Types of security attacks

A security attack is any attempt to break the confidentiality, integrity or availability of a system or its data. Attacks are classified as passive and active, and as coming from outside or inside.

1. Passive attacks

The attacker only observes or copies data and does not change it, so they are hard to detect.

• Release of message contents (snooping/eavesdropping): reading private data, e.g. e-mail, passwords on the network.
• Traffic analysis: studying the pattern, size and frequency of messages even when they are encrypted.

2. Active attacks

The attacker modifies data or disrupts service.

• Masquerade (spoofing): one entity pretends to be another, e.g. using a stolen password.
• Replay: a captured message is sent again to get an unauthorised effect.
• Modification of messages: altering part of a message.
• Denial of service (DoS/DDoS): flooding a server with requests so valid users cannot use it.

3. Other common attacks (Tanenbaum)

• Malware: viruses, worms, Trojan horses, logic bombs, spyware.
• Trap door (back door): secret entry point left in a program.
• Buffer overflow: writing past the end of a buffer to overwrite the return address.
• Login spoofing / phishing: fake login screen collects passwords.
• Insider attacks: by users with legitimate access.

Countermeasures: authentication, encryption, firewalls, antivirus, patches and access control.