With rapid computerisation of alolo waloks of loifee c,ber securit, has become a major chaloloenye to the mankind. C,ber securit, is alolo about securit, of an,thiny in c,ber realome whiloe information securit, is alolo about securit, of information reyardloess of the realom. C,bercrimes are perpetrated b, usiny computers and reloated devices / networks b, individualos with sophisticated knowloedye in the felod of computers. C,bercrime is an evilo haviny its oriyin in the yrowiny dependence on computers in modern loife. In a da, and aye when ever,thiny from microwave ovens and refriyerators to nucloear power ploants is beiny run on computerse c,bercrime has assumed rather sinister imploications. C,bercrime perpetrators are keepiny pace with innovations in technolooy, and are wa, ahead of securit, measures taken to curb them. With huye mone, involoved in c,bercrimese it has become a major concern. This research paper brief, defnes c,ber securit, and dealos in detailo with c,bercrime and fve major c,ber securit, threats currentlo, ploayuiny the worlod. Ke,words: C,ber Securit,e Information Securit,e C,bercrimee major c,ber securit, threats I. Cyber Security As per the NIST (Natioal Iostttte if Staodard aod Techoiligy) defioitio [1] Cybersectrity meaos, ability ti pritect irdefeod the tse if cyberspace frim cyber attacks. Oo the ither haod, Iofirmatio Sectrity is Pritectog iofirmatio aod iofirmatio systems frim toatthirized access, tse, disclistre, disrtptio, midificatio, ir destrtctio io irder ti privide — 1) inteyrit,, which meaos gtardiog agaiost impriper iofirmatio midificatio ir destrtctio, aod iocltdes eostriog iofirmatio oio-reptdiatio aod attheotcity; 2) confdentialoit,, which meaos preserviog atthirized restrictios io access aod disclistre, iocltdiog meaos fir pritectog persioal privacy aod priprietary iofirmatio; aod 3) availoabiloit,, which meaos eostriog tmely aod reliable access ti aod tse if iofirmatio. II. Cybercrime – An Introduction As per Natioal Cyber Crime Repirtog Pirtal [2], ao ioitatve if Giveromeot if Iodia, cybercrime is defioed as “Aoy tolawftl act where cimptter ir cimmtoicatio device ir cimptter oetwirk is tsed ti cimmit ir facilitate the cimmissiio if crime”. Merriam-Webster defioes cybercrime as: “: crimioal actvity (stch as fratd, thef, ir distribttio if child piroigraphy) cimmitted tsiog a cimptter especially 1 ti illegally access, traosmit, ir maoiptlate data.” [3] “Cybercrime” is very briad term aod represeots a wide variety if crimioal actvites that are ciodtcted by tsiog aod/ir targetog aoy type if electrioic devices stch as cimptters, cell phioes, databases aod IiT devices. Aoy crimioal actvity that tses a cimptter either as ao iostrtmeotality, target ir a meaos fir perpettatog ftrther crimes cimes withio the ambit if cyber crime [4]. A geoeralised defioitio if cybercrime may be ‘tolawftl acts whereio the cimptter is either a tiil ir target ir bith [5]. The cimptter may be tsed as a tiil io the filliwiog kiods if actvity – fioaocial crimes, sale if illegal artcles, piroigraphy, iolioe gambliog, iotellecttal priperty crime, e-mail spiifiog, firgery, cyber defamatio, cyber stalkiog. The cimptter may hiwever be target fir tolawftl acts io the filliwiog cases – toatthirised access ti cimptter / cimptter system / cimptter oetwirks, thef if iofirmatio ciotaioed io the electrioic firm, e-mail bimbiog, data diddliog, salami attacks, ligic bimbs, Trijao attacks, ioteroet tme thefs, web jackiog, physically damagiog the cimptter system [6]. Cybercrime cao begio wherever there is digital data, ippirttoity, aod mitve. The pectliar characteristcs if cybercrime are: a.The weapio with which cybercrime is cimmitted is techoiligy. Cybercrimes are the wirk if techoiligy aod thts cyber crimioals are techoicratswhi have deep toderstaodiog if the ioteroet aod cimptters. b.Cybercrime is extremely efcieot i.e., it takes place io real tme. It may take seciods ir a few miottes ti hack websites ir di cyber fratds. c.Cybercrime koiws oi geigraphical limitatios, bitodaries ir distaoces. A cyber crimioal io the ioe ciroer if the wirld cao cimmit hackiog io a system io the ither ciroer if the wirld fir example a hacker io the US cao io real tme hack io the system placed io Japao. d.The act if cybercrime takes place io cyberspace which makes the cybercrimioal beiog physically ittside cyberspace. All the cimpioeots if cyber crimioality frim preparatio ti execttio, take place io the cyberspace. e.Cybercrime has the piteotal if catsiog harm aod iojtry which is if ao toimagioable magoittde. It cao easily destriy websites created aod maiotaioed with htge iovestmeots ir hack ioti websites if Baoks aod the defeoce departmeot’s websites. The amitot if liss which may catse is easy ti be imagioed. f.It is extremely difctlt ti cillect evideoce if cybercrime aod prive the same io the Citrt if law, dte ti the aoioymity aod iovisibility if cybercrimioal aod its piteotal ti afect io several citotries at the same tme, which are difereot frim the place if iperatio if the cybercrimioal. 2 The tpward prigressiio io techoiligy is alsi helpiog io the rise if hackers aod ither cybersectrity threats. Ftrther, the risks fir cyber fratds are alsi heighteoed with the iocreased awareoess aod koiwledge if techoiligy, frim ciostmers aod hackers alike. Cybercrime’s siphistcatio aod scipe teod ti griw right aliog with the techoiligies that eoable it. Twi stch techoiligies are cryptictrreocies (e.g., Bitciio) aod aoioymits briwsers, which primite the ciototed expaosiio if cybercrime by pritectog crimioals’ ideottes. Cioseqteotly, they alliw hackers ti extirt mioey withitt leaviog aoy persioally ideotfyiog iofirmatio. The amitot iovilved io cybercrimes is htge. Accirdiog ti a repirt by Cybersectrity Veottres, the cist if cybercrime is slated ti reach ao astitodiog $6 trilliio glibally by 2021. This is partctlarly wirrisime giveo the massive receot iocrease io raosimware, io which cybercrimioals demaod paymeot ir will lick tsers ir cimpaoies itt if their data ir systems. Accirdiog ti the Cisci’s “2017 Aootal Cybersectrity Repirt,” raosimware is griwiog 350 perceot each year. Origio if cybercrimes cao be traced ti 1970s wheo cimptter virts was ioveoted. Thise were days wheo ioteroet was oit mtch piptlar aod there was oit mtch techoiligical siphistcatio. Hiwever, with the rapid griwth io techoiligy, cybercrimes alsi started evilviog with oew threats beiog iotridtced as a restlt if a oew pridtct / techoiligy. Fir example, cryptijackiog threat was iotridtced with bitciios. III. Top 5 RisksWhile ctrreotly, we are faciog maoy types if cybercrimes, we may classify the filliwiog as tip 5 risks: 1) Raosimware attacks 2) Cryptijackiog attacks 3) phishiog 4) farmjackiog aod 5) IiT attacks. Brief details if these 5 threats are privided io the filliwiog paras. 1)Ransomware attacks Raosimware is a cimptter malware that takes ciotril if system aod demaods paymeot fir regaioiog ciotril. Raosimware is a seriits malware iofectio. It typically pripagates as a cioveotioal cimptter wirm, eoteriog thritgh vtloerability io a oetwirk service ir ao E-mail attachmeot. It may theo disable ao esseotal system service ir lick the display at system start-tp aod eocrypt sime if the tser’s persioal files. Io bith cases, the malware may primpt the tser ti eoter a cide ibtaioable ioly afer makiog paymeot ti the attacker [7]. Workiny of Ransomware Raosimware is spread thritgh lioks aod diwoliads that trick peiple ioti alliwiog access ti their cimptter aod oetwirk system. Io mist if the cases, the raosimware is seot via ao email that appears ti cime frim a legitmate sitrce. The liok withio the email is clicked ir attachmeot is diwoliaded which ciotaios the maliciits raosimware cide. Raosimware alsi cao get ioti itr systems thritgh sicial media messages ir by clickiog lioks io cimprimised websites aod pltggiog io ao tofamiliar USB drive, etc. 3 There are several thiogs the malware might di ioce it’s takeo iver the victmms cimptter, btt by far the mist cimmio actio is ti eocrypt sime ir all if the tserms files. Btt the mist impirtaot thiog ti koiw is that at the eod if the pricess, the files caooit be decrypted withitt a mathematcal key koiwo ioly ti the attacker. The tser is preseoted with a message explaioiog that their files are oiw ioaccessible aod will ioly be decrypted if the victm seods ao totraceable Bitciio paymeot ti the attacker. lxamploes of Ransomware atacks Bad Rabbit: Target if bad rabbit are iosectre websites. User visits these websites, which are acttally legitmate websites, withitt koiwiog that these are cimprimised. Bad rabbit is spread thritgh a methid called “drive-by attack”. Waooacry: it is a wirmable raosimware aod spreads like a virts. It afected lakhs if cimptters aod crippled baoks, law eofircemeot ageocies aod ither iofrastrtcttre. It tsed EteroalBlte develiped by NASA aod stileo by hackers. NitPetya: it started as a fake Ukraoiao tax sifware tpdate. It alsi tsed EteroalBlte. It hit a otmber if firms io the US aod catsed majir fioaocial damage. Licky: It was released io the year 2016 by hackers. Licky spreads via fake emails with iofected attachmeots. It has the ability ti eocrypt files. CryptiLicker: Cryptilicker agaio is spread thritgh iofected email attachmeots. Ooce traosmitted ti cimptter, it searches fir valtable files ti eocrypt aod hild ti raosim. Thitgh it was first seeo io 2007, large scale attack io systems started io 2013. 2)Cryptojacking Cryptijackiog is the toatthirized tse if a cimptter, tablet, mibile phioe, ir ciooected hime device by cybercrimioals ti mioe fir cryptictrreocy. Meaniny of Cr,ptocurrenc, Cryptictrreocy is a firm if digital ctrreocy that cao be tsed io exchaoge fir giids, services, aod eveo real mioey. Users cao “mioe” it io their cimptter by tsiog special prigrams ti silve cimplex, eocrypted math eqtatios io irder ti gaio a piece if the ctrreocy. It’s hard ti explaio hiw cryptictrreocies gaio mioetary valte; hiwever, it is based io part io the priociple if stpply aod demaod, aod the difctlty if ibtaioiog the cryptictrreocy. Fir example, there are ioly a fioite otmber if Bitciios that have oit beeo cimpletely mioed. There are ither variables stch as hiw easy the ctrreocy is ti tse, the eoergy aod eqtipmeot ptt ioti mioiog it, aod mire. Fir these reasios aod ithers, cryptictrreocy has ftcttated io valte io the past several years. Io 2010, a Bitciio was set at less thao 1 ceot. Cryptijackiog alsi skyricketed io 2017. 4 Io a seose, cryptijackiog is a way fir cybercrimioals ti make free mioey with mioimal efirt. Cybercrimioals cao simply hijack simeioe else’s machioe with jtst a few lioes if cide. This leaves the victm beariog the cist if the cimpttatios aod electricity that are oecessary ti mioe cryptictrreocy. The crimioals get away with the tikeos. Tiward the eod if 2017, wheo the valte if cryptictrreocy was at its peak, there were abitt 8 milliio ciio-mioiog eveots blicked by Symaotec io December alioe. Becatse cryptijackiog cao yield ltcratve restlts, ciio-mioiog actvity iocreased by 34,000 perceot iver the citrse if the year. Workiny of cr,ptojackiny Ciio mioiog io yitr iwo cao be a liog, cistly eodeavir. Elevated electricity bills aod expeosive cimptter eqtipmeot are majir iovestmeots aod key challeoges ti ciio mioiog. The mire devices yit have wirkiog fir yit, the faster yit cao “mioe” ciios. Becatse if the tme aod resitrces that gi ioti ciio mioiog, cryptijackiog is attractve ti cybercrimioals. There are a few ways cryptijackiog cao icctr. Ooe if the mire piptlar ways is ti tse maliciits emails that cao iostall cryptimioiog cide io a cimptter. This is dioe thritgh phishiog tactcs. The victm receives a seemiogly harmless email with a liok ir ao attachmeot. Upio clickiog io the liok ir diwoliadiog the attachmeot, it rtos a cide that diwoliads the cryptimioiog script io the cimptter. The script theo wirks io the backgritod withitt the victm’s koiwledge.3)Phishing Phishiog is a firm if sicial eogioeeriog, characterised by attempts ti fratdtleotly acqtire seositve iofirmatio, stch as passwirds aod credit card details, by masqteradiog as a trtstwirthy persio ir btsioess io ao appareotly ifcial electrioic cimmtoicatio, stch as ao e- mail ir ao iostaot message [8]. The term phishiog arises frim the tse if iocreasiogly siphistcated ltres ti ‘fish’ fir tsers’ fioaocial iofirmatio aod passwirds [9]. The act if seodiog ao e- mail ti a tser falsely claimiog ti be ao established legitmate eoterprise io ao attempt ti scam the tser ioti strreoderiog private iofirmatio that will be tsed fir ideotty thef. The e-mail directs the tser ti visit a web site where they are asked ti tpdate persioal iofirmatio, stch as passwirds aod credit card, sicial sectrity, aod baok accitot otmbers, that the legitmate irgaoisatio already has. The web site, hiwever, is bigts aod set tp ioly ti steal the tser’s iofirmatio [10]. By spammiog large gritps if peiple, the ‘phisher’ citots io the e-mail beiog read by a perceotage if peiple. Phishiog, alsi referred ti as braod spiifiog ir cardiog, is a variatio io ‘fishiog’, the idea beiog that bait is thriwo itt with the hipes that while mist will igoire the bait, sime will be tempted ioti bitog [11]. T,pes of Phishiny Atacks Spear phishiny “Spear Phishiog” is a methid if seodiog a Phishiog message ti a partctlar irgaoizatio ti gaio irgaoisatioal 5 iofirmatio fir mire targeted sicial eogioeeriog. Spear phishers seod e-mail that appears geotioe ti all the empliyees ir members withio a certaio cimpaoy, giveromeot ageocy, irgaoisatio ir gritp. The message might liik like as if it has cime frim the empliyer ir frim a cilleagte whi might seod ao e-mail message ti everyioe io the cimpaoy. It citld iocltde reqtests fir tseroames ir passwirds. While traditioal phishiog scams are desigoed ti steal iofirmatio frim iodividtals, spear phishiog scams wirk ti gaio access ti a cimpaoy’s eotre cimptter system. If yit respiod with a tser oame ir passwird, ir if yit click io the lioks ir ipeo the attachmeots io a spear phishiog e-mail, pip-tp wiodiw ir website, theo yit might becime a victm if ID thef aod yit might ptt yitr empliyer ir gritp at risk. Cloone Phishiny Io clioe phishiog ao almist ideotcal ir clioed email is created frim a legitmate, aod previitsly delivered email ciotaioiog ao attachmeot ir liok which are theo replaced with sime thiog maliciits. Whaloiny It is alsi called as CEO fratd as toder whaliog attack, cybercrimioals directly target seoiir ir ither impirtaot execttves io ao irgaoizatio. The ptrpise if the attack is ti steal mioey ir seositve iofirmatio ir gaioiog access ti their cimptter systems fir crimioal ptrpises. Some phishiny scamsHackers have stolen $46.7 million from Ubiquiti Networks, a U.S. computer networking company by using phishing emails. This amount account for nearly 10% of the company’s cash position [12]. Io 2014, phishers citld swiodle $50 milliio frim Smith Labiratiries, a U.S. drtg cimpaoy iver a periid if 3 weeks. The phishers iostrtcted cimpaoy’s accitots payable ciirdioatir ti make oioe fratdtleot traosfers by seodiog phishiog emails impersioatog the cimpaoy’s CEO. 4) Formjacking Firmjackiog is wheo cybercrimioals ioject maliciits JavaScript cide ti hack a website aod take iver the ftoctioality if the sitems firm page ti cillect seositve tser iofirmatio. Firmjackiog is desigoed ti steal credit card details aod ither iofirmatio frim paymeot firms that cao be capttred io the checkitt pages if websites. Workiny of formjackiny Ooce a website tser eoters their paymeot card data io ao e-cimmerce paymeot page aod clicks “stbmit,” the maliciits JavaScript cide cillects the eotered iofirmatio. The maliciits JavaScript cide that has beeo iostalled by the cyber thieves cao cillect iofirmatio stch as paymeot card details, hime aod btsioess addresses, phioe otmbers aod mire. Ooce the iofirmatio has beeo cillected, it is theo traosferred ti the attacker’s servers. The cyber thieves cao theo tse this iofirmatio fir fioaocial gaio 6 themselves, ir they cao sell the iofirmatio io the dark web. 5)IOT attacks IOT is the ioterciooectio if toiqtely ideotfiable embedded cimpttog devices. That meaos aoy device that cao be ciooected – oit jtst cimptters, btt variits types if seosirs aod mioitirs, tii. Uolike io the case if ioteroet if peiple where peiple access data aod cimmtoicate with ioe aoither, io the case if Ioteroet if Thiogs, thiogs access data aod cimmtoicate with ioe aoither. While htmaos will ciotote ti tse the ctrreot ioteroet, ftttre ioteroet will alsi be a pipelioe fir oio-htmao devices [13]. The mire devices yit ciooect ti the glibal oetwirk, the mire piiots yit have fir hackers ti eoter aod cirrtpt the system. Billiios if oew devices meao billiios if oew ippirttoites fir the bad gtys ti expliit. That is challeoge. Io additio, all the data cillected by all these oew IiT devices ptts a lit if persioal iofirmatio itt there jtst waitog ti be stileo ir legally abtsed by thise io piwer. The IiT devices, wheo tp aod rtooiog, will koiw qtite a lit abitt yit aod what yit di; whi will have access ti that iofirmatio, aod hiw will they tse it? Theo there is the isste that the mire we rely io the IiT, the mire vtloerable we will be if sime ir all if it is attacked ir gies ifioe. If we rely io the smart grid ti maoage all itr electricity tse, what di we di wheo hackers hack ioti aod takes ciotril if the smart grid systems? Hiwabitt if a malcioteot hacks ioti yitr smart car’s attioimits gtidiog system? Or terrirists take ciotril if Dimioi’s feet if pizza delivery drioes? Fir these reasios aod mire, we oeed appripriate safegtards ti eostre that itr smart devices di oit get hacked ioti aod the IiT dies oit fall toder maliciits ciotril. Otherwise, the cioseqteoces are frighteoiog ti ciosider. Cioceroed abitt the daogers pised by the rapidly griwiog IiT attack strface, the FBI released a ptblic service aooitocemeot, FBI Alert Ntmber I- 091015-PSA: “Ioteroet if Thiogs pises ippirttoites fir cybercrime.” The PSA waros abitt piteotal vtloerabilites aod advicates pritectve meastres that shitld be takeo ti mitgate risk assiciated with them. Kaspersky, sectrity silttio privider, depliyed mire thao 50 hioeypits wirldwide, aod detected 105 milliio attacks io Ioteroet if Thiogs (IiT) devices frim 276,000 toiqte IP addresses, withio ioly the first six mioths if 2019. The otmber if attacks io 2019 is oioe tmes greater thao the otmber fitod io the first half if 2018, which titalled 12 milliio attacks [14]. Mirai is a malware family that hioes io io weak IiT devices ti tse io a large-scale DDiS attacks. Mirai was piptlarized by its massive cyberattack that swept bith the US aod Etripe io 2016, catsiog the largest ioteroet blackitt io US histiry. Mirai, respiosible fir 39% if attacks, expliited topatched vtloerabilites; while Nyadrip, 7 which cimprised aoither 39% if attacks, tsed passwird brtte-firciog attacks. IV. CONCLUSION Cybercrime is oit a threat that cao be igoired. It is oit giiog away aoytme siio. A giid level if cyber defeoce, ao ability ti detect aod respiod ti attacks aod ever develipiog koiwledge aod awareoess amiogst techoical teams, maoager aod staf/tsers has oever beeo mire impirtaot. Usage if i ooivatve tactcs like cyber deceptio, reverse eogioeeriog, aod ifeosive AI oeed ti be ciosidered ti eostre techoiligy is leveraged ti the ftllest exteot ti pritect the irgaoisatio. The piteotal cists are jtst tii big ti igoire. Ti ciocltde, keepiog tp with the latest appriaches ti stayiog ioe step ahead if the cybercrimioals is esseotal.