Internal Network Attacks

arifakyuz.com siber guvenlik uzmani e bulten

The most unpredictable cybersecurity factor is HUMAN

The biggest MATERIAL harmful "Cyber Attacks worldwide" are caused by the infection of malicious encryption and ransomware that infiltrates the system as a result of devices unconsciously plugged into computer systems by the inside and end user, clicking on phishing e-mails or clicking on malicious links on websites.

To avoid exposure to Internal Network attacks:

Training departments of companies affiliated to Human Resources and Information Technology (IT) departments should carry out joint training activities. Continuous trainings should be given to end users against "Cyber Attack Attacks".

What is the solution?

arifakyuz com son kullanici egitimi parola guvenligi egitimi 1

Password policy complexity requirements

Users should be rigorously trained on the complexity requirements they must meet when setting their passwords.

Ensure that a customised password policy is in place by requiring Passwords in your environment to include one or more of the following:

Minimum length
Use of both uppercase and lowercase letters
Starting with a letter
Special characters
Figures
Not using dictionary words, restricted/unacceptable words, or easy-to-break patterns

Types of Attacks

Dictionary attack

Dictionary attack, one of the most frequently referenced types of attacks, is carried out by trying every word in the dictionary against the password. This dictionary also includes frequently used passwords such as 123456, qwerty, monkey, princess, baseball, password, hunter2.

Brute force

In this attack, the attacker tries every possible combination of characters. In theory, any password can be cracked this way, but depending on the length of the password, it can take very, very long to implement. You can protect yourself from such attacks by using uppercase and lowercase letters, numbers, and characters such as $, & in your password. Of course, internet services also have their own security measures against brute force attacks.

Rainbow table

The Rainbow table is usually an offline attack. For example, an attacker obtains a list of user names and passwords, but the passwords are encrypted. Hashed passwords look completely different from the original. However, in some cases, an attacker could pass plaintext passwords through a hashing algorithm and compare them to passwords in an encrypted password file. In some cases, the encryption algorithm may be vulnerable.

The Rainbow table consists of a large number of algorithm-specific hashes (terabytes of space are sometimes needed to store these tables). The Rainbow table greatly shortens the time it takes to crack a hashed password.

Malware/keylogger

One of the most guaranteed ways to steal your login information is to take advantage of pests and keyloggers. If the attacker manages to install such software on your PC, they can take over all your accounts at the same time. Pests can sometimes target a specific type of data as well.

arifakyuz com son kullanici egitimi sosyal muhendislik ataklari 1

Social Engineering Attacks

End users must be constantly trained against social engineering attacks with examples. The main headings of the attacks to be trained should be as follows.

Shoulder Surfing
Garbage Mixing
Trojans
Role playing
Phishing Phishing Emails
Reverse Social Engineering

Types of Attacks

Angling attack

There is actually no complete "Hack" here. In a phishing attack, the attacker sometimes sends emails to hundreds of thousands of people, hoping that the victim will hand over their password with their own hands. The email tells you to take immediate action (change your password immediately to avoid being hacked, etc.) and the email appears to be from a real company. Research says that the number one in phishing attacks is fake bills and phishing mails.

Social engineering

Social engineering can be defined as the real life application of a fishing rod attack. The "attacker" tells you on the phone that he's from the new support team in your office and asks you for your password for a specific job. In the meantime, it is possible to easily hand over your password without thinking that there is a scammer in front of you.

In social engineering, which has been in operation for years, the goal may not always be your password. For example, sometimes a fake electrician may ask you to open the door to enter a secure building.

arifakyuz com son kullanici egitimi usb ataklari 1

USB Attacks

End users should be rigorously instructed not to connect the following devices to any of the computer systems included in the company's inventory and network.

USB Flash Memory devices
Portable Storage Devices
Tablet
Phone

I hope my writing was useful. Unfortunately, companies do not attach much importance to personnel training for Cyber Security Attacks in the world and in our country. For cyber attacks that are no joke and cause irreversible financial damage when exposed, it will be very healthy for company managers to allocate more resources in their budgets for IT Software, Hardware and Personnel training items.

cropped 2 — **Arif Akyüz**
*Senior Information Technologies*
*System and Network*
Specialist *Cyber Security Specialist*
[email protected]