In computer

Computer

A computer is a programmable machine designed to sequentially and automatically carry out a sequence of arithmetic or logical operations. The particular sequence of operations can be changed readily, allowing the computer to solve more than one kind of problem...

and computer network

Computer network

A computer network, often simply referred to as a network, is a collection of hardware components and computers interconnected by communication channels that allow sharing of resources and information....

s an attack is any attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset.

IETF

Internet Engineering Task Force

Internet Engineering Task Force

The Internet Engineering Task Force develops and promotes Internet standards, cooperating closely with the W3C and ISO/IEC standards bodies and dealing in particular with standards of the TCP/IP and Internet protocol suite...

 defines attack in RFC 2828 as:

an assault

Assault

In law, assault is a crime causing a victim to fear violence. The term is often confused with battery, which involves physical contact. The specific meaning of assault varies between countries, but can refer to an act that causes another to apprehend immediate and personal violence, or in the more...

 on system security that derives from an intelligent threat

Threat (computer)

In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and thus cause possible harm.A threat can be either "intentional" or "accidental" In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and...

, i.e., an intelligent act that is a deliberate attempt (especially in the sense of a method or technique) to evade security service

Security service (telecommunication)

Security service is a service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers as defined by ITU-T X.800 Recommendation....

s and violate the security policy

Security policy

Security policy is a definition of what it means to be secure for a system, organization or other entity. For an organization, it addresses the constraints on behavior of its members as well as constraints imposed on adversaries by mechanisms such as doors, locks, keys and walls...

 of a system.

US Government

CNSS Instruction No. 4009 dated 26 April 2010 by Committee on National Security Systems

Committee on National Security Systems

The Committee on National Security Systems is a United States intergovernmental organization that sets policy for the security of the US security systems.-Charter, mission, and leadership:...

 of United States of America

United States

The United States of America is a federal constitutional republic comprising fifty states and a federal district...

  defines an attack as:

Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.

The increasing dependencies of modern society on information and computers networks (both in private and public sectors, including military)

has led to new terms like cyber attack and Cyberwarfare.

CNSS Instruction No. 4009 define a cyber attack as:

An attack, via cyberspace, targeting an enterprise’s use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information.

Phenomenology

An attack can be active or passive.

An "active attack" attempts to alter system resources or affect their operation.

A "passive attack" attempts to learn or make use of information from the system but does not affect system resources. (E.g., see: wiretapping

Telephone tapping

Telephone tapping is the monitoring of telephone and Internet conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitoring connection was an actual electrical tap on the telephone line...

.)

An attack can be perpetrated by an insider or from outside the organization;

An "inside attack" is an attack initiated by an entity inside the security perimeter (an "insider"), i.e., an entity that is authorized to access system resources but uses them in a way not approved by those who granted the authorization.

An "outside attack" is initiated from outside the perimeter, by an unauthorized or illegitimate user of the system (an "outsider"). In the Internet, potential outside attackers range from amateur pranksters to organized criminals, international terrorists, and hostile governments.

The term "attack" relates to some other basic security terms as shown in the following diagram:

      + - - - - - - - - - - - - +  + - - - - +  + - - - - - - - - - - -+

      | An Attack:              |  |Counter- |  | A System Resource:   |

      | i.e., A Threat Action   |  | measure |  | Target of the Attack |

      | +----------+            |  |         |  | +-----------------+  |

      | | Attacker |<
||<
                 |  |

      | |   i.e.,  |   Passive  |  |         |  | |  Vulnerability  |  |

      | | A Threat |<
>||<>                 |  |

      | |  Agent   |  or Active |  |         |  | +-------|||-------+  |

      | +----------+   Attack   |  |         |  |         VVV          |

      |                         |  |         |  | Threat Consequences  |

      + - - - - - - - - - - - - +  + - - - - +  + - - - - - - - - - - -+

A resource (both physical or logical), called an asset, can have one or more vulnerabilities

Vulnerability (computing)

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance.Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw...

 that can be exploited

Exploit (computer security)

An exploit is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic...

 by a threat

Threat (computer)

In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and thus cause possible harm.A threat can be either "intentional" or "accidental" In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and...

 agent in a threat action. The result can potentially compromises the Confidentiality

Confidentiality

Confidentiality is an ethical principle associated with several professions . In ethics, and in law and alternative forms of legal resolution such as mediation, some types of communication between a person and one of these professionals are "privileged" and may not be discussed or divulged to...

, Integrity

Integrity

Integrity is a concept of consistency of actions, values, methods, measures, principles, expectations, and outcomes. In ethics, integrity is regarded as the honesty and truthfulness or accuracy of one's actions...

 or Availability

Availability

In telecommunications and reliability theory, the term availability has the following meanings:* The degree to which a system, subsystem, or equipment is in a specified operable and committable state at the start of a mission, when the mission is called for at an unknown, i.e., a random, time...

 properties of resources (potentially different that the vulnerable one) of the organization and others involved parties (customers, suppliers).

The so called CIA triad is the basis of Information Security

Information security

Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction....

.

The attack can be active when it attempts to alter system resources or affect their operation: so it compromises Integrity or Availability. A "passive attack" attempts to learn or make use of information from the system but does not affect system resources: so it compromises Confidentiality.

A Threat is a potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm. That is, a threat is a possible danger that might exploit a vulnerability. A threat can be either "intentional" (i.e., intelligent; e.g., an individual cracker or a criminal organization) or "accidental" (e.g., the possibility of a computer malfunctioning, or the possibility of an "act of God" such as an earthquake, a fire, or a tornado).

A set of policies concerned with information security management, the Information Security Management Systems (ISMS), has been developed to manage, according to Risk management

Risk management

Risk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities...

 principles, the countermeasures

Countermeasure (computer)

In Computer Security a countermeasure is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.The definition is...

 in order to accomplish to a security strategy set up following rules and regulations applicable in a country.

An attack should led to a security incident i.e. a security event that involves a security violation. In other words, a security-relevant system event in which the system's security policy is disobeyed or otherwise breached.
The overall picture represents the risk factors

Risk factor (computing)

In Information security, Risk factor is a collectively name for circumstances affecting the likelihood or the impact of a security risk.- FAIR :...

 of the risk scenario.
An organization should make steps to detect, classify and manage security incidents. The first logical step is to set up an Incident response plan and eventually a Computer emergency response team.

In order to detect attacks, a number of countermeasures

Countermeasure (computer)

In Computer Security a countermeasure is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.The definition is...

 can be set up at organizational, procedural and technical levels. Computer emergency response team, Information technology security audit and Intrusion detection system are example of these.
Types of attacks
An attack usually is perpetrated by someone with bad intentions: Black hatted

Hacker (computer security)

In computer security and everyday language, a hacker is someone who breaks into computers and computer networks. Hackers may be motivated by a multitude of reasons, including profit, protest, or because of the challenge...

 attacks falls in this category, while other perform Penetration test

Penetration test

A penetration test, occasionally pentest, is a method of evaluating the security of a computer system or network by simulating an attack from malicious outsiders and malicious insiders...

ing on an organization information system to find out if all foreseen controls are in place.

The attacks can be classified according to their origin: i.e. if it is conducted using one or more computers: in the last case is called a distributed attack. Botnet

Botnet

A botnet is a collection of compromised computers connected to the Internet. Termed "bots," they are generally used for malicious purposes. When a computer becomes compromised, it becomes a part of a botnet...

 are used to conduct distributed attacks.


Other classifications are according to the procedures used or the type of vulnerabilities exploited: attacks can be concentrated on network mechanisms or host features.


Some attacks are physical: i.e. theft or damage of computers and other equipments. Other are logical, trying to force changes in the logic used by computers or network protocols in order to achieve unforeseen (by the original designer) result but useful for the attacker. The general term used to describe the category of software used to logically attacking computers is called malware

Malware

Malware, short for malicious software, consists of programming that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior...

.

The following is a partial short list of attacks:

• Passive
  • Network
    • wiretapping
      Telephone tapping
      Telephone tapping is the monitoring of telephone and Internet conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitoring connection was an actual electrical tap on the telephone line...
      
      
    • Port scanner
      Port scanner
      A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it.A port scan or portscan is "An attack...
      
      
    • Idle scan
      Idle scan
      The idle scan is a TCP port scan method that consists of sending spoofed packets to a computer to find out what services are available. This is accomplished by impersonating another computer called a "zombie" and observing the behavior of the zombie system.This action can be done through common...
      
      
• Active
  • Denial-of-service attack
    Denial-of-service attack
    A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer resource unavailable to its intended users...
    
    
  • Spoofing
    Spoofing attack
    In the context of network security, a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage.- Spoofing and TCP/IP :...
    
    
  • Network
    • Man in the middle
      Man-in-the-middle attack
      In cryptography, the man-in-the-middle attack , bucket-brigade attack, or sometimes Janus attack, is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other...
      
      
    • ARP poisoning
    • Ping flood
      Ping flood
      A ping flood is a simple denial-of-service attack where the attacker/s overwhelms the victim with ICMP Echo Request packets. It is most successful if the attacker has more bandwidth than the victim...
      
      
    • Ping of death
      Ping of death
      A ping of death is a type of attack on a computer that involves sending a malformed or otherwise malicious ping to a computer. A ping is normally 32 bytes in size ; historically, many computer systems could not handle a ping packet larger than the maximum IPv4 packet size, which is 65,535 bytes...
      
      
    • Smurf attack
      Smurf attack
      The Smurf attack is a way of generating significant computer network traffic on a victim network. This is a type of denial-of-service attack that floods a target system via spoofed broadcast ping messages....
      
      
  • Host
    • Buffer overflow
      Buffer overflow
      In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory. This is a special case of violation of memory safety....
      
      
    • Heap overflow
      Heap overflow
      A heap overflow is a type of buffer overflow that occurs in the heap data area. Heap overflows are exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically allocated by the application at run-time and typically contains program data...
      
      
    • Format string attack
      Format string attack
      Uncontrolled format string is a type of software vulnerability, discovered around 1999, that can be used in security exploits. Previously thought harmless, format string exploits can be used to crash a program or to execute harmful code...
      
      

Consequence of a potential attack
A whole industry is working trying to minimize the likelihood and the consequence of an information attack.

For a partial list look at :Category:Computer security software companies

They offer different products and services, aimed at:

• study all possible attacks category
• publish books and articles about the subject
• discovering vulnerabilities
• evaluating the risks
• fixing vulnerabilities
• invent, design and deploy countermeasures
• set up contingency plan
  Contingency plan
  A contingency plan is a plan devised for an exceptional risk which is impractical or impossible to avoid. Contingency plans are often devised by governments or businesses who want to be prepared for events which, while highly unlikely, may have catastrophic effects. For example, suppose many...
  
   in order to be ready to respond

Many organization are trying to classify vulnerability and their consequence: the most famous vulnerability database is the Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures

The Common Vulnerabilities and Exposures or CVE system provides a reference-method for publicly-known information-security vulnerabilities and exposures. MITRE Corporation maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland...

The Computer emergency response teams were set up by government and large organization to handle computer security incidents.
See also

• Asset (computing)
• Common Vulnerabilities and Exposures
  Common Vulnerabilities and Exposures
  The Common Vulnerabilities and Exposures or CVE system provides a reference-method for publicly-known information-security vulnerabilities and exposures. MITRE Corporation maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland...
  
  
• Computer emergency response team
• Computer insecurity
  Computer insecurity
  Computer insecurity refers to the concept that a computer system is always vulnerable to attack, and that this fact creates a constant battle between those looking to improve security, and those looking to circumvent security.-Security and systems design:...
  
  
• Computer security
  Computer security
  Computer security is a branch of computer technology known as information security as applied to computers and networks. The objective of computer security includes protection of information and property from theft, corruption, or natural disaster, while allowing the information and property to...
  
  
• Contingency plan
  Contingency plan
  A contingency plan is a plan devised for an exceptional risk which is impractical or impossible to avoid. Contingency plans are often devised by governments or businesses who want to be prepared for events which, while highly unlikely, may have catastrophic effects. For example, suppose many...
  
  
• Countermeasure (computer)
  Countermeasure (computer)
  In Computer Security a countermeasure is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.The definition is...
  
  
• Exploit (computer security)
  Exploit (computer security)
  An exploit is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic...
  
  
• Factor Analysis of Information Risk
  Factor Analysis of Information Risk
  Factor analysis of information risk is a taxonomy of the factors that contribute to risk and how they affect each other. It is primarily concerned with establishing accurate probabilities for the frequency and magnitude of loss events...
  
  
• Hacking: The Art of Exploitation Second Edition
  Hacking: The Art of Exploitation Second Edition
  -Author and background information:This book is written by Jon Erickson and was published in 2008. Jon Erickson is a computer security expert, with a background in computer science. He currently works as a vulnerability researcher and computer security specialist in California. He also wrote...
  
  
• Internet Engineering Task Force
  Internet Engineering Task Force
  The Internet Engineering Task Force develops and promotes Internet standards, cooperating closely with the W3C and ISO/IEC standards bodies and dealing in particular with standards of the TCP/IP and Internet protocol suite...
  
  
• Information technology security audit
• Information Security
  Information security
  Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction....
  
  
• Intrusion detection system
• ISMS
• IT risk
  IT risk
  Information technology risk, or IT risk, IT-related risk, is a risk related to information technology. This relatively new term due to an increasing awareness that information security is simply one facet of a multitude of risks that are relevant to IT and the real world processes it...
  
  
• Metasploit
• Month of Bugs
  Month of Bugs
  Month of Bugs is an increasingly popular strategy used by security researchers to draw attention to the lax security procedures of commercial software corporations. The tenet is these corporations have shown themselves to be unresponsive and uncooperative to security alerts and that "responsible...
  
  
• National Information Assurance Glossary
  National Information Assurance Glossary
  Committee on National Security Systems Instruction No. 4009, National Information Assurance Glossary, published by the United States federal government, is an unclassified glossary of Information security terms intended to provide a common vocabulary for discussing Information Assurance...
  
  
• Penetration test
  Penetration test
  A penetration test, occasionally pentest, is a method of evaluating the security of a computer system or network by simulating an attack from malicious outsiders and malicious insiders...
  
  
• Risk factor
  Risk factor (computing)
  In Information security, Risk factor is a collectively name for circumstances affecting the likelihood or the impact of a security risk.- FAIR :...
  
  
• Security control
  Security controls
  Security controls are safeguards or countermeasures to avoid, counteract or minimize security risks.To help review or design security controls, they can be classified by several criteria, for example according to the time that they act, relative to a security incident:*Before the event, preventive...
  
  
• Security service (telecommunication)
  Security service (telecommunication)
  Security service is a service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers as defined by ITU-T X.800 Recommendation....
  
  
• Threat
  Threat (computer)
  In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and thus cause possible harm.A threat can be either "intentional" or "accidental" In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and...
  
  
• Vulnerability
  Vulnerability (computing)
  In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance.Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw...
  
  
• Vulnerability management
  Vulnerability management
  "Vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities" This practice generally refers to software vulnerabilities in computing systems.- Vulnerability Management Programs :...
  
  
• w3af
  W3af
  w3af is an open-source web application security scanner. The project provides a vulnerability scanner and exploitation tool for Web applications...
  
  

External links

• Term in FISMApedia