Attacks and Remediations: A Comprehensive Guide to Cybersecurity Threats

Attacks and Remediations

A list of the Attacks and their respective Remediations / Defences we'll tackle in the blog articles until the end of this year (Yey!)

By handling potential online threats, we arm ourselves to make smarter choices, spot sketchy stuff, and know how to react when things don't feel right.

Categories of Attacks

Access-Control-Attack
(e.g., IDOR, Privilege Escalation)
Description: Attacks that exploit flaws in access control mechanisms, allowing attackers to gain unauthorized access to resources or perform actions they should not be able to. These attacks often arise from poor implementation of access control policies.
Examples:
- Insecure Direct Object References (IDOR) (accessing resources by manipulating request parameters).
- Privilege Escalation (gaining higher privileges by exploiting system vulnerabilities).

API-Security
(e.g., API Misconfiguration, Rate Limiting Bypass)
Description: Attacks that exploit vulnerabilities in APIs (Application Programming Interfaces), such as improper authentication, lack of rate limiting, or exposure of sensitive endpoints. APIs are often targeted due to their direct access to backend services.
Examples:
- API Misconfiguration (exposing administrative functions publicly).
- Rate Limiting Bypass (sending too many requests to overwhelm or exploit an API).

Authentication-and-Session-Attack
(e.g., Broken Authentication, Brute Force)
Description: Attacks that exploit weaknesses in authentication mechanisms or session management to gain unauthorized access to systems or hijack user sessions. This includes exploiting weak passwords, poor session handling, or insecure authentication protocols.
Examples:
- Brute Force Attacks (guessing passwords through repeated attempts).
- Session Hijacking (stealing session tokens to impersonate a user).

Cloud-Specific-Vulnerability
(e.g., IAM Misconfigurations, Insecure Serverless Functions)
Description: Attacks that target vulnerabilities specific to cloud environments, such as misconfigured identity and access management (IAM) policies, insecure serverless functions, or poorly protected virtual private clouds (VPCs).
Examples:
- IAM Misconfigurations (over-permissioned roles leading to unauthorized access).
- Insecure Serverless Functions (exposing cloud functions to unauthorized execution).

Code-Execution-Attack
(e.g., Remote Code Execution, Insecure Deserialization)
Description: Attacks where an attacker can execute arbitrary code on a vulnerable system, either locally or remotely. These attacks often lead to full system compromise and are considered highly severe. Examples:
- Remote Code Execution (RCE) (executing commands on a remote server).
- Insecure Deserialization (executing code by tampering with serialized data).

Configuration-Based-Attack
(e.g., Security Misconfiguration, Open Redirects)
Description: Attacks that exploit weaknesses in system configurations, including open redirects or improper security settings that are left exposed, take advantage of misconfigured security policies or parameters.
Examples:
- Open Redirects (redirecting users to malicious sites).
- Security Misconfiguration (allowing access to sensitive configuration files).

Container-Orchestration-Security
(e.g., Kubernetes Misconfigurations, Insecure Container Registries)
Description: Attacks that target container orchestration platforms, such as Kubernetes or Docker Swarm, by exploiting misconfigurations or insecure practices in managing containers and workloads.
Examples:
- Kubernetes Misconfigurations (exposing unauthenticated dashboards).
- Insecure Container Registries (storing unverified or vulnerable images).

Cryptographic-Attack
(e.g., Padding Oracle Attack, Advanced Cryptanalysis Techniques)
Description: Attacks targeting the cryptographic algorithms or their implementation are aimed at breaking encryption schemes, decrypting sensitive data, or bypassing encryption-based security mechanisms.
Examples:
- Padding Oracle Attack (exploiting padding errors in block cyphers).
- Advanced Cryptanalysis (using statistical methods to break encryption algorithms).

DevOps-Security
(e.g., CI/CD Pipeline Attack, Insecure Code Repositories)
Description: Attacks targeting the DevOps lifecycle, including vulnerabilities in continuous integration/continuous deployment (CI/CD) pipelines, insecure code repositories, or compromised build systems. These attacks focus on gaining control over the software development and deployment process.
Examples:
- CI/CD Pipeline Attacks (injecting malicious code into the build process).
- Insecure Code Repositories (leaking sensitive information through version control systems like GitHub).

File-Based-Attack
(e.g., Directory Traversal, Insecure File Upload)
Description: Attacks that exploit vulnerabilities in how a system handles file access or uploads, allowing attackers to upload malicious files or read/write unauthorized files on the server.
Examples:

Directory Traversal (accessing restricted files by manipulating file paths).
Insecure File Upload (uploading files that contain malicious code).

Input-Based-Attack
(e.g., SQL Injection, XSS, CSRF)
Description: Attacks where the attacker manipulates user inputs that are insufficiently validated by the system, leading to unauthorized access or execution of malicious commands. These attacks exploit input fields such as forms, URL parameters, or headers.
Examples:

SQL Injection (injecting SQL code into a query to manipulate a database).
Cross-Site Scripting (XSS) (injecting malicious scripts into web pages).
Cross-Site Request Forgery (CSRF) (tricking users into performing actions they didn’t intend).

Microservices-Security
(e.g., Service-to-Service Authentication, Insecure Service Discovery)
Description: Attacks targeting microservice architectures, particularly focusing on weak or insecure communication between services, service discovery mechanisms, or insecure authentication practices within the microservices ecosystem.
Examples:

Insecure Service Discovery (exposing service discovery endpoints to attackers).
Service-to-Service Authentication Bypass (exploiting trust relationships between services).

Misconfiguration-Attack
(e.g., Security Misconfiguration, Insecure Deserialization)
Description: Attacks that exploit improperly configured system components, such as leaving sensitive endpoints exposed, using default credentials, or enabling insecure features by default, these attacks take advantage of weak or missing security controls in the configuration.
Examples:

Security Misconfiguration (leaving default passwords unchanged).
Insecure Deserialization (allowing the deserialization of untrusted data).

Network-Based-Attack
(e.g., DDoS, SSRF)
Description: Attacks that target network communication protocols and infrastructure, disrupting services or gaining unauthorized access to networked systems. These attacks often aim to exhaust resources, intercept data, or manipulate requests between systems.
Examples:

Distributed Denial of Service (DDoS) (overwhelming a server with traffic).
Server-Side Request Forgery (SSRF) (tricking a server into making unauthorized requests to internal services).

Attacks and Remediations

Attacks and Remediations

Categories of Attacks

The "70" List