What Types of Attacks Are Out There?

Here are the five most common cyberattacks that threaten small and midsize businesses:

1. Malware: Malware refers to malicious types of software that threat actors use to cause extensive damage to an organization’s computer systems, networks and data. It may also be used to give attackers access to your network without your knowledge or authorization. The intent of malware is very often to profit in some way, such as through forced advertising, stealing information, spreading email spam or extorting money.
2. Ransomware: Ransomware is a specific type of malware that attackers use to gain access to a system or network, and then block the organization from accessing it until they pay a ransom. The goal is to stop businesses from being able to perform critical functions, such as a hospital intaking patients or a manufacturer logging orders for shipment. Certain types of ransomware attacks will actually steal sensitive data (like patient data or credit card info in those two examples) and hold it ransom until the sum is paid. This can be especially detrimental for companies in industries with stringent regulatory compliance.
3. Phishing: Phishing is a type of cyberattack where actors try to lure users into giving up sensitive data or installing some type of malware on their system. Phishing attacks are commonly done over email but they can also be carried out through phone calls and text messages. In an email phishing scam, the attacker might pretend to be a legitimate organization (such as a bank) and send a link that leads to a fake login page. The page is designed to look like the real thing, but when you put in your credentials, the attacker now has access to your username and password.
4. Credential theft: To steal credentials, hackers will usually try one of two options: a phishing attempt, or an attack that compromises a company’s database with sensitive information, such as social security numbers and username/password combos. Usually, hackers will sell this info on the black market for financial gain, rather than using it themselves. Employees at mid-market companies may be particularly prone to having their credentials compromised, because without proper training or a highly informed password policy, they’re likely to use the same password across different sites. And if a hacker gets a hold of login information for one site, they’ll use it to try and hack into accounts on hundreds of other sites, such as an email or credit card account.
5. Security infrastructure misconfiguration: This is less of a specific attack and more of a vulnerability that many small businesses find themselves susceptible. If you have a security tool in place, but it’s misconfigured, it is inherently insecure. Hackers are always on the lookout to exploit these types of weaknesses. If a firewall is misconfigured, for example, threat actors can get in and take control of a server. They use this access to deploy some type of payload, either to extract data or for their own financial gain (such as through ransomware).