Every organization is susceptible to cyberthreats from inside and outside their organizations. These threats can be intentional, as with cybercriminals, or unintentional, as with employees or contractors who accidentally click malicious links or download malware. 

IT security aims to address this wide range of security risks and account for all types of threat actors and their varying motivations, tactics and skill levels.

Malware is malicious software that can render infected systems inoperable, destroying data, stealing information and even wiping files critical to the operating system. 

Well-known types of malware include: 

• Ransomware is malware that locks a victim’s data or device and threatens to keep it locked—or worse—unless the victim pays a ransom to the attacker. According to the IBM Security X-Force Threat Intelligence Index 2023, ransomware attacks represented 17 percent of all cyberattacks in 2022.
   

• A Trojan horse is malware that tricks people into downloading it by disguising itself as a useful program or hiding within legitimate software. A remote access Trojan (RAT) creates a secret backdoor on the victim’s device, while a dropper Trojan installs additional malware once it has a foothold.
   

• Spyware secretly gathers sensitive information, such as usernames, passwords, credit card numbers and other personal data, and transmits it back to the hacker.
   

• A worm is self-replicating malware that can automatically spread between apps and devices.

Frequently referred to as "human hacking," social engineering manipulates victims into taking actions that expose sensitive information, compromise their organization’s security, or threaten their organization's financial well-being.

Phishing is the best-known and most pervasive type of social engineering attack. Phishing attacks use fraudulent emails, text messages or phone calls to trick people. These attacks aim to get people to share personal data or access credentials, download malware, send money to cybercriminals, or take other actions that might expose them to cybercrimes. Special types of phishing include: 

• Spear phishing—highly targeted phishing attacks that manipulate a specific individual, often using details from the victim’s public social media profiles to make the ruse more convincing.
   

• Whale phishing—spear phishing that targets corporate executives or wealthy individuals.
   

• Business email compromise (BEC)—scams in which cybercriminals pose as executives, vendors or trusted business associates to trick victims into wiring money or sharing sensitive data.

Another social engineering tactic, tailgating, is less technical but no less a threat to IT security: it involves following (or ‘tailing’) an individual with physical access to a data center (say, someone with an ID card) and literally sneaking in behind them before the door closes.

A DoS attack overwhelms a website, application or system with volumes of fraudulent traffic, rendering it too slow to use or altogether unavailable to legitimate users. A distributed denial-of-service (DDoS) attack uses a network of internet-connected, malware-infected devices—called a botnet—to cripple or crash the target application or system. 

A zero-day exploit takes advantage of an unknown or as-yet-unaddressed security flaw in computer software, hardware or firmware. ‘Zero day’ refers to the fact that the software or device vendor has zero days, or no time, to fix the flaw, because malicious actors can already use it to gain access to vulnerable systems.

Insider threats originate from employees, partners and other users with authorized access to the network. Whether unintentional (for example, a third-party vendor tricked into launching malware) or malicious (for example, a disgruntled employee bent on revenge), insider threats have teeth. A recent report from Verizon (link resides outside ibm.com) reveals that while the average external threat compromises around 200 million records, threats involving an inside threat actor have exposed as many as 1 billion records.

In an MITM attack, a cybercriminal eavesdrops on a network connection and intercepts and relays messages between two parties to steal data. Unsecured wifi networks are happy hunting grounds for hackers launching MITM attacks.

As cybersecurity threats continue to escalate in ferocity and complexity, organizations are deploying IT security strategies that combine a range of security systems, programs and technologies. 

Overseen by experienced security teams, these IT security practices and technologies can help protect an organization’s entire IT infrastructure, and avoid or mitigate the impact of known and unknown cyberthreats.

Because many cyberattacks, such as phishing attacks, exploit human vulnerabilities, employee training has become an important line of defense against insider threats.

Security awareness training teaches employees to recognize security threats and use secure workplace habits. Topics covered often include phishing awareness, password security, the importance of running regular software updates, and privacy issues, like how to protect customer data and other sensitive information.

Multi-factor authentication requires one or more credentials in addition to a username and password. Implementing multi-factor authentication can prevent a hacker from gaining access to applications or data on the network. This authentication works even if the hacker is able to steal or obtain a legitimate user's username and password.

Multi-factor authentication is critical for organizations that use single sign-on systems. These systems enable users to log in to a session once and access multiple related applications and services during that session without logging in again.

Incident response, sometimes called cybersecurity incident response, refers to an organization’s processes and technologies for detecting and responding to cyberthreats, security breaches and cyberattacks. The goal of incident response is to prevent cyberattacks before they happen, and to minimize the cost and business disruption resulting from any cyberattacks that occur.

Many organizations create a formal incident response plan (IRP) that defines the processes and security software they use to identify, contain and resolve to different types of cyberattacks. According to the Cost of a Data Breach 2003 report, at organizations that create and regularly test a formal IRP the cost of a data breach was USD 232,008 less than the average (USD 4.45 million).

No single security tool can prevent cyberattacks altogether. Still, several tools can play a role in mitigating cyber risks, preventing cyberattacks and minimizing damage when an attack occurs. 

Common security software to help detect and divert cyberattacks include: 

• Email security tools, including AI-based anti-phishing software, spam filters and secure email gateways

• Antivirus software to neutralize spyware or malware attackers might use to target network security to conduct research, eavesdrop on conversations, or takeover email accounts

• System and software patches to close technical vulnerabilities commonly exploited by hackers

• Secure web gateways and other web filtering tools to block malicious websites often linked to phishing emails

• Threat detection and response solutions use analytics, artificial intelligence (AI) and automation to help security teams detect known threats and suspicious activity. They enable security teams to take action to eliminate the threat or minimize its impact. These technologies include security orchestration, automation and response (SOAR), security incident and event management (SIEM), endpoint detection and response (EDR), network detection and response (NDR), and extended detection and response (XDR).

• Offensive security, or “OffSec,” refers to a range of proactive security strategies that use adversarial tactics—the same tactics malicious actors use in real-world attacks—to strengthen network security rather than compromise it.

Offensive security operations are often carried out by ethical hackers, cybersecurity professionals who use their hacking skills to find and fix IT system flaws. Common offensive security methods include:

• Vulnerability scanning—using the same tools that cybercriminals use to detect and identify exploitable security flaws and weaknesses in an organization’s IT infrastructure and applications.

• Penetration testing—launching a mock cyberattack to uncover vulnerabilities and weaknesses in computer systems, response workflows and users' security awareness. Some data privacy regulations, such as the Payment Card Industry Data Security Standard (PCI-DSS), specify regular penetration texting as a requirement for compliance.
   

• Red teaming—authorizing a team of ethical hackers to launch a simulated, goal-oriented cyberattack on the organization.

Offensive security complements security software and other defensive security measures—it discovers unknown cyberattack avenues, or vectors, that other security measures might miss. And it yields information security teams can use to make their defensive security measures stronger.