Glossary: Cybersecurity Terms & Definitions

What Are Cyberattacks?

Cyberattacks are malicious campaigns that target infrastructure such as computer systems, networks, web apps, or APIs to disrupt, steal, or manipulate data. 

A cyberattack is an intentional effort by an individual or organization to breach the information system of another individual or organization, usually with the intent to steal data, disrupt operations, or cause harm to individuals, organizations, or nations.

Types of Cyberattacks

Attackers use a variety of sophisticated tools and techniques to launch cyberattacks against their targets.  Some of the most common types of cyberattacks include:

1. Malware Attacks

Malware refers to malicious software designed to infiltrate, damage, disrupt, or unauthorizedly access computer systems, networks, or devices. Malware is often delivered via email or clickable links in messages and is designed to infect systems and compromise their security. To mitigate the impact of malware, always install antivirus software on all devices, be cautious when opening suspicious email or attachments, and avoid suspicious websites.  Common types of malware include:  

  • Viruses, which are malicious code that attaches itself to legitimate software or files and replicates when executed.
  • Worms, which are self-replicating malware that spreads across networks and systems without user intervention. 
  • Trojans, which are malware disguised as legitimate software, and once installed perform a range of malicious actions, such as stealing data or providing remote access to attackers. 
  • Spyware, which monitors users’ activities without their knowledge or consent to collect sensitive information such as credentials or credit card numbers.

2. Phishing Attacks

Phishing are attacks that involve deceptive email or messages that trick individuals into revealing sensitive information, such as passwords, credit card numbers, or personal data. These attacks often take the form of fraudulent emails, websites, or messages that appear to come from legitimate sources, but they are actually controlled by cybercriminals. A more targeted form of this attack, known as spear phishing, involves tailoring messages to a particular individual or organization to make the request for information seem more legitimate. To protect against phishing attacks, users should be cautious of unsolicited emails, particularly those requesting personal or financial information, and never click on suspicious links or download attachments from unknown senders.

3. DDoS Attacks

Distributed denial of service (DDoS) attacks render a system nonfunctional, making it unavailable to legitimate users. DDoS attacks degrade infrastructure by flooding the target resource with traffic, overloading it to the point of inoperability. DDoS attacks involve multiple sources or a botnet, which is a network of compromised computers or devices under the control of an attacker who coordinates these multiple sources and launches the attack against the target. An attack that originates from a single source is simply called a denial of service (DoS) attack. 

Volumetric, or flood, attacks are a type of DDoS attack that often target layers 3, 4, or 7, with SYN flood being a very common attack that can overwhelm network firewalls and other critical network infrastructure. 

Protecting against DDoS attacks requires a combination of defenses to create a layered defense that includes traffic filtering and rate limiting mechanisms. These can block malicious network traffic and detect anomalies in traffic patterns that may indicate a DDoS attack. Implementing cloud-based DDoS protection services can provide dedicated and scalable mitigation capabilities to defend against DDoS attacks. By redirecting traffic through these services, organizations can benefit from advanced mitigation techniques, real-time threat intelligence, and the expertise of specialized providers.

4. Ransomware Attacks

Ransomware is a type of malware that encrypts a system’s data, with the attacker demanding payment (ransom) to unlock the data or provide the decryption key. A ransomware attack often begins with a targeted spear phishing campaign that tricks a user into clicking on a malicious link or website, which unleashes the encryption software and blocks access to the victim’s data. Attackers typically display a ransom note on the victim's screen or provide instructions on how to pay the ransom (often in cryptocurrency) to receive the decryption key. As with other phishing attacks, being very cautious about email attachments and links is the first line of defense against malware attacks. Other protections against the impact of ransomware attacks include backing up data to remote and secure systems that are not directly accessible to the primary network so another unencrypted copy of the data remains available. Network segmentation can also help to contain and isolate infections, limiting the spread of encryption malware.

5. Social Engineering Attacks

Social engineering attacks rely on psychological manipulation to deceive people into revealing sensitive information, performing actions, or making decisions that compromise security. In some cases, attackers may impersonate trusted individuals, such as colleagues, supervisors, or IT personnel, to convince victims to share sensitive data or reveal usernames, passwords, or other authentication credentials. Using this information, attackers can gain unauthorized access to systems, accounts, and sensitive data. Phishing and social engineering are often used in combination to manipulate victims and can be quite targeted, such as a phishing email followed by a phone call from someone impersonating a trusted individual (i.e., from a bank or the IT department). The primary way to prevent social engineering attacks is through user education and awareness of phishing and social engineering tactics, though strong authentication practices, such as MFA, can help limit the net impact of social engineering attacks.

6. Insider Threats

Insider threats are security risks posed by individuals within an organization who have access to the organization's systems, data, or networks. These individuals may be current or former employees, contractors, partners, or anyone with legitimate access privileges. Insider threats can be intentional or unintentional and can result in various types of cybersecurity incidents including sabotage, data theft, mishandling of data, and falling for phishing or social engineering attacks. Employee awareness and training to recognize insider threats are important for preventing the risk of insider threats, as are strong access controls, such as the principle of least privilege, and strong user authentication methods to verify user identities and protect against unauthorized access.

7. Web Application Attacks

These malicious attacks are directed at web applications, websites, and web services, with the aim of exploiting vulnerabilities and compromising their security. App modernization efforts and the resulting evolution of many traditional web apps to API-based systems across hybrid and multi-cloud environments have dramatically increased the threat surface. 

Security teams must consider many risks for web apps and APIs, including:

  • Vulnerability exploits, which are weaknesses or defects in software that criminals can target to compromise security, including execution of malicious code. These are often caused by unsupported or unpatched software, software bugs, or misconfigurations. 
  • Automated threats, which refer to malicious attacks performed by bots, scripts, or hacker toolkits rather than by humans. These threats can exploit inherent vulnerabilities in web applications and APIs, leading to security breaches, data theft, account takeover, fraud, and other harmful consequences. 
  • Business logic abuse, which occurs when attackers manipulate the expected behavior of a web application to achieve malicious objectives, often using automation. This may entail manipulating an application’s workflows to gain access to restricted areas or to perform unauthorized transactions or access sensitive data.
  • Bypass of authentication and authorization controls, which can occur when insufficient enforcement of access controls and authorization allow attackers to gain access to unauthorized functionality or data.
  • Client-side attacks, which are threats that target software or components in the user’s devices, such as a web browser or installed applications. A common form of client-side attack is Cross-Site Scripting (XSS), in which attackers inject malicious client-side scripts, such as JavaScript, into web pages viewed by other users. This can result in the theft of sensitive information, such as login credentials, personal data, or session cookies. Modern apps typically have many interdependencies, such as third-party integrations, libraries, and frameworks. Security teams may not have visibility into all these components that execute on the client side—opening a threat vector for attackers to execute malicious scripts and exfiltrate data directly from a web browser. 
  • Security misconfiguration, when attackers attempt to find unpatched flaws, common endpoints, services running with insecure default configurations, or unprotected files and directories to gain unauthorized access to a system. Security misconfiguration is an increasing risk as architecture continues to decentralize and becomes distributed across multi-cloud environments.

Cyberattack Objectives

Cyberattacks can have various objectives, based on the motives and goals of the threat actors that launch the attacks.

Financial gain is a common motive for cyberattacks such as ransomware attacks and fraud, as is theft of data, which can be easily monetized on the dark web. Sensitive data that can be offered for sale include intellectual property, trade secrets, credentials, and financial information. Espionage is another motive for cyberattacks, with nation-state actors and cyber spies operating to gather intelligence and sensitive information to serve national or political interests. Cyberattacks can also be used to disrupt the normal flow of operations or interfere with critical infrastructure, leading to downtime and loss of revenue.

Cyberattack Targets

Cybercriminals are very good at detecting and targeting technology weaknesses and vulnerabilities to launch cyberattacks across all attack vectors. Common vulnerabilities include outdated or unpatched software, which attackers can exploit to gain unauthorized access, compromise data, or execute malicious code. Weak authentication mechanisms can also allow unauthorized individuals or attackers to gain access to systems and sensitive information, or to compromise accounts. Insecure application design can also contribute to cyberattacks by introducing vulnerabilities that attackers can exploit, such as security misconfigurations, flawed session management, or insecurely designed APIs. 

Attackers also target network vulnerabilities. These include unsecured Wi-Fi networks, which allow attackers to intercept or manipulate communication between two parties, potentially stealing sensitive information or injecting malicious content. Weak network configurations can also create security gaps that attackers can exploit, such as inadequate firewall rules, misconfigured access control lists (ACLs), and weak or outdated encryption protocols. 

Vulnerabilities related to supply chain issues can also be exploited by attackers. Weaknesses in third-party suppliers or cybersecurity practices by vendors can be exploited by attackers to gain access to an organization's network or resources. These can include inadequate security measures, unpatched software, or vulnerable hardware. It’s important to assess the cybersecurity practices of suppliers and partners and require them to adhere to security standards and best practices as part of vendor due diligence. 

Human factors can also contribute to cyber vulnerabilities. In addition to social engineering attacks, in which criminals manipulate individuals into revealing sensitive information, use of weak passwords or lack of security awareness on the part of employees can also create an opening for a cyberattack. Insider negligence, such as inadvertently downloading malware or mishandling sensitive data—even if unintentional—can lead to cyberattacks. 

Like many other technologies, AI can be used for both legitimate and malicious purposes and is increasingly harnessed by bad actors to conduct sophisticated and damaging cyberattacks. AI can be employed to scan software and systems for vulnerabilities and collect and analyze data about potential targets. It can then be used to launch attacks when weaknesses are detected. AI can also speed up the process of password cracking by using machine learning algorithms to guess passwords more efficiently. AI-generated deepfake videos and audio can be used for social engineering attacks, impersonating high-level executives or other trusted figures within an organization to manipulate employees into taking actions that compromise security. In addition, easy access to powerful AI is democratizing cybercrime by lowering the barriers to entry for conducting automated cyberattacks, making it easier for a wider range of individuals or groups to engage in cybercrime.

Most Common Cyberattack Vectors

Attackers continuously evolve their cyberattack techniques, and new attack vectors emerge regularly. In addition, sustained and targeted attacks frequently employ more than one methodology. Following are examples of the most common attack vectors. 

  • Man-in-the-Middle (MitM) attacks occur when an attacker intercepts communications between two parties without their knowledge or consent, allowing the attacker to eavesdrop on the conversation, steal information, or even manipulate the data being transmitted. MitM attacks can occur in a number of ways: An attacker may intercept wireless communications within a public Wi-Fi network, or may engage in session hijacking, when attackers steal session cookies or tokens to impersonate users and gain unauthorized access to web applications.
  • Injection attacks occur when attackers insert untrusted or hostile data into command or query languages, or when user-supplied data is not validated, filtered, or sanitized by the application, leading to execution of malicious commands. Injection attacks include NoSQL, OS command, LDAP, and SQL injection attacks, and also Cross-Site Scripting (XSS), in which attackers inject malicious client-side scripts, such as JavaScript, into web pages viewed by other users. This can result in the theft of sensitive information, such as login credentials, personal data, or session cookies.
  • Credential theft involves stealing usernames and passwords, often through techniques like keylogging, credential stuffing, and password spraying (using common passwords against many user accounts). Compromised credentials can lead to unauthorized account access, data breaches, and lateral movement within a network. Attackers frequently target weak or reused passwords, making robust authentication practices crucial. Credential stuffing has dramatically increased the rates of account takeover (ATO) and fraud across industries, particularly in e-commerce and financial services.
  • Malicious websites are intentionally designed to perform harmful actions, compromise the security of visitors' devices, or engage in illicit activities. Malicious websites can exploit vulnerabilities in web browsers, plugins, or operating systems to silently download and install malware onto devices without the user’s consent or knowledge, an exploit often referred to as Drive-By Downloads. Malicious websites can also host clickable ads that contain malicious code or links.
  • Compromised software enables attackers to gain unauthorized access to systems through exploiting known vulnerabilities in unpatched software or via malware injected into software updates or downloads. 

To guard against these types of vulnerabilities, be sure to implement strong authentication and access controls such as strong passwords or passphrases and enable MFA to add an additional layer of security. Employing the principle of least privilege and regularly reviewing and updating access controls ensures that users have only the permissions necessary to perform their functions. In addition, be sure to keep software and systems patched and up to date and conduct vulnerability assessments and penetration testing to identify and remediate weaknesses. Human factors can have a major impact on the risk of cyberattacks, so be sure to provide cybersecurity awareness training and education to all employees and users. Cybersecurity is a shared responsibility that involves not only IT professionals but also every individual within an organization. 

Impact of Cyberattacks

Cyberattacks can have significant and wide-ranging consequences for both individuals and organizations. The most immediate impacts can be financial losses, whether from fraud or theft from unauthorized access to an individual’s accounts; or lost revenue, legal fees and regulatory fines experienced by an organization after a cyberattack. Organizations can also suffer reputational damage and operational disruption after an attack, and may face the theft of intellectual property that impacts competitiveness and market position. In the case of ransomware attacks, organizations may encounter the difficult decision of whether to pay a ransom to recover encrypted data, particularly since ransom payment does not guarantee data recovery and can encourage further attacks. 

As the following examples make clear, the threat of cyberattacks is present across a wide range of industries and business types. 

  • In late 2022, attackers manipulated an API at T-Mobile and breached 37 million user accounts to obtain customer names, billing addresses, email addresses, phone numbers, account numbers, and birth dates. The attacker, who had unauthorized access to T-Mobile's systems for over a month before the breach was discovered, has not been identified. 
  • In March, 2023, Russian hackers launched social engineering campaigns targeted at U.S. and European politicians, businesspeople, and celebrities who had publicly denounced Vladimir Putin’s invasion of Ukraine. Hackers persuaded victims to participate in phone or video calls, giving misleading prompts to obtain pro-Putin or pro-Russian soundbites. They published these to discredit victims’ previous anti-Putin statements.  
  • In June, 2023, a DDoS attack led to a disruption of Microsoft 365 services, including Outlook, Teams, OneDrive, and cloud computing platform Azure, for over 8 hours. Microsoft said the attack was directed by a group known as Storm-1359 that has access to a collection of botnets and tools that enable the threat actor to launch DDoS attacks from multiple cloud services and open proxy infrastructures. The attack targeted the application layer (layer 7) of the network stack, rather than the most frequently targeted layers 3 or 4.

How Does F5 Handle Cyberattacks?

As cybersecurity threats grow more advanced and persistent, and as the consequences of cyberattacks grow more catastrophic, organizations must move away from the use of fragmented, point-based security tools towards a comprehensive, integrated approach to cybersecurity preparedness that extends across the entire attack surface. A new approach to security is required to protect identities, devices, networks, infrastructure, data, and applications across a dynamic, multi-cloud environment that leverages modern architectures, microservice-based edge workloads, and third-party integrations. 

F5 offers a suite of integrated cybersecurity solutions that maximize protection and reduce risk across both legacy and modern apps and automate security policies across all environments. Driven by AI and ML, F5 security solutions allow for more adaptive and responsive security measures to enhance threat detection, automate incident response, and analyze vast datasets to identify patterns and anomalies indicative of cyber breaches and defend against emergent threats. 

F5 security solutions mitigate vulnerabilities and cyber threats with comprehensive security controls and uniform policy and observability, including simplified deployment and management of app security across environments. With F5, organizations can leverage pervasive security including web application firewall (WAF), distributed denial-of-service (DDoS) mitigation, API security, and bot defense from a single, purpose-built platform that easily scales across multi-cloud and edge environments. A holistic governance strategy and a centralized control panel reduce operational complexity, optimize application performance, and increase the security efficacy of your investments by observing end-to-end application traffic and events.