Practical Cyber Security:
Attacks, Tools, Monitoring, Defence

In day-to-day IT you do not win with buzzwords; you win with basics done well, repeatable, and measured. In a day-to-day you don’t get all these, but in 30 years of IT, you will experience most of them.
This post is the simple map when thinking about CyberSecurity, threats, testing, monitoring, and defence.

Attack types – short definitions

• Backdoor Trojan – malicious access planted for later entry. First fix: rebuild and rotate credentials, close egress, hunt for persistence.

• Birthday attack – collision trick against hashes. Fix: modern hashing (SHA-256+), signed artefacts.

• Brute force attacks – trial of many passwords/keys. Fix: MFA, lockouts, throttling.

• Business Email Compromise (BEC) – social engineering to move money. Fix: payment verification out-of-band, DMARC, impersonation protection.

• Code injection – untrusted input executed as code. Fix: input validation, parameterised queries, WAF rules.

• Cross-site scripting (XSS) – hostile script in the browser. Fix: output encoding, CSP, WAF, secure frameworks.

• Cryptojacking – your compute mined for crypto. Fix: EDR, block unknown outbound, monitor CPU spikes.

• Distributed Denial of Service (DDoS) – overwhelm services. Fix: edge DDoS protection (Cloudflare), autoscale, rate limits.

• DNS spoofing – fake DNS answers. Fix: DNSSEC, trusted resolvers, TLS everywhere.

• DNS tunnelling – data hidden in DNS queries. Fix: block unusual DNS, inspect, alert on entropy.

• Drive-by attacks / downloads – silent infection from a page. Fix: patch browsers, script controls, EDR.

• Eavesdropping – sniffing traffic. Fix: TLS 1.2+, HSTS, network segmentation.

• Identity-based attacks – abusing accounts/tokens. Fix: conditional access, MFA, least privilege, short-lived tokens.

• Insider threats – malicious or careless insiders. Fix: logging, DLP, approvals, separation of duties.

• IoT attacks – weak devices at the edge. Fix: isolate VLANs, change defaults, patch or replace.

• Malware – any hostile software. Fix: EDR + allow-listing + patching cadence.

• Man-in-the-Middle (MitM) – intercept/alter traffic. Fix: TLS, certificate pinning, secure Wi-Fi.

• Password attacks – guessing/reuse/dumps. Fix: MFA, SSO, password managers, breach matching.

• Phishing – broad fraud emails. Fix: secure email gateway, user training, report button.

• Ransomware – encrypt and extort. Fix: EDR, immutable backups, tested restores, least privilege.

• Session hijacking – steal cookies/tokens. Fix: secure cookies, token binding, short expiry, re-auth.

• Spear-phishing – targeted phishing. Fix: VIP protection, domain monitoring.

• Spoofing -pretending to be someone/something. Fix: SPF, DKIM, DMARC, display name defence.

• SAML-related attacks (your list had “SaL!”, assuming SAML) – token forgery/relay. Fix: strict audience/issuer, signed/encrypted assertions.

• SQL Injection – untrusted input in SQL. Fix: parameterised queries, ORM, WAF.

• Supply-chain attacks – compromise via third parties. Fix: SBOM, signed builds, least-privileged integrations.

• Trojan horses – malware disguised as legit. Fix: allow-listing, user education, EDR.

• URL manipulation / interpretation – tamper query/paths. Fix: server-side checks, deny-by-default routing.

• Web attacks (general) – file upload abuse, auth bypass, logic flaws. Fix: secure coding, WAF, threat modelling.

• Whaling – phishing aimed at execs. Fix: exec training, VIP mail rules.

• Zero-day exploits – unknown vulns used now. Fix: hardening, exploit mitigations, virtual patching/WAF.