# data[].attributes.body
A rainbow table attack is a method of hacking in which the perpetrator attempts to crack passwords stored in a database system using a rainbow hash table. A rainbow table is a hash algorithm used in cryptography to store essential data in a database, such as passwords.

How to Mitigate

o   Use strong password related to password policy (numbers, letters – uppercase and lower case, symbols)

o   Enable two-factor authentication

# data[].attributes.body
Phishing is the practice of delivering fake messages that appear to come from a trusted source. It is often done by email. The aim is to steal sensitive information such as credit card and account information or to install malware on the victim's PC. Phishing is a popular form of cyber threat that everyone should be aware of in order to be protected.

How to Mitigate

o   Do not click on unknown links

o   Do not give information to unsecured websites

o   Rotate password regularly

o   Do not ignore security patch updates

o   Install firewalls

o   Do not be tempted by pop-up messages

# data[].attributes.body
A key logger is a tool that can record and report on a user of a computer. Key loggers keep track of you by recording what you type as you type it and malicious hackers often install key loggers for nefarious purposes.

How to Mitigate

o   Use Firewall

o   Install a password manager

o   Update the system

o   Consider other additional security tools

o   Change your password

# data[].attributes.body
The automatic insertion of stolen username and password pairs ("credentials") into website login forms in order to illegally obtain access to user accounts is known as credential stuffing. Because many users reuse the same password and username/email, entering those stolen credentials to dozens or hundreds of other sites can allow an attacker to breach those accounts as well.

How to Mitigate

o   Use a unique password for each service

o   Use a web application Firewall

o   Limit authentication requests and send notification

o   Use multi-factor authentication

# data[].attributes.body
Password spraying is an attack that uses a few regularly used passwords to gain access to a large number of accounts. Traditional brute-force attacks try to guess a password in order to obtain unauthorized access to a single account. This can provided useful in the targeted account being locked out, as most account-lockout rules only allow for a certain number of failed attempts within a given time period. Password spray campaigns typically target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols. Targeting federated authentication can help mask malicious traffic.

How to Mitigate

o   Enable multi-factor Authentication

o   Enforce the  use of strong passwords

o   Review passport management programs

o   Create security awareness in workplace

# data[].attributes.body
Dumpster diving is something that looks like taking treasure from someone's trash. In the IT world, dumpster diving is a technique used to retrieve information that could be used to carry out an attack or gain unauthorized access to a computer network from disposed of items.

A dumpster does not have limitations. It goes through access code passwords written down in sticky notes, and sensitive information such as phone call list, meeting minutes or calendar events and can be used by attackers using social media techniques to gain access to the network.

Disposed computer storage devices are can be a gem mine for attackers because information can be recovered from them, including those that have been improperly formatted or erased.  This will include trusted certificates and sensitive passwords. The equipment related to the TPM (Trust Platform Module) data or other hardware IDs that are trusted by an organization is included.

How to Mitigate

o, Ensure all identical information and data are removed from computer equipment before being disposed of or resold.

o   Use a matching secure storage media deletion method

o   Maintain a data retention policy and keep sensitive data clean.

o   Educate the employee about the risk while disposed organizational equipment

o   Using locked trash and trusted recycle bins

# data[].attributes.body
Man in The Middle is the most common interception attack. When two computers communicate with each other, but actually with another computer in the middle of communication.

An attack's purpose is to steal personal information such as user names, passwords, other account information, and credit card numbers. Users of banking apps, SaaS enterprises, e-commerce websites, etc...

How to Mitigate

o   Avoid open network Wi-Fi connection

o   Immediately log out from an application when it is not in use

o   Not using public networks

o   Paying attention to browser notification

o   Use multifactor authentication

o   Use end-to-end encryption algorithms for applications

o   Using virtual private network

o   Secure browsing plugins

# data[].attributes.body
Distributed Network Attack is a new method to recover password-protected files. When we are looking after before so many years there is limited the processing power of the user matching. DNA uses the power across the network to decrypt passwords. DNA server installed in a central location of the network. Then DNA server client can access the network.

How to Mitigate

o   Get to know about network traffic of the using network

o   Create a DOS response plan

o   Scale up your bandwidth

o   Move to the cloud

# data[].attributes.body
A replay attack is a type of network attack in which an attacker discovers and fraudulently delays or repeats a data transmission.

In other words, a replay attack is an assault on the security protocol that uses replays of data transmission from a different sender onto the intended receiving system, misleading the participants into believing the data communication was successful.

How to Mitigate

o   Use advanced digital cryptography

o   Using one-time password
o   Use third party authentication

# data[].attributes.body
Shoulder surfing is a social engineering method that involves peeking over someone's shoulder to observe what they are doing. As a shoulder surfer (with malicious purpose), it's pretty easy to stand next to someone as they fill out a form, use an ATM, or pay with a credit card in a crowded environment.

What Can Be Used For Long-Distance Shoulder Surfing?

Shoulder surfing may also be done from a distance using binoculars or other vision-enhancing gear.

Example for Shoulder Surfing

·       When a coworker sits next to an employee while they converse on the phone about confidential business, a coworker can listen to the employee's call and take notes.

·       Furthermore, if a person uses a public Wi-Fi network without utilizing a VPN, hackers can intercept important information.

How to Mitigate

o   Install a privacy filter

o   Maintain the awareness of your surrounding

o   Use a password manager

o   Protect pins

o   Avoid using public networks

# data[].attributes.body
An interception occurs when an unauthorized person has access to secret or private information. Interception attacks are assaults on the network that aim to compromise the CIA Triad's secrecy.

How to Mitigate

o   Use authorization and authentication mechanisms

o   Use Firewalls

o   Use Digital Signatures

# data[].attributes.body
A dictionary attack is a method of breaking a network or a password protected computer by using words in a dictionary as a password. It can be used when asymmetric cryptography (encrypt/ decrypt) is done. This risk was created because personal users and businesses use ordinary words as passwords. These attacks usually fail due to the password policy being much updated.

How to Mitigate

o   Allow only three password attempts

o   Require a period of 5 – 15 minutes to re-attempt

o   Use meaningless letters, numbers and symbols

o   Use multi-factor authentication in user account

# data[].attributes.body
The system and network administrators monitor and troubleshoot network traffic using sniffers. Attackers use sniffers to capture data packets containing sensitive information such as user accounts etc. Sniffers can be software or hardware installed in a system. There are two types of sniffing. There are,

o Active Sniffing   - A switch is a p2p device
o Passive Sniffing  - Attackers use MAC address to read

How to Mitigate

o Avoid unsecured networks
o Encrypt messages with a VPN
o Network Scanning and Monitoring

# data[].attributes.body
A brute force attack is a type of trial-and-error tuning technique. It has been guessed every possibility to encryption keys from rainbow pages or find hidden web pages. In the brute force, the attack uses excessive forceful attempts and tries to force it is way into the private accounts. This is a very old attack method but it is very popular with hackers because it is very complicated and takes passwords from one second to many years very quickly.

How to Mitigate

o   Use encrypting and hashing algorithms

o   Enable two-factor authentication

o   Limiting failing login attempts

o   Implementing CAPTCHAS

o   Increase password complexity

o   Implement proactive threat hunting methods

o   Implement IT hygiene setup and updated security policies

# data[].attributes.body
The rule-based attack is one of the more difficult attack styles. The rule-based approach is similar to a computer language developed to generate password candidates. It has so many functions to extend, cut and modify words and has conditional operators to skip some, etc. That makes it the most accurate, flexible and efficient attack.

# data[].attributes.body
A dictionary attack is a method of breaking a network or a password protected computer by using words in a dictionary as a password. It can be used when asymmetric cryptography (encrypt/ decrypt) is done. This risk was created because personal users and businesses use ordinary words as passwords. These attacks usually fail due to the password policy being much updated.

How to Mitigate

o   Allow only three password attempts

o   Require a period of 5 – 15 minutes to re-attempt

o   Use meaningless letters, numbers and symbols

o   Use multi-factor authentication in user account