9Attack techniques

Security attacks can be characterized as the different sorts of systematic activities aimed at decreasing or corrupting the security. From this perspective, an attack can be defined as a systematic threat generated by an entity in an artificial, deliberate and intelligent way. Computer networks may be vulnerable to many threats along many avenues of attack, including:

- Social engineering, wherein someone tries to gain access through social means (pretending to be a legitimate system user or administrator, tricking people into revealing secrets, etc.)
- War dialing, wherein someone uses computer software and a modem to search for desktop computers equipped with modems that answer, providing a potential path into a corporate network.
- Denial-of-service attacks, including all types of attacks intended to overwhelm a computer or a network in such a way that legitimate users of the computer or network cannot use it.
- Protocol-based attacks, which take advantage of known (or unknown) weaknesses in network services.
- Host attacks, which attack vulnerabilities in certain computer operating systems or in how the system is set up and administered.
- Password guessing; passwords are sequences of symbols, usually associated with a user name, which provide a mechanism for identification and authentication of a particular user. On almost all machines, the users themselves choose the passwords. This places the burden of security on end users who either do not know, or, sometimes do not care about sound security practices. As a general rule, passwords that are simple to remember, are, likewise, easy to guess. Attackers have several venues of guessing passwords and overcoming this obstacle.
- Eavesdropping of all sorts, including stealing e-mail messages, files, passwords, and other information over a network connection by listening in on the connection.

Security attacks may be divided into these two main categories:

- Passive attacks
- Active attacks