A survey by FortiGuard, a cyber intelligence service, found that 15 billion cyber attacks occurred in Brazil in a period of just three months, between March and June 2019.
That's why it's so important that you understand the types of attacks that information security can defend against, thus avoiding damage to your system, your personal security, and your company's reputation.
Below, we list five types of attacks and how you can prevent and defend against them with information security routines. This is a war between society and cybercrime with no end in sight.
These recommendations aren't limited to the corporate environment, but also apply to all users of devices, websites, systems, and applications—anyone who has something to lose if their defenses against criminal attacks fail.
Shall we go ahead?
Legend has it that a vampire only enters your home if invited. The question is whether you know the person knocking at your door is a vampire.
This is the dilemma when it comes to Phishing, a type of attack characterized by deception. The attacker poses as someone trustworthy, which could be a company of which the victim is a customer.
In the case of companies, inattentive employees may end up passing on access data to malicious attackers posing as support staff.
The attack can be carried out by sending fake links via email or exchanging messages.
After gaining access to the system, the attacker steals the user's or company's confidential data, which can lead to financial or competitive losses.
To protect yourself from phishing, educating users is the best measure. A few simple precautions will help protect your system against this type of attack, such as:
A backdoor is a type of Trojan horse that infects your system. A backdoor can take many forms, including software that creates entry points for malware, code hidden in software, and misconfigured remote administration systems.
In this type of invasion, your system is accessed and controlled by the attacker, who modifies, deletes and opens files, installs malicious software, runs programs and sends emails.
To prevent backdoor intrusion, your company needs to be equipped with a well-configured firewall on the network and devices, capable of monitoring user traffic and managing access.
In cases where malicious code can be sent via email or links, antivirus software is able to detect the threat and neutralize it.
Also use an intrusion prevention system, which allows you to monitor suspected malicious activity by authorized users.
These Trojans reach our systems through software and hardware. Therefore, it's a good idea to buy only from reputable manufacturers. The same caution should be taken when using open-source services.
The spoofing process is very similar to phishing. The difference is that the attacker accesses the operating system to steal the user's identity (IP), thus impersonating someone else.
Unlike phishing, which is a social engineering maneuver, spoofing is a technique used for forgery.
One of the purposes of spoofing is modifying the victim's DNS to legitimize the redirection of a domain to another IP, in order to obtain confidential information to undertake criminal actions.
To protect yourself from this type of attack, you should adopt routines very similar to those we recommend to protect yourself from phishing attacks, such as using a password manager, not opening attachments with strange file extensions that you weren't expecting, and not clicking on suspicious links received by email.
When you receive a suspicious request for personal or banking information, you should call the supposedly sending company to check the authenticity of the request.
Finally, if you identify a spoofing threat, report it to the spoofed sender so they can take action.
A DoS attack, unlike those previously mentioned, isn't intended to steal data or commit fraud. It's an attack on the system itself, attempting to paralyze it.
This cybercriminal's cyberattacks send a large volume of packet requests to the victim, overwhelming the computer or server. The goal is to cause the system to crash while attempting to respond to the requests.
In the case of more robust systems, the technique used is DDoS, in which the criminal shares requests among several machines to cause the system to collapse.
The main way to protect yourself is to invest in bandwidth to have defense capacity in case of an overload of traffic requests.
The other is to have backup connections for critical users to provide alternative paths in the event of an attack.
You can, to improve your protection, install an intrusion detection program, capable of, among other features, intercepting requests directed to your pages and networks.
Even more sophisticated are remote DDoS protection systems, which hide your real IP address and redirect traffic through a mitigation network. Some are even cloud-based.
The term is associated with espionage. The attacker accesses your system to violate your confidentiality.
After the invasion, it installs itself and begins to intercept and store your information for later fraudulent or criminal use.
Defense against eavesdropping attacks includes cryptographic key exchange, use of one-time passwords or encrypted authentication to prevent password snooping, and the use of strong encryption during the data transmission process.
Now that you've learned a little more about these five most common types of cyberattacks to protect yourself against, put these routines into practice, especially those involved in protecting customer data.
It's worth remembering that the General Data Protection Law (LGPD) comes into effect in August 2020. Failure to properly manage customer and user data may subject violators to administrative and legal sanctions.
See the ISO 27001 guide for compliance with the LGPD (Brazilian General Data Protection Law).
If you're a business owner or manager, educate your employees about their role in data protection and cyberattack prevention. Train them, as the first barrier against such criminals is their level of awareness and preparedness.
ProMove produces customized programs for awareness, training, and implementation of Information Security and LGPD (Brazilian General Data Protection Law) practices. If you need to transform your team into one that understands the importance of security, contact us!
CMMI AIM (Artificial Intelligence Maturity) is the framework for...
On March 11, 2026, Vasilios Syrakis received the email that many senior engineers have received: eight years at Atlassian, infrastructure...
Be the first to comment!