12 Common Network Threats and Attacks

This chapter explains that network security is challenged by the fact that even one weak device, account, or misconfiguration can give attackers a foothold to intercept traffic, move laterally, and reach sensitive systems. It defines network threats and attacks as anything that endangers confidentiality, integrity, or availability, then shows how attacks commonly progress through a lifecycle of reconnaissance, weaponization, delivery, exploitation, installation, command and control, and final actions on objectives. The chapter emphasizes an assume-breach mindset, because defenders must plan not only to prevent intrusion but also to contain damage when an attacker gets inside.

It then surveys the main attack types that threaten networks, starting with malware such as viruses, worms, Trojans, rootkits, spyware, adware, ransomware, and botnets. It also covers scripting attacks like XSS, SQL injection, buffer overflows, logic bombs, and TOC/TOU weaknesses, along with password attacks such as brute force, spraying, dictionary attacks, and rainbow tables, and explains how salting and strong hashing reduce those risks. Social engineering, phishing, spoofing, on-path attacks, denial-of-service attacks, side-channel attacks, physical attacks, insider threats, and advanced persistent threats are presented as additional ways attackers exploit technology, trust, and human behavior.

Finally, the chapter shows how organizations defend themselves with layered controls and ongoing validation. Preventive measures include firewalls, endpoint protection, email and web filtering, NAC, wireless security, and segmentation for difficult environments such as IoT. Detective and response tools such as IDS, IPS, SIEM, EDR, XDR, and SOAR help identify suspicious behavior, correlate logs, and automate containment, while threat intelligence and vulnerability assessments keep defenses current and measurable. The overall message is that effective cybersecurity depends on continuous monitoring, testing, adaptation, and coordination across technical, administrative, and physical safeguards.

Arrangement of the distinct types of malware according to their malicious intent and propagation mechanisms.

Illustration of a Cross-Site Scripting (XSS) attack.

Illustration of an SQL Injection (SQLi) attack.

Illustration of salted password hashing in the workflows of password creation and password validation.

Illustration of Phishing email indicators

The tactics of Phishing attacks displayed side-by-side.

Illustration of an on-path attack scenario.

Illustration of a coordinated flood in a Distributed Denial of Service (DDoS) attack.

Illustration of a Smurf attack using ICMP broadcast amplification

Illustration of the setup of a WAF Firewall.

Illustration of the setup of a NAC architecture.

Illustration of the setup of network IDS and network IPS.

Illustration of the setup of a SIEM architecture combining network IPS/IDS with host agents.

1. The correct answer is D. Trojans are a type of software that appears legitimate but has hidden malicious functions that evade security mechanisms, typically by exploiting legitimate authorizations of the user that invokes the program.
2. The correct answer is C. A rootkit tries to maintain root-level access while concealing malicious activity. It typically creates a backdoor and attempts to remain undetected by anti-malware software. A rootkit is active while the system is running.
3. The correct answer is C. Ransomware is malicious software designed to deny a user or organization access to files on their computer by encrypting them and demanding a ransom payment for the decryption key. This type of cyberattack prevents legitimate users from accessing files on their computers.
4. The correct answer is A. A phishing attack emails a fraudulent message to trick the recipient into disclosing sensitive information to the attacker.
5. The correct answer is B. The primary goal of a spoofing attack is to gain access to a target system by impersonating a legitimate user or device.
6. The correct answer is A. In an on-path attack, hackers position themselves on the communication path between two parties, intercepting and possibly altering the communication.
7. The correct answer is C. The primary goal of a denial-of-service (DoS) attack is to make a system or network resource unavailable to its intended users by temporarily or indefinitely disrupting the services of a host connected to the Internet.
8. The correct answer is A. An insider threat is a security risk that originates from within an organization, often from an employee or former employee.
9. The correct answer is A. An Advanced Persistent Threat (APT) attack is a type of cyber attack designed to gain access to a target system and remain undetected for an extended period.
10. The correct answer is C. A Security Information and Event Management (SIEM) system is an application that gathers security data from information system components and presents actionable information through a unified interface. 2.1.

FAQ