For each malicious attack and threat identified in Assignment 1, choose a strategy for dealing with the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance).

Masquerading – An attacker impersonates an authorized user to capture authentication information for use at a later date, resulting in possible unauthorized access to the network. An impersonation attack may be a replay or may be some other type of attack. Risk mitigation would be the best strategy for dealing with a masquerading attack. As risk mitigation uses various controls to reduce risk. (Janssen, 2013)
Social engineering – An attacker uses the weakest link (people) to gain access to secret information by simply asking. This can be done over the phone or email. Compromise of sensitive information is likely to occur. Social networking websites can reveal a large amount of personal information, including resumes, home addresses, phone numbers, employment information, work locations, family members, education and photos. Social media websites may share more personal information than users expect or need to keep in touch with friends making them vulnerable to identity theft or other crimes. Risk avoidance would be the best strategy for dealing with a social engineering attack. (Roman, 2013)
Phishing – Attackers use email to trick an individual into giving up private information such as financial information through a link to a fake website. When a user logs onto the fake Web site, and enters their login credentials and/or personal information (address, social security number, credit card number, etc.) are put into the attacker's database. Possible identity theft or compromise of organizational data may occur. Risk avoidance would be the best strategy for dealing with a phishing attack. The risk avoidance technique is basically when a user declines to take a risk. (Bowers, 2013)

Phreaking – Attackers exploit bugs and glitches in an organizations telephone system to gain access to the network, resulting in possible unauthorized access to the network. During this attack, a phreaker manipulates the phone network to cause it to perform a function that is normally not allowed. A common goal of phreaking is breaking into the phone network, usually through a payphone, to make free long-distance calls. Risk Mitigation would be the best strategy for dealing with a phreaking attack. As risk mitigation uses various controls to reduce risk. (Bowers, 2013)

Pharming – An attacker tricks user into visiting a bogus site to obtain personal and financial information. Pharming is also a good source for introducing viruses and other malicious activity into the network, resulting in loss of data and potential denial of service. Pharming can be conducted either by changing the hosts file on a victim's computer or by exploitation of a vulnerability in DNS server software. DNS servers are computers responsible for resolving Internet names into their real IP addresses. Risk Avoidance would be the best strategy for dealing with the risk pharming attack. The risk avoidance technique is basically when a user declines to take a risk. (Collette, 2013)

Janssen, C. (2013) Techopedia.com (Masquerade Attacks). Retrieved May 31, 2013, from http://www.techopedia.com/definition/4020/masquerade-attack
Roman, J. (2013) bankinfosecurity.com (Social Engineering). Retrieved June 1, 2013, from http://www.bankinfosecurity.com/social-engineering-mitigating-risks-a-4795/op-1 Bowers, T. (2013) searchsecurity.com. Phishing: The business risks and strategies for mitigating
Retrieved June 1, 2013, from http://searchsecurity.techtarget.com/tip/Phishing-The-business-risks-and-strategies-for-mitigating-them Bowers, T. (2013) DLS.com. Hosted PBX Toll Fraud Attacks: Phreaking
Retrieved June 1, 2013, from http://www.telephonyyourway.com/2011/07/22/hosted-pbx-toll-fraud-attacks-phreaking/
Collette, R. (2013) ComputerEconomics.com. Countering the Phishing/Pharming Threat
Retrieved June 1, 2013, from http://www.computereconomics.com/article.cfm?id=1099