Understanding SQL Injection, Insider Attacks, and Malware Threats for Enhanced Cybersecurity

In this report we will discuss about SQL injection and below are the summaries point:- SQL injection: Attackers exploit innocent database queries to insert malicious code, leading to data theft or manipulation. Insider attacks: Perpetrated by current/former employees or vendors with access to confidential data, compromising organizational security. Malware threats: Trick users into downloading intrusive software, such as Trojan viruses, fileless malware, spyware, and worms.

SQL injection common method used by attackers to gain an unauthorized access to databases, by adding
innocent database queries that in reality are malicious codes used for either stealing or manipulating
with data.
By adding special characters to a user input the SQL codes are manipulated, thus changing the context
of the query, so instead of processing user input the databases start to process malicious code
advancing the attackers goals. Leak of customer data, intellectual property or attacker gaining an
administrative access to a database are the outcomes of SQL injections.
Insider attack
This attack usually originates from within the organization either by a former, current employee or
anyone related to the company, like vendors having an access to the confidential data of the company.
This might be intentional or unintentional, but results in compromising the confidential data of the
organization.
Three kinds of insider attackers are present:
1. Non-malicious attacker: these are attacks caused due to negligence of the security
procedures by the users.
2. Malicious attackers: these are the people who intentionally attempt to steal data of the
organization for personal gain.
3. Compromised attackers: these attackers are people who are not aware of their account
being hacked. The attackers then pretend to be the legitimate user and steal or temper
with the organizations data.
This attack overwhelm the resources and stop the systems from functioning and denying access to users.
Works in combination with other cyber threats.
These attacks may launch a denial of service to capture the attention of security staff and create
confusion, while they carry out more subtle attacks aimed at stealing data or causing other damage.
Malware, being the most common type of threat, is an intrusive malicious software developed by
hackers for data theft, damage or for destroying a computer or a system.
This usually works by tricking the users into taking actions like clicking a link or opening attachments and
in some cases these malwares install themselves on the system without the user’s knowledge.
Some of the types of malware attacks are:
Trojan Virus
These viruses disguise themselves as helpful software, but once the users download them it gains access
to confidential data and either modify, block or delete them. This can be harmful to the performance of
the device, and unlike virus and worms, Trojan viruses don’t replicate themselves.
Fileless Malware

Uses legitimate programs to infect a computer. It is known as memory-resident as it operates from a
victim’s computer memory and not from the files on the device hence it leaves no footprint making it
hard to be detected and removed.
Spyware
Rather than disrupting the device operations, this malicious software manages users’ activity to obtain
confidential information. Keylogger, is a type of software that records the keystrokes to revel passwords
and personal information.
Virus and worms
Viruses works by replicating themselves from one host to another. These malicious software are either
attacked to a document or file that supports macros to execute its code and spread, in a device
disrupting its ability to operate and also causes data lost.
Worms also work by replicating themselves and spreading to any device within the network,
but they don’t need a host to do so. A worm enters the device as a downloaded file or a
network connection before replicating itself, and just like viruses this causes operational
malfunctioning and data lost.
Aup
This policy consists for constraints and practice that are to be followed by an employee using the
organizational IT assets must agree to while accessing the cooperate network or the internet. These are
standard policies signed by all employees before they are hired and given their network ID.
In addition to AUP, companies also have Information Security Policy, which are high-level policies that
cover a large number of security controls. This policy ensures that employees using the IT assets of the
organization or its network follow the stated rules and guidelines, and are aware of the consequences
that will follow if the rules are broken.
Access control policies are a set of rules and guideline that determine the physical and digital limitation
of an employee. These policies make sure that only authorized set of people can have access to critical
systems or data. These policies state methods for monitoring accessed and used systems, how
unatteneded worksatation should be secured, and how access is removed when an employee resigns,
how devices, network and applicaaitons provided by the organization are protected with mandaorty
login and that physical spaces can only be accessed by authorized people.
DMZ are designed to provide a secure network for host public facing services like web server and email
server. Hence many organization implement DMZ as they are ensured any type of security attack
occurring to these public-facing servers will not affect the internal network of the organization.
Risk assessment is one of the major components of a risk analysis. A risk assessment is a systematic
process performed by a competent person which involves identifying, analyzing, and controlling hazards
and risks present in a situation or a place. This decision-making tool aims to determine which measures

should be put in place in order to eliminate or control those risks, as well as specify which of them
should be prioritized according to the level of likeliness and impact they have on the business.
One of the key elements of a risk analysis is risk assessment. A risk assessment is a methodical
procedure carried out by a qualified individual that entails locating, evaluating, and controlling any risks
or dangers that may be present in a circumstance or location. This decision-making tool tries to identify
which actions should be taken to mitigate or control such risks and to indicate which of them should be
given priority based on their likelihood and potential effects on the company.
ISO 31000 framework utilizes the plan, do, check and act cycle. It assists in effectively managing risk
through the application of risk management process along with ensuring that the information about the
derived risk from the processes is adequately reported. Framework also ensures that this information is
used as a base for decision making and accountability at all relevant organizational levels.
Below essential elements of the framework for managing risk and the way in which they are interrelated
in an iterative manner is described.
The first part that initiates process execution is context establishment. Context, in terms of ISO 31000 is
a combination of internal and external surrounding, both viewed in relation to the organizational
objectives and strategies.
By establishing context the organization articulates its objectives, defines internal and external factors to
be taken in consideration when managing risks and sets the scope and risk criteria for the remaining
process.
The risk management methods provided by ISO 31000 can help organizations in identifying and
controlling risk related to IT systems and data. The Framework provided by ISO 31000 helps manage IT
security risks effectively. By following the standard, organizations can identify and
prioritize risks, assess risks, implement appropriate controls, continuously monitor
and improve the risk management process, and comply with applicable data
protection regulations.This can be made more effective by integrating it with other IT security
standards like ISO 27001.
Better prefomracne
Monitoring network can help organization prevent unexpected outages. Providing an insight into a
networks performance along with identifying and addressing bottlenecks, bandwidth issues and other
performance problems. Another significant aspect of network monitoring solution is to identify warning
signs that might indicate a device failure. This can enhance the network's overall effectiveness and
dependability, decreasing downtime and enhancing the user experience.

An advantage of networking monitoring is that it offers information about the overall performance of
the network, like network traffic, bandwidth being used and other factors that are performance
indicators, which assist and organization in locating and fixing problems related to the network
performance like bottlenecks or network congestion, which can have an adverse effect on user
experience. Improvement in network performance can help organizations into increasing productivity
and reduce downtime allowing IT teams to optimized performance for more efficient business
operations.
Objectives
The first step to making an effective disaster recovery plan is identifying the goals. A company should be
clear about:
Recovery Time Objectives (RTO): this is the maximum time an organization can tolerate for recovering
normal operations in case of disaster.
Recovery Point Objective(RPO): this is the maximum amount of data an organization can afford to lose.
Apart from this an organization should also be clear about where to focus first during recovery. This can
be done by mapping out the entire infrastructure to ensure all the systems are accounted for. Once this
is done organization can prioritize the list into:
Mission-critical: these are the first priority, that need to be set-up immediately to avoid massive data
loss or severe disruption to business operations.
Essential: these systems are important but can be unavailable for up to 24 hours without significant
impact to the business.
Non-essential: these applications are the lowest priority because business can rum without them for a
few days.
Be sure to consider any system dependencies in your business objectives, because they may affect how
you prioritize recovery efforts.
Hardware and software inventory
For a plan to be effective, you must have a comprehensive, up-to-date inventory of your IT assets. You
will need to do a full inventory of every piece of hardware, software, and peripheral that touches your
networks or is used by your employees, contractors, and vendors.
This will be a pretty extensive project, because you will need to account for every on-premise, cloud-
based, and mobile/BYOD tool and technology your organization uses.
Identify Personnel Roles
Organisation should have a designated disaster recovery team that is well-
acquainted with the documented recovery processes and plays a specific role in the
plan. The contact details along with each team members responsibility should be
mentioned in the disaster recovery plan.

Responsibilities of the recovery team should not only cover what do during and
post-disaster, but also, in advance of, such as:
 Ensuring more than one person knows how to perform necessary tasks, so if
something happens, there isn't the risk it won't be done properly or at all.
 Ensuring your staff know the manual way to perform certain processes (if
they exist) as software or hardware might be damaged or disrupted during a
disaster and not be available.
 Training of all staff, so they are prepared for how to act and do their jobs
safely in the event of a disaster. Especially if your organisation operates in a
high-risk environment, adequate training can significantly reduce the impact
of a crisis.
 Ongoing backups and maintenance of business continuity
systems
 Responsibility for declaring a disaster
 Responsibility for contacting third-party vendors
 Responsibility for reporting to management and liaising with
customers, press, etc.
 Responsibility for managing the crisis and recovering from it
Defined Tolerance for Downtime and Data Loss
Your critical business functions (CBFs) are the vital functions of your organization
that without which it cannot operate properly or at all.
In determining the strategies that will help your business recover from a disaster,
you must identify how long can your company tolerate for recovering normal
operations, which is known as Recovery Time Objectives and the maximum amount
of data your organization can afford to lose, which is known as Recovery Point
Objectives (RPO). Determining these objectives can help you better priorities
processes listed in your recovery plan.
Secure Backups
The quality and frequency of your backups will make or break your DR
efforts. Consider these best practices for keeping backups secure and
available if you need them in a crisis:
 Keep your backups separate and inaccessible from the main company
network. Some ransomware can pass through the network and encrypt
backup data, rendering it useless.

 Implement a 3-2-1 backup strategy; create three copies of your data,
store them on two different media, and store one of those copies off-site
or in the cloud.
 Invest in a cloud backup and DR solution that simplifies backup and
recovery by providing a central UI and the most current disaster recovery
tools and technology.
Disaster Response Procedures
A key element of a disaster recovery plan is a documented procedure for responding to a catastrophic
event. The first few hours of an event are critical, and staff should know exactly what to do to minimize
damage to organizational systems, and recover systems to resume normal operations.
A DR procedure should include clear action steps, in simple and unambiguous language, including how
to fail over to the disaster recovery site and ensure that recovery is successful.
Remote Access/ alternative workspaces
In case of natural disaster, offices may not be accessible, therefore having a plan to enable employees to
work remotely will help the business in running their normal operations.
The plan include a way all employees can quickly accesses the organizations network and be able to
communicate to vendors, customers and employees by preparing fall-back emails and phone system
solutions.
Another thing to keep in mind is to ensure that your security technologies are up to date to ensure that
your data is safely accessed from outside the firewall.
Communication plan
When disaster strikes, a company must have a clear plan for delivering essential information to affected
parties like customers, employees and other stakeholders.
The communication plan should include:
 Contact lists of those internal and external stakeholders that need to be informed.
 A protocol for what information can be communicated and how it should be conveyed,
depending on the situation.
 Also have elements like public relations (PR), communication on the company websites,
and social media should be included.
A clear communication channel helps organization, build a better relationship with the company and
stay loyal to them.
Schedule for Testing, Reviewing & Improving
An organization should dedicate time to test and rehearse the DR plan to make sure it's useful, effective
and up to business and industry standards.

Lessons learned from this drill can help organization update the DR plan to make it clearer and more
effective for all the parties involved.
The DR plan build at least should cover these three objectives:
 Testing backups to make sure data is protected and recoverable
 Testing the DR processes to make sure they work
 Testing employees to make sure they know what to do in a real
emergency
With businesses evolving and changing quickly, organization should also evolve their disaster recovery
plans.
Directly connecting web server to public and private network is usually not recommended, as it leads to
making the system vulnerable and exposing crucial information to hackers, who are always looking for
an opportunity or to anyone else who comes across the exposed data.
Data exposure or system vulnerability is one of the reasons why connecting web servers to public
network is not recommended. When web servers are
So when a web server is connected to a public network the chances of data expose is more as