Cybersecurity Vulnerability Awareness

This article will explain the most common cybersecurity vulnerabilities, the way those vulnerabilities are exploited, cybersecurity best practices, and cybersecurity resources. 

Cybersecurity vulnerabilities are defined as weaknesses within a software program, computer system, or network that can be exploited by cybercriminals seeking to cause harm to a company or individual to access sensitive assets, such as personal information, financial data, business plans, internal strategies, federal tax information, protected health information, and many more. A handful of vulnerabilities can affect you, but these are the top five that most users/companies continue to have issues with:

           1. Zero-Day Vulnerabilities: A zero-day vulnerability is a weak point within a system or piece of software that cybercriminals discover before a patch is available. 

           2. Unpatched Software: Patching software and then releasing an updated version is a common practice, meant to optimize the software’s performance and security. However, the original version of the software is left unpatched and remains open to vulnerabilities. 

           3. Application Misconfiguration: Software often allows users to configure settings to their liking, including whether they wish to enable or disable its security features. Disabling these features can expose users to potential cyber-attacks. This vulnerability tends to be of particular concern in cloud-based environments. 

           4. Unsecured APIs: APIs provide a digital interface that enables applications or components of applications to communicate with each other over the Internet or via a private network. APIs are one of the few organizational assets with a public IP address. If not properly and adequately secured, they can become an easy target for attackers to breach. As with misconfigurations, securing APIs is a process prone to human error. Users may be unaware of the unique security risk this asset possesses and rely on standard security controls. 

           5. Credential Theft: Cybercriminals trick individuals via a phishing email to steal their credentials and use them to access the user’s system. They also employ old passwords uncovered in previously exposed data breaches to gain access. 

Exploiting a vulnerability is the first step in a successful cyber-attack. A vulnerability provides the gateway for a cybercriminal to gain access to a system or network. Once they achieve access, they can execute a malicious code used to compromise the system or network. Common tactics of cybercriminals include:

• Malware Attack: An intrusive program that installs itself within a system without the system’s permission. 

• Ransomware:  A specific type of malware that illegally encrypts key data, withholding it from the user until they pay a ransom. 

• Phishing Attack: A fraud-style attack in which a cybercriminal poses as a legitimate business like a bank via email and tricks the user into sending confidential information to the attacker. 

• Distributed Denial-of-Service (DDoS) Attack: An attack that uses several compromised computer systems to overwhelm a specific website or server so that it crashes. 

• Advanced Persistent Threats: Prolonged cyberattacks are used to steal valuable data while undetected. 

• IoT-based Attacks: Cyberattacks that gain unauthorized access to sensitive data through any IoT device. 

We use the Internet for virtually everything, but now we have more accounts, apps, and streaming services than ever before. With this comes more cybersecurity threats. Here are some important cybersecurity basics and best practices to ward off cyberattacks:

• Safeguard your data: In your daily life, you probably avoid sharing personally identifiable information. It’s important to exercise the same caution online. Cybercriminals have been known to impersonate trusted websites or authorities to trick you into providing personal information. 

• Avoid Pop-ups, unknown emails, and links: Phishers prey on internet users in hopes they will open pop-up windows or other malicious links that could have viruses and malware embedded in them. That’s why it’s important to be cautious of links and attachments in emails from senders you don’t recognize. 

• Use strong password protection and authentication: If a cybercriminal figures out your password, it could give them access to your network or account information. Creating unique, complex passwords is essential. A good password is a password that does not have personal information, at least sixteen characters, one special character, and a lowercase and uppercase.   

• Connect to secure Wi-Fi: Home Wi-Fi networks should be secure, encrypted, and hidden. You can add a layer of protection by using a virtual private network (VPN). A VPN is a service that provides online privacy and anonymity by creating a private network from a public internet connection. Free public Wi-Fi networks in places like coffee shops can put your data at risk of being intercepted. A VPN encrypts your connection so your online activity, including the links you click or the files you download, can’t be accessed by cybercriminals or other snoops.   

• Enable Firewall Protection: Having a firewall for your home network is the first line of defense in helping protect data against cyberattacks. Firewalls prevent unauthorized users from accessing your websites, mail services, and other sources of information that can be accessed from the web. 

• Update your security software and back up your files: Following IT security best practices means keeping your security software, web browsers, and operating systems updated with the latest protections. Antivirus and anti-malware protections are frequently revised to target and respond to new cyber threats. You should also secure and back up files regularly in case of a data breach or a malware attack. 

National Institute of Standards and Technology (NIST)

Cybersecurity and Infrastructure Security Agency (CISA)

National Security Agency (NSA)

Homeland Security

Need additional information or assistance? Contact the ITS Service Center.