Types of Attacks on Computer Networks: A Complete Threat Taxonomy

A cyber attack is any deliberate attempt to compromise the confidentiality, integrity, or availability of a computer system or the information stored on it. The three properties together form what security professionals call the CIA triad, and almost every attack pattern that has been catalogued in fifty years of network security maps onto one of those three goals. Some attacks read data they should not see. Some change data without permission. Some make systems unusable. The technical mechanisms vary, but the ends are limited.

The threat surface has grown alongside the network. A standalone mainframe in 1970 could be attacked only by someone with physical access. A connected enterprise in 2026 is exposed to anyone with a laptop and a modest budget for tools that can be rented by the hour from criminal marketplaces. India’s Indian Computer Emergency Response Team, CERT-In, logs over a million incidents a year, and that count understates the real number because most small and medium organisations never report.

For UPSC, the topic is squarely in cyber security under GS-III, and intersects internal security, the IT Act 2000, and the Digital Personal Data Protection Act 2023. This article maps the major families of cyber attack, walks through the most important examples in each category, surveys the defensive frameworks and Indian institutional response, and outlines what individuals and organisations can do to reduce risk.

The CIA Triad and the Logic of Attack

Confidentiality means that information is accessible only to those authorised to see it. An attack on confidentiality is one that lets an unauthorised party read data, whether that is a password file, a customer database, or a private email. Integrity means that information has not been altered without authorisation. An attack on integrity changes data, plants false records, or modifies code. Availability means that authorised users can use the system when they need to. An attack on availability denies service through flooding, encryption, or destruction.

Almost every attack fits into one or more of these buckets, and the security countermeasure stack is organised around the same three properties. Encryption protects confidentiality. Cryptographic hashing and digital signatures protect integrity. Redundancy and capacity planning protect availability. Real-world security architectures combine all three because most serious attacks compromise more than one.

Adversaries also fall into a small number of categories. Nation-state actors operate with high resources and patience and target government, defence, and critical infrastructure. Organised criminal groups operate at scale for financial gain, mostly through ransomware and fraud. Hacktivists pursue ideological goals. Insiders with legitimate access cause some of the most damaging breaches. Lone amateurs round out the picture. Defenders rarely know which they are facing in the early stages of an incident, which is one reason incident response is hard.

Malware-Based Attacks

Malware, short for malicious software, is the largest single category of attack tooling. A virus is a piece of code that attaches itself to a host file and spreads when the host is executed, by analogy with biological viruses. Classic file-infecting viruses are rare in the modern landscape because operating systems have made code execution from arbitrary files harder, but the vector still exists in macro viruses inside office documents.

A worm is a self-propagating piece of malware that spreads across a network without user action, exploiting unpatched vulnerabilities. The Morris Worm of 1988 was the first widely publicised example. Conficker in 2008 and the SMB-exploiting WannaCry in 2017 are more recent. Worms are dangerous because they scale at network speed, infecting thousands of systems before defenders can respond.

A Trojan horse is malware disguised as legitimate software. Users download what appears to be a useful application or document, and the embedded payload executes silently. Banking Trojans like Emotet and Trickbot were among the most prolific Trojan families before law enforcement takedowns disrupted their operations.

Ransomware encrypts files on a victim system and demands payment, typically in cryptocurrency, for the decryption key. The economics of ransomware exploded after 2015 because cryptocurrency made anonymous payment practical. Major families include WannaCry, NotPetya, Petya, CryptoLocker, Ryuk, REvil also called Sodinokibi, DarkSide which struck Colonial Pipeline in 2021, and LockBit which has been the most active family since 2022. The 2017 NotPetya outbreak, which masqueraded as ransomware but was actually destructive wiper malware, caused over ten billion dollars in global damage.

Spyware secretly collects information from a victim system, including keystrokes, screenshots, browser history, and saved credentials. Commercial spyware like Pegasus, sold by Israel’s NSO Group, has been used against journalists, activists, and political figures including in India. Adware is the less malicious cousin, displaying unwanted advertisements rather than stealing data, though it often crosses the line into outright spyware.

Social Engineering Attacks

Social engineering attacks target people rather than software. The technical defences may be perfect, but if a user can be tricked into clicking a link or revealing a password, the attacker has won. Phishing is the dominant form, sending fake emails or messages that imitate trusted brands or people to extract credentials, payment data, or to install malware. Spear phishing targets specific individuals with personalised content, often after open-source research on the victim. Whaling targets executives. Business email compromise uses spoofed or hijacked email accounts to redirect payments to attacker-controlled bank accounts.

Vishing is voice phishing, using phone calls to impersonate banks, government agencies, or technical support to extract data or money. India has seen large-scale vishing operations targeting senior citizens with fake court summons, fake SIM-block notices, and fake customs officers in the so-called digital arrest scam.

Smishing uses SMS text messages, typically with a malicious link to a fake delivery tracking page or banking portal. The vector exploits the fact that mobile users tend to be less cautious about links arriving in messages than emails.

Baiting lures victims with attractive offers, infected USB drives left in physical locations, or pirated software downloads. Pretexting fabricates a believable scenario to extract information, for example calling an employee while pretending to be from the IT department to reset a password. Quid pro quo offers something in exchange for help, like fake technical support that asks the victim to install a remote access tool. Tailgating is the physical-world equivalent, following an authorised person through a secured door.

Network Traffic Attacks

Network traffic attacks manipulate packets in transit. A denial of service attack floods a server with more requests than it can handle, exhausting bandwidth, connections, or computational capacity. Distributed denial of service uses thousands or millions of compromised hosts, often Internet of Things devices in a botnet, to flood from many sources at once. The 2016 Mirai botnet attacks against Dyn DNS took down large parts of the public internet for hours.

Man-in-the-middle attacks intercept communication between two parties. The attacker positions itself between victim and server, decrypting, reading, or modifying traffic before forwarding it. The attack works against poorly configured TLS, against open Wi-Fi networks, and against compromised certificate authorities. Modern web traffic with strong TLS, certificate pinning, and HSTS is largely resistant, but legacy systems, internal corporate networks, and IoT devices remain vulnerable.

Packet sniffing captures traffic on a network without modifying it. On a wired network this requires access to the cabling or a misconfigured switch. On a wireless network it can be done from any nearby attacker with the right tools.

Session hijacking takes over an active authenticated session, typically by stealing the session cookie. The attacker reuses the cookie to access the victim’s account without needing the password. Cross-site scripting attacks often have session hijacking as their final step.

DNS cache poisoning corrupts the DNS resolver cache to redirect users to attacker-controlled servers. ARP poisoning does the equivalent at the local network level, redirecting Ethernet traffic. BGP hijacking, at the internet routing layer, has been used to intercept traffic to entire countries.

Identity and Access Attacks

Password attacks remain effective because users still pick weak passwords and reuse them across services. Brute force attacks try many combinations against a login interface or stolen hash. Dictionary attacks use lists of common passwords. Credential stuffing uses passwords leaked from one service against many other services on the assumption of reuse, which is empirically valid for a large fraction of users.

Spoofing attacks falsify identity information. IP spoofing forges the source address of network packets. Email spoofing forges the sender of an email. Caller ID spoofing forges the number on a phone call. ARP spoofing falsifies the link-layer address binding.

Privilege escalation attacks abuse a foothold to gain higher rights. Vertical escalation moves from a low-privileged user to administrator. Horizontal escalation moves to a different user account at the same level. The Windows local privilege escalation vulnerabilities patched repeatedly through 2020 to 2024 are examples of how this attack surface persists.

Multi-factor authentication has reduced the effectiveness of password and credential attacks substantially, but is not a complete defence. SIM swap fraud, MFA fatigue attacks, and adversary-in-the-middle attacks against time-based one-time passwords have all been used in real intrusions.

Web Application Attacks

Web application attacks target the software running on web servers. SQL injection inserts malicious SQL statements into input fields that are not properly sanitised, allowing the attacker to read or modify the database. Despite being well understood for over twenty years, SQL injection still appears regularly in penetration tests and breach reports.

Cross-site scripting injects executable script into pages served to other users, allowing the attacker to steal session cookies, capture form data, or deface the page. Stored XSS persists in the database and affects all users of a vulnerable page. Reflected XSS uses a crafted URL to execute against a single victim.

Cross-site request forgery tricks an authenticated user into submitting a request the user did not intend, for example transferring funds. The defence is the use of synchroniser tokens that the attacker cannot forge.

Server-side request forgery makes the application server fetch a URL chosen by the attacker, which can be used to reach internal services, cloud metadata APIs, and database administration interfaces. The 2019 Capital One breach was an SSRF exploitation of a misconfigured AWS WAF that exposed cloud credentials.

Insecure direct object references, broken access control, deserialisation flaws, and dependency vulnerabilities round out the OWASP Top Ten, the canonical list of web application risks maintained by the Open Web Application Security Project.

India’s Major Ransomware Cases and CERT-In Response

India has not been spared from the global ransomware wave. The 2022 ransomware attack against AIIMS Delhi, attributed to a foreign actor, locked patient records for over a week and forced a return to manual processes. The 2023 SafePay-style attacks against multiple state-government systems, the recurring intrusions against state electricity boards, and the 2024 attacks against C-DAC and other research bodies have established that no sector is exempt.

CERT-In, the Indian Computer Emergency Response Team operating under the Ministry of Electronics and Information Technology, is the lead agency for incident response. Under the April 2022 directions, organisations must report cyber incidents to CERT-In within six hours, maintain logs for 180 days, and synchronise system clocks to NTP servers operated by NIC and NPL. The directions were controversial but reflect the seriousness of the underreporting problem.

The National Critical Information Infrastructure Protection Centre, NCIIPC, under the National Technical Research Organisation, has the parallel mandate for protecting critical infrastructure including power, banking, telecom, transport, and government. Sectoral CERTs in finance, power, and other domains layer below CERT-In and NCIIPC.

The Cyber Crime Coordination Centre, I4C, under the Ministry of Home Affairs runs the National Cyber Crime Reporting Portal at cybercrime.gov.in and coordinates with state police on financial fraud and cyber-enabled crime. The platform’s helpline, 1930, has become the first port of call for victims of online financial fraud.

Defence in Depth and the Principle of Least Privilege

A serious cyber security architecture rests on layered defences. The perimeter layer uses firewalls, intrusion prevention systems, and DDoS scrubbing services to filter obvious attacks before they reach internal systems. The identity layer authenticates users with multi-factor authentication, manages access through role-based controls, and audits login activity for anomalies.

The application layer relies on secure software development practices, code review, dependency scanning, and runtime application self-protection. The data layer uses encryption at rest and in transit, key management hardware, and tokenisation for sensitive fields. The endpoint layer protects laptops, mobile devices, and servers with endpoint detection and response tools, application allowlisting, and configuration baselines.

The principle of least privilege says that any process, user, or system should have only the access it needs and no more. Combined with network segmentation, least privilege limits the blast radius of a compromise. An attacker who lands on a finance laptop should not be able to read the engineering source code from there.

Zero trust is the modern packaging of these principles. The model assumes the network is hostile, requires authentication for every request regardless of source, and treats internal traffic with the same suspicion as external traffic. Government and enterprise security architectures around the world are moving in this direction.

The Policy Context

India’s IT Act 2000, with its 2008 amendments, criminalises most forms of cyber attack under sections 65 to 74 and provides the legal basis for CERT-In and NCIIPC. The Digital Personal Data Protection Act 2023 adds a separate framework for personal data, requiring data fiduciaries to notify the Data Protection Board and affected users of breaches.

The proposed Digital India Act, intended to replace the IT Act, has been in draft form for several years and is expected to modernise the framework with sections specifically on intermediary liability, deepfakes, and emerging technology. The Telecommunications Act 2023 brings network operators under a unified licensing regime that includes security obligations.

Internationally, the Budapest Convention on Cybercrime is the dominant framework, although India has not signed. India participates in the United Nations Open-Ended Working Group on cyber security and pushes for a UN-led negotiation rather than the Council of Europe’s lead. The geopolitics of cyber norms remain fragmented, and India’s posture reflects both technological aspiration and policy independence.

Prelims Pointers

The CIA triad of cyber security stands for confidentiality, integrity, and availability. Major malware types include viruses, worms, Trojans, ransomware, spyware, and adware. WannaCry of May 2017 used the EternalBlue SMB exploit. NotPetya in June 2017 was destructive wiper malware. CERT-In is the Indian Computer Emergency Response Team under MeitY. The April 2022 CERT-In directions require incident reporting within six hours. NCIIPC protects Critical Information Infrastructure under NTRO. The National Cyber Crime Reporting Portal is run by I4C under MHA. The cyber crime helpline number is 1930. The IT Act 2000 was amended in 2008. The Digital Personal Data Protection Act came into force in 2023. India is not a signatory to the Budapest Convention.

Firewalls: The Network’s Traffic Filter

A firewall is the single most recognisable piece of defensive equipment in any network, yet it is also the most misunderstood. At its core, a firewall monitors and filters traffic moving into and out of a network, comparing every packet against a configured set of security rules and allowing only what those rules permit. It sits at the boundary between a trusted internal network and the untrusted networks beyond it, deciding which connections may cross. Where the rest of the defensive stack reacts to threats already in motion, the firewall is the gatekeeper that decides whether traffic enters at all.

It helps to be precise about what a firewall does not do, because the functions are often confused. A firewall does not scan stored files and strip out viruses; that is the work of antivirus and endpoint detection software, which inspects what is already on a machine. It does not create copies of data for recovery, which is the role of backup systems. And it does not scramble files so only an authorised key can read them, which is what encryption provides. The firewall’s job is narrower and earlier in the chain: regulate the flow of traffic, not the integrity of files or the secrecy of their contents.

Modern firewalls range from simple packet filters that judge traffic by source, destination, and port, to stateful inspection systems that track whole conversations, to next-generation appliances that read application behaviour and block known malicious signatures. In the layered model this page describes, the firewall is the perimeter’s first filter, working alongside intrusion prevention systems and authentication controls rather than replacing them.

Mains Practice Questions

1. The CIA triad provides a useful framework for understanding cyber attacks but is incomplete in the era of large-scale cybercrime and state-sponsored intrusions. Discuss with examples and Indian institutional response. (250 words)
2. Examine the regulatory architecture for cyber security in India with reference to CERT-In, NCIIPC, I4C, the IT Act, and the Digital Personal Data Protection Act. (250 words)
3. Ransomware has become the dominant criminal threat to enterprises and governments. Analyse why, with reference to specific incidents in India and globally, and suggest measures for resilience. (250 words)

Way Forward

Cyber resilience for India requires investment along five axes. The first is human capital, where the gap between cyber security demand and supply runs into the hundreds of thousands of trained professionals. Specialised programmes at the IITs, NITs, IIITs, and at private universities, along with the CERT-In incident-response training and the cyber forensics capability built at C-DAC, need to scale by an order of magnitude.

The second is institutional. CERT-In’s mandate is broad and its resources are not commensurate. A more autonomous, better-resourced national cyber security agency, perhaps under a National Cyber Security Coordinator with statutory authority, has been recommended in multiple expert reports. NCIIPC’s reach into critical infrastructure operators is uneven and needs strengthening, particularly in the power and banking sectors.

The third is technology. Indigenous capability in operating systems, network equipment, and security tooling reduces dependence on foreign vendors. Promotion of open-source security software, support for domestic firms in endpoint detection, identity management, and SIEM tooling, and investment in biotechnology and AI-driven defence are all areas where Indian industry can grow.

The fourth is law. The Digital India Act, when passed, must address the gaps in the IT Act including platform accountability, deepfake liability, and emerging technology risks. The Data Protection Board needs adequate staffing and powers to deter non-compliance.

The fifth is international cooperation. India should continue to push for UN-led cyber norms, work bilaterally with major partners on threat intelligence sharing, and invest in capacity-building support for smaller countries that face the same threats with fewer resources.

The threat is not going away. The question is whether the response keeps pace.

Frequently Asked Questions

PDF