balance of power in the region. The result was Desert Storm.

Urbanization and Demographics Could Skew China's Economic Rebalancing

China's urban population may grow by as many as 230 million people in the next 15 years. Most growth will take place not in metropolises like Beijing, Shanghai and Chongqing but in the myriad small- and medium-sized satellite cities around them. And as residents flock to these cities, China's working-age population will begin to decline, and its elderly population will grow dramatically.

Together, these processes will underpin major changes not only in China's overall economic structure, but also in the financial, fiscal and political relationship between central and local government. The added burdens facing small- and medium-sized cities, especially those located deep inside China that are sequestered from mainstream global trade, will be substantial and perhaps socially and politically destabilizing.

In July, the Chinese government announced that a revision to the one-child policy had been implemented throughout the country's provinces and regions. The announcement of the revision, which allows couples in which either partner is an only child to have up to two children, heralded the end of the controversial policy. More relaxed family planning measures have long been in place for rural and ethnic minority communities, and most urban Chinese of childbearing age now were the only children in their families, so the revision dramatically narrows the portion of China's population to which the original one-child policy still applies.

The purpose of the one-child policy -- limiting the population shaping demographic trends -- was superseded many years ago by the far more fundamental forces of industrialization and urbanization. Two decades ago, China's fertility rate fell below 2.1, the generally accepted population replacement rate. Since then, it has dropped to roughly 1.5 or, by some measures, as low as 1.4. These are comparable to fertility rates in Russia and Italy but well below those of the United States, Australia, the Netherlands and many other more advanced economies.

It is a coincidence, but a symbolically loaded one, that China's fertility rate fell below the population replacement rate in the same year that the Chinese government enacted new fiscal policies and other measures that would necessitate and drive the housing construction booms of the 1990s, early 2000s and post-global financial crisis era. The almost continuous two-decade property boom cycle underpinned rapid growth in the portion of China's population living in cities -- from less than 30 percent in the early 1990s to the current 54 percent. In doing so, it introduced hundreds of millions more Chinese to urban life, with all its associated costs. Far more than the one-child policy, these costs have shaped family planning practices in China in recent years, as have rising education levels and the transition from an agriculture-based economy to one based on manufacturing and construction.

Ukraine, Iraq and a Black Sea Strategy

The United States is, at the moment, off balance. It faces challenges in the Syria-Iraq theater as well as challenges in Ukraine. It does not have a clear response to either. It does not know what success in either theater would look like, what resources it is prepared to devote to either, nor whether the consequences of defeat would be manageable.

A dilemma of this sort is not unusual for a global power. Its very breadth of interests and the extent of power create opportunities for unexpected events, and these events, particularly simultaneous challenges in different areas, create uncertainty and confusion. U.S. geography and power permit a degree of uncertainty without leading to disaster, but generating a coherent and integrated strategy is necessary, even if that strategy is simply to walk away and let events run their course. I am not suggesting the latter strategy but arguing that at a certain point, confusion must run its course and clear intentions must emerge. When they do, the result will be the coherence of a new strategic map that encompasses both conflicts.

The most critical issue for the United States is to create a single integrated plan that takes into account the most pressing challenges. Such a plan must begin by defining a theater of operations sufficiently coherent geographically as to permit integrated political maneuvering and military planning. U.S. military doctrine has moved explicitly away from a two-war strategy. Operationally, it might not be possible to engage all adversaries simultaneously, but conceptually, it is essential to think in terms of a coherent center of gravity of operations. For me, it is increasingly clear that that center is the Black Sea.