8 Threats To Information Security & How You Can Tackle Them

Plenty of businesses around the world are asking ‘what is infosec’ (or information security) and how are attackers compromising company data? The methods that are being used in security attacks in information security are almost as varied as the types of data that you might be storing! But there are some common types of attacks in information security that we see over and over again. Knowing what these types of security threats are is the first step to avoiding them and keeping your business safe.

1. Data Breaches

Any time that an attacker gains access to your data, it is known as a data breach. Whether that ends up in a data leak, where the information is shared publicly online for anyone to access and use, or a ransomware attack, where information that is critical to your company’s operation ‘hostage’ until a ransom demand can be paid, the results of a data breach for any company can be devastating.

But not all data breaches are the same – attackers use a variety of different techniques (many of which are outlines below) to infiltrate your systems and gain access to data, each of them having different consequences. And, to add insult to injury, not all data breaches come in the form of attacks, per se. Human error can easily lead to confidential information being shared, whether knowingly or unknowingly. And even if data is sent to a client or vendor in error, any sharing of information that shouldn’t be shared qualifies as a data breach.

2. Phishing Attacks

Phishing has been a common practice since the earliest part of the millennium, but attackers have gotten more sophisticated in their techniques. There’s general phishing, spear phishing, whale phishing, and each of them has a specific target in mind.

General phishing emails are sent to anyone and everyone. Attackers who use this technique take a spray and pray approach – emailing as many people as they can, and hoping that one of them will fall for their con by either clicking on a link or downloading an attachment.

Spear phishing is a more targeted approach, where attackers send mails to specific people within a company who are likely to have high levels of access. They gather information about their targets online and use this to gain their victim’s trust, making them think that they’re speaking to a colleague, a vendor, or someone else they might know, rather than a complete stranger. The goal in this case is to gain access to company information, or to hack an account which will provide them with even more access to data.

While spear phishing tends to target people in general management, whale phishing takes on the ‘Moby Dick’ of businesses – the white whales who have the most access of all. The CEOs, CFOs and owners who have control over all of the company’s data. Successful whale phishing attacks see the attackers gaining full access to a company’s data, which make it significantly easier to pull off, for example, a ransomware attack which will have a big pay day for them.

3. Malware

One of the most common techniques that attackers use to infiltrate systems and compromise users is malicious software, or malware. While there are multiple types of malware doing the rounds, each of which uses different techniques to compromise devices, the aim behind installing malware on machines is to spy on users and gain access to information illicitly.
While phishing attackers often make use of malware by getting their victims to download an attachment or visit a website that will install malware on their machine, phishing is not the only way that malware is spread. It’s common for people to visit a site with a deal that seems far too good to be true – like the offer to win a free iPad just by clicking a button – only to find that when they click that button, nothing seems to happen. They close the site, shaking their heads in annoyance, but otherwise forget that it ever happened. In the meantime, they have unknowingly downloaded malware to their device, and it may take some time before they even realise the error, since malware attackers often like to lurk in the background, gathering as much data as they can before making a move.

4. Social Engineering

Another technique used by phishing attackers, but also used in other types of security attacks, is social engineering. You can think of social engineering as a form of identity theft – an attacker gathers as much information as they can about a person and then pretends to be them. A successful social engineering attack will see victims trusting an attacker, thinking that they’re a friend or colleague, and from there, the attacker can gain access to further information, take on a new identity to gain the trust of further victims, or trick you into providing personal information like user credentials or credit card details, which they can use to their advantage.
The real question when it comes to social engineering is, how do attackers gain access to the personal information they need to pull off a successful attack? The answer lies in social media, in Google searches, and in the attack itself. People share so much information on social media, and often make their posts public, meaning that anyone can access that data. They share where they went on holiday, who their friends are, what they ate for lunch. And all of this can be used by an attacker to gain a person’s trust.
Let’s say for example, that an attacker wanted to attack a business. They do a quick Google search and find that the business has a CFO named Larry. The company’s website lists his name, his surname, his photograph, his title, and a couple of details about him. Nothing innocuous on its own, but enough information to find Larry on Facebook and LinkedIn. On Larry’s Facebook page, he has recently updated his profile picture and cover photo with pictures of his family on holiday, and oh look, he checked into a flight to Mauritius two weeks ago. The attacker types up an email based on this information, and sends it from an address which claims to be Larry’s boss.
“Hey Larry. I hope you had a great time in Mauritius with the family! I was just wondering if you could by any chance pass along your number – I seem to have lost it, and would like to have a chat about some payments that slipped past us while you were away.”
An email like the one above may seem innocent, but if Larry were to respond to it and give his number to an attacker, that is more personal information than the attacker had before, and a new method of contact which can be exploited to gain further trust and elicit more information.

5. Network Attacks

While social engineering and phishing attacks target individuals, hoping to use their trust and their credentials to gain access and bypass your company’s information security measures, it’s not only your team members that you need to be worried about protecting.

Network attacks are all about bringing down your servers, routers and other network devices that allow your business to operate and access information effectively. Or, if they don’t bring the network down, a network attack can involve an attacker infiltrating and hiding within your network, and intercepting data that is being transferred across it.

What makes network attacks one of the more dangerous data security threats is the fact that businesses often don’t update or patch their network devices as a priority, making it easy for attackers to take advantage of software vulnerabilities. Software and app developers regularly release security updates to address flaws and vulnerabilities within the software, but these do require action on the part of IT teams in order to ensure that these patches and updates are applied as soon as possible to keep your business protected.

6. Physical Attacks

We often talk about the threats that cyberattackers pose. With so much data being stored in cloud facilities, cyber attacks are one of the biggest threats to data, after all. But they are not the only threat out there. Physical attacks like theft and sabotage need to also be taken into consideration. And with more and more people working remotely and transporting devices with them wherever they go, it’s not just your offices that you need to secure against physical attacks.

If a laptop gets stolen, for example, whether it’s from one of your employees’ houses, or from a bag that they took with them to a café, or from the resort that they’re staying at in Thailand, your business suddenly has got a much bigger problem on it’s hands than just an employee who isn’t able to work. The thief not only has access to a device, but also potential access to all of the data stored on the device, all of the user credentials that are saved in the browser and more.

There is, of course, the chance that the thief is nothing more than a crook who simply wants to wipe the device and sell it on. But if they are prone to both physical theft and cyberattacks, they suddenly have a wide range of company data at their disposal.

7. Brute Force Attacks

Insecure passwords pose a huge threat to your company’s information security, and Brute Force Attacks are the reason why.
In a Brute Force Attack, a cyber criminal can run a script which guesses thousands of passwords every second, trying to gain access to your website, your cloud services, your systems and networks. If one of your employees has used a password like “Password”, their name or surname, their year of birth, these are all easily cracked, and can result in the attacker quickly gaining access and compromising your company data.
But it’s also not just weak passwords that pose a problem. During brute force attacks, even complex passwords can become compromised. Which is why securing your data through passwords alone just isn’t enough in today’s modern world which is filled with threats to information security.

8. Insider Threats

We’d love to tell you that the only threats to your company’s data are cyberattackers – strangers who you have never met and are never going to meet. But in reality, insider threats remain a very real concern to companies around the world. And for good reason.
It’s one matter when an attacker gains access to your business data, but it’s another matter entirely when a human who is trusted within your company purposely compromises your information. It could be an unhappy employee, a disgruntled ex-worker who has somehow retained access to your data, a corporate spy who has been planted by a competitor. While this last scenario seems unlikely, stranger things have happened when it comes to company politics.
What’s even worse, is that some types of insider threats can also take the form of human error – people who don’t even realise that they are compromising company data, and are just trying to do their jobs as best they can. They may be creating multiple copies of documents which then become far too easily confused, resulting in a loss of data credibility. They could be sending sensitive information over unencrypted emails. They could be trying to log into their email accounts over public WiFi while sitting at a café, not realising that their data is being spied on in a man-in-the-middle style attack. But just because they are unaware, that doesn’t make them any less of a threat to your business.