Apa saé jenis-jenis serangan keamanan sing umum?

Question

Accepted Answer

Memahami **jenis-jenis serangan** — carane penyerang nyoba ngkompromi sistem — minangka fondasi kanggo nglindungi marang serangan kasebut. Kategori utama kalebu injection, XSS, CSRF, brute force, social engineering, DDoS, lan liya-liyane.

## Serangan aplikasi web

```text
INJECTION (SQL, command, etc.) → inject malicious code via input (manipulate queries/commands)
XSS (Cross-Site Scripting) → inject scripts that run in victims' browsers
CSRF (Cross-Site Request Forgery) → trick a logged-in user's browser into making unwanted
  requests (perform actions as them without consent)
BROKEN ACCESS CONTROL → access/modify what you're not authorized to (e.g. IDOR)
SSRF → trick the server into making requests it shouldn't
```

## Serangan autentikasi / akses

```text
BRUTE FORCE → try many passwords/keys until one works (rate-limit, lock out, MFA)
CREDENTIAL STUFFING → use leaked username/password pairs from other breaches
SESSION HIJACKING → steal session tokens/cookies to impersonate a user
PHISHING / SOCIAL ENGINEERING → trick people into revealing credentials/info (the human
  is often the weakest link)
```

## Serangan liyane

```text
DDoS (Distributed Denial of Service) → flood a system to make it unavailable
MAN-IN-THE-MIDDLE (MITM) → intercept communication (HTTPS prevents this)
MALWARE / ransomware; SUPPLY CHAIN attacks (compromise dependencies/build tools)
ZERO-DAY → exploit unknown/unpatched vulnerabilities
```

## Mengapa iku penting

Memahami jenis-jenis serangan keamanan sing umum minangka fondasi amarga **sampeyan ora bisa nglindungi marang ancaman sing ora sampeyan ngerti**, mula ngerti carane penyerang gumawa minangka sangat penting kanggo mbangun sistem sing aman, iki dadi ilmu keamanan sing penting.

Kesadaran babagan jenis-jenis serangan — carane penyerang nyoba ngkompromi sistem — minangka fondasi pertahanan, amarga saben jenis serangan nduwé pertahanan sing cocog, lan memahami ancaman ndorong lan nuntun langkah-langkah perlindungan.

Memahami **serangan aplikasi web** — **injection** (manipulasi query/perintah liwat input), **XSS** (script sing mbukak ing browser korban), **CSRF** (ngapusi browser pengguna sing login kanggo nggawe permintaan sing ora dipenginake), **broken access control** (akses marang sumber daya sing ora dikudhaake), lan **SSRF** — nutupi ancaman tingkat aplikasi sing paling umum sing kudu dijaga dening developer.

Memahami **serangan autentikasi/akses** — **brute force** (nyoba akeh password, dicegah kanthi rate-limiting lan MFA), **credential stuffing** (nggunakake kredensial sing bocor), **session hijacking** (nyolong token), lan **phishing/social engineering** (ngapusi wong, amarga manungsa sering dadi tulisane paling lemah) — nutupi carane penyerang ngarahake akses.

Memahami **serangan liyane** — **DDoS** (flood kanggo nyebabake ketidaktersediaan), **man-in-the-middle** (intercept komunikasi, dicegah kanthi HTTPS), malware, **supply chain attacks** (ngkompromi dependensi — saya penting), lan zero-days — majalke kesadaran babagan landscape ancaman.

Ngerti jenis-jenis serangan iki ngandel developer kanggo ngenali ancaman, ngerti ngapa pertahanan khusus ana (parameterized queries marang injection, escaping marang XSS, MFA marang brute force, HTTPS marang MITM), lan mbangun perlindungan sing cocog.

Amarga nglindungi marang ancaman mbutuhake memahami lan saben jenis serangan umum nduwé pertahanan sing cocog, lan amarga kesadaran babagan serangan utama (injection, XSS, CSRF, brute force, phishing, DDoS, supply chain) minangka fondasi kanggo mbangun sistem sing aman, memahami serangan keamanan sing umum minangka fondasi, ilmu keamanan sing penting — kesadaran ancaman sing ndasari kabeh keamanan defensif, perlu kanggo ngenali ancaman lan ngerti ngapa langkah-langkah keamanan ana, lan baseline kanggo saben developer sing mbangun sistem sing kudu ngontrol serangan sing terus-terusan lan beda-beda sing ngadhepi software.