An information
security incident can be intentional or accidental (for example, due to human
error or natural phenomenon) and can be caused by both technical and
non-technical means. The consequences can be events such as the unauthorized
disclosure or modification of information, its destruction or other events that
make it inaccessible, or the damage or theft of the organization's assets.
Information security incidents that have not been reported but have been
identified as such cannot be investigated, nor can protective measures be applied
to prevent their recurrence.
Denial of service
The denial of service is a broad category of incidents of
information security that have one thing in common. These information security
incidents result in the inability of systems, services or networks to continue
operating at their previous performance, most often with a total denial of
access to authorized users.
The incidents of information security - related denial of
service created by technical means are of two basic types: resource destruction
and resource depletion.
Common examples of these types of intentional technical
information security denial of service incidents include the following:
• Scan network broadcast addresses to completely fill
network bandwidth with reply message traffic.
• Sending data in an unwanted format to a system, service,
or network in an attempt to disrupt or disrupt its normal operation.
• Simultaneously opening multiple sessions with a particular
system, service, or network to try to exhaust its resources (that is, slow them
down, block them, or interrupt them).
In some cases, technical information security
denial-of-service incidents may occur accidentally, as a result of an operator
misconfiguration or application software incompatibility, while others may be
intentional.
Sometimes technical information security denial of service
incidents are deliberately initiated to disrupt systems, services, and network
performance, while others are simply by-products of other malicious activities.
In this sense, some of the more common covert scanning and identification techniques
can lead to the complete destruction of legacy or misconfigured systems or
services when scanned.
Note that many deliberate denial-of-service technical
incidents are often initiated anonymously (i.e. the source of the attack is
unknown) because the attacker often does not have information about the
attacked network or system.
Factors causing denial of service incidents
The incidents of denial of service security of information
created by non - technical means and cause loss of information, service and /
or processing devices information may be caused by the following factors:
• Violations of physical security that result in theft,
intentional damage, or destruction of equipment.
• Accidental damage to hardware and / or location due to
fire or flood.
• Extreme environmental conditions, such as high
temperatures (caused by an air conditioning failure).
• System malfunction or overload.
• Uncontrolled changes in the system.
• Software or hardware malfunction.
Information gathering
Broadly speaking, information gathering information security
incidents involve activities related to identifying potential attack targets
and obtaining information about services running on identified attack targets.
These information security incidents involve reconnaissance to establish:
• The existence of the target, obtaining information about
the topology of the surrounding network and with whom the target is usually
associated when sharing information;
• Possible vulnerabilities on the target or in its immediate
network environment that could be exploited.
Among the most common examples of attacks aimed at gathering
information by technical means are the following:
• Reset the DNS (domain name system) records for the
destination Internet domain (DNS zone transfer).
• Send test requests to random network addresses to find
working systems.
• Scan the system to identify (for example, by file
checksum) the host's operating system.
• Scan available network ports for file transfer protocols
to the system to identify relevant services (eg, email, FTP, network, etc.) and
software versions for those services.
• Scan one or more services with known vulnerabilities in a
range of network addresses (horizontal scan).
Sometimes the collection of technical information extends to
unauthorized access if, for example, an attacker tries to gain unauthorized
access while looking for a vulnerability. Typically, this is done by automated
hacking tools that not only look for vulnerability, but also automatically
attempt to exploit vulnerable systems, services, and / or networks.
Factors that cause incidents in the collection of information
Information collection incidents created by non-technical
means result in:
• Direct or indirect disclosure or modification of
information.
• Theft of electronically stored intellectual property.
• Non-compliance with the obligation to render accounts, for
example, in the register of accounts.
• Misuse of information systems (for example, in violation
of the law or the organization's policy).
Incidents can be caused by the following factors:
• Physical security breaches that result in unauthorized
access to information and theft of important data storage devices , such as
encryption keys.
• Failures and / or misconfiguration of operating systems
due to uncontrolled changes in the system, or software or hardware failures
that give rise to unauthorized access to information by the organization's
staff or people outside of it.
Unauthorized access
The unauthorized access type incident includes incidents not
included in the first two types. These types of incidents mainly consist of
unauthorized attempts to access the system or misuse the system, service or
network. In this sense, some examples of unauthorized access through technical
means are:
• Attempt to recover files with password.
• Buffer overflow attacks to gain privileged access (for
example, at the system administrator level) to the network.
• Exploiting protocol vulnerabilities to intercept
connections or falsely route legitimate network connections.
• Trying to extend privileges to resources or information
beyond those of a legitimate user or administrator.
Factors causing unauthorized access incidents
The incidents of unauthorized access created by non -
technical means which lead to direct disclosure or indirectly, or modification
of information, the violation of responsibility or misuse of information
systems can be caused by the following:
• Destruction of physical protection devices with subsequent
unauthorized access to information.
• Operating system failure and / or misconfiguration due to
uncontrolled system changes or improper software or hardware performance.
