Macro virus

Explanation:
A macro virus is a virus that is written in a macro language: a programming language which
is embedded inside a software application (e.g., word processors and spreadsheet
applications). Some applications, such as Microsoft Office, allow macro programs to be
embedded in documents such that the macros are run automatically when the document is
opened, and this provides a distinct mechanism by which malicious computer instructions
can spread. (Wikipedia)
NB: The virus Melissa is a well-known macro virus we could find attached to word
documents.

Dynamic ARP Inspection (DAI)

Explanation:
Dynamic ARP inspection (DAI) protects switching devices against Address Resolution
Protocol (ARP) packet spoofing (also known as ARP poisoning or ARP cache poisoning).
DAI inspects ARPs on the LAN and uses the information in the DHCP snooping database
on the switch to validate ARP packets and to protect against ARP spoofing. ARP requests
and replies are compared against entries in the DHCP snooping database, and filtering
decisions are made based on the results of those comparisons. When an attacker tries to
use a forged ARP packet to spoof an address, the switch compares the address with
entries in the database. If the media access control (MAC) address or IP address in the
ARP packet does not match a valid entry in the DHCP snooping database, the packet is
dropped.

Clickjacking Attack

Explanation: https://en.wikipedia.org/wiki/Clickjacking
Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible
or disguised as another element. This can cause users to unwittingly download malware,
visit malicious web pages, provide credentials or sensitive information, transfer money, or
purchase products online.
Typically, clickjacking is performed by displaying an invisible page or HTML element, inside
an iframe, on top of the page the user sees. The user believes they are clicking the visible
page but in fact they are clicking an invisible element in the additional page transposed on
top of it.

Open-source intelligence

No response

Kismet

Explanation:
https://en.wikipedia.org/wiki/Kismet_(software)
Kismet is a network detector, packet sniffer, and intrusion detection system for 802.11
wireless LANs. Kismet will work with any wireless card which supports raw monitoring
mode, and can sniff 802.11a, 802.11b, 802.11g, and 802.11n traffic

Brute force

Explanation: Brute-force attack when an attacker uses a set of predefined values to attack
a target and analyze the response until he succeeds. Success depends on the set of
predefined values. It will take more time if it is larger, but there is a better probability of
success. In a traditional brute-force attack, the passcode or password is incrementally
increased by one letter/number each time until the right passcode/password is found.

Application

Explanation:
https://en.wikipedia.org/wiki/Internet_Relay_Chat
Internet Relay Chat (IRC) is an application layer protocol that facilitates communication in
text. The chat process works on a client/server networking model. IRC clients are computer
programs that users can install on their system or web-based applications running either
locally in the browser or on a third-party server. These clients communicate with chat
servers to transfer messages to other clients.
IRC is a plaintext protocol that is officially assigned port 194, according to IANA. However,
running the service on this port requires running it with root-level permissions, which is
inadvisable. As a result, the well-known port for IRC is 6667, a high-number port that does
not require elevated privileges. However, an IRC server can also be configured to run on
other ports as well.
You can't tell if an IRC server is designed to be malicious solely based on port number.
Still, if you see an IRC server running on port a WKP such as 80, 8080, 53, 443, it's almost
always going to be malicious; the only real reason for IRCD to be running on port 80 is to
try to evade firewalls.
https://en.wikipedia.org/wiki/Application_firewall
An application firewall is a form of firewall that controls input/output or system calls of an
application or service. It operates by monitoring and blocking communications based on a
configured policy, generally with predefined rule sets to choose from. The application
firewall can control communications up to the OSI model's application layer, which is the
highest operating layer, and where it gets its name. The two primary categories of
application firewalls are network-based and host-based.
Application layer filtering operates at a higher level than traditional security appliances. This
allows packet decisions to be made based on more than just source/destination IP
Addresses or ports. It can also use information spanning across multiple connections for
any given host.
Network-based application firewalls
Network-based application firewalls operate at the application layer of a TCP/IP stack.
They can understand certain applications and protocols such as File Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol (HTTP). This allows it
to identify unwanted applications or services using a non-standard port or detect if an
allowed protocol is being abused.
Host-based application firewalls
A host-based application firewall monitors application system calls or other general system
communication. This gives more granularity and control but is limited to only protecting the
host it is running on. Control is applied by filtering on a per-process basis. Generally, prompts are used to define rules for processes that have not yet received a connection.
Further filtering can be done by examining the process ID of the owner of the data packets.
Many host-based application firewalls are combined or used in conjunction with a packet
filter.

Educate everyone with books, articles and training on risk analysis, vulnerabilities and
safeguards.

Administrative safeguards