# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 4 Cyber Attacks
### Attack-Mechanism and Security Events  
The classifiers of operational and informational impact have in this study previously been described as forms of direct impact within the cyber infrastructure. Based on the reports, the most common direct impact generated by an attack, looking at both operational and informational consequences, is **the disruption in access to information resources and systems**. As seen in Figure 1, cyberattacks resulting in the operational impact of denial of service have been concluded to account for 43 percent, or 109 cases in total, of the reported malicious incidents. In 17% of incident reports, the misuse of resources was reported, followed by account hijacks in 13%. Threat actors installing malware in an organisation's cyber infrastructure accounts for 11% of cyberattacks, totaling 28 cases. Website resource compromise incidents account for approximately 5% of incidents. Unknown and other comprised 6% and 5% of the reported cyberattacks. Note that the other category primarily refers to fraud cases. The main impact of these attacks is on human behaviour and economic loss. In 44 cases, or 17%, the attacker's operational impact was classified into multiple categories. Malware installation occurs in 39% of cases when a system user is compromised. Malware infection occurred in 32% of compromised user accounts. Approximately 20% of attacks resulting in a denial of service also involved other operational compromises, with the most common being the misuse of resources (11 cases). The distribution of informational impact is shown in Figure 2. One of the most common informational impacts described in incident reports is disruption in availability. Approximately half of malicious-activity-related incidents disrupt access to information resources and system functionality. In 16% of cases, disruption led to the disclosure of information, as determined by reading reports. The information was distorted in approximately 8% of cases. Figure 1: Attack-Mechanism and Security Events. Approximately 4% of cases involved mapping and discovering the structure of the targeted organisation's network and systems. Only approximately 1% of cyberattack reports describe the permanent loss of information assets, making information destruction a rare impact. This may be due to organisations implementing measures to prevent permanent information loss. In contrast to the CIA-triad, most of the observed cyberattacks compromise availability, while fewer compromise confidentiality and integrity. The IT incident reports may be biassed due to the requirement for NIS organisations to report incidents that disrupt or degrade their operations. The analysis revealed that many incidents had no significant operational or informational consequences. The analysis of reported malicious activity indicated that more than 20% of instances did not cause any operational consequences to the organisation's cyber infrastructure. Furthermore, 22% of attacks were reported to have had no impact on the organisations' data. Figure 2 illustrates the proportion of cyber-attacks that do not have a direct impact on operations or information. Approximately 15-21% of cyberattacks occurring from April 2019 to 2023 were related to IT incidents that seemed to have no effect on the targeted cyber infrastructure. According to the study's definition, in the period of April 2022-2023, only 12% of incidents were categorised as having no direct impact. The primary methods of attack exploited in cases without immediate consequences were social engineering and insufficient authentication, although they ultimately proved unsuccessful. Leveraging vulnerabilities in authentication mechanisms and cognitive biases may increase the probability of failure. The findings of this study rely on incident reports, and organisations may have an increased understanding of unsuccessful attacks using these methods. In contrast, 94% of the identified denial of service attacks, specifically 103 out of 109, have resulted in disruptions to availability.