Social engineering. Almost one-third of security breaches in 2020 incorporated social engineering techniques. These include phishing (posing in an email or phone call as a legitimate institution to get personal details and passwords; scareware (manipulating users into believing they need to download malware), and quid pro quo (calling random people and pretending they are tech support int order to get access to the victims’ computers). At the core of all of these techniques is a manipulation of human psychology.
2. Ransomware. This is a program that encrypts data and then demands payment for its release. Ransomware is one of the most popular kinds of malware used for data breaches.
3. DDoS attacks. A distributed denial-of-service attack occurs when a system’s bandwidth or resources are flooded, causing a disruption in service. While the computers are down, hackers employ those that were previously compromised by malware to perform criminal activity. Criminals have also begun to employ AI (artificial intelligence) to perform DDoS attacks. Recent dependence on digital services and increased online traffic has created more vulnerability than ever.
4. Third-party software. If a program that was developed by a company other than the original developer is compromised, this opens a gateway for hackers to gain access to other domains. As many as 80% of organizations have experienced a cybersecurity breach caused by a vulnerability from one of their third-party vendors.
5. Cloud computing vulnerabilities. Criminals scan for cloud servers that are not password protected, exploit unpatched systems, and then perform brute-force attacks to access user accounts. Some also try to steal sensitive data, plant ransomware, or use the cloud systems for coordinated DDoS attacks or cryptojacking (mining cryptocurrency from victims’ accounts).