chapter thirteen

13 Network Threats and Attacks

 

This chapter covers

  • General Stages of a cyber attack
  • Types of threats
  • Threat Identification
  • Threat Prevention

As we have seen, due to their interconnected nature, networks are inherently susceptible to attacks. A single compromised device — whether due to a phishing email, a weak password, or unpatched software — can serve as a gateway for attackers to intercept or manipulate network traffic, move laterally across systems, and access sensitive data. These initial footholds often go undetected, enabling attackers to expand their reach undetected, which makes containment and remediation significantly challenging. This underscores the urgent need for robust, comprehensive security measures across all network components.

Attackers typically exploit the weakest link in a network’s defenses to bypass stronger protections. For instance, rather than targeting a well-protected server directly, they might compromise an employee’s device with a weak password and use it as a springboard to escalate privileges and infiltrate deeper into the network.

To effectively counter these threats, cybersecurity professionals must understand the mechanics of network systems and the tactics that attackers use to exploit them. This knowledge is critical for securing data in transit, protecting vital assets, and implementing proactive defense strategies.

13.1 The Stages of a Cyber Attack

13.1.1 Reconnaissance

13.1.2 Weaponization

13.1.3 Delivery

13.1.4 Exploitation

13.1.5 Installation

13.1.6 Command and Control (C2)

13.1.7 Objective Execution

13.2 Understanding Threats and Attacks

13.2.1 Malware

13.2.2 Scripting Attacks

13.2.3 Password Attacks

13.2.4 Social Engineering

13.2.5 Spoofing

13.2.6 On-Path Attacks

13.2.7 Denial of Service (DoS) Attacks

13.2.8 Side-Channel Attacks

13.2.9 Physical Attacks

13.2.10 Insider Threats

13.2.11 Advanced Persistent Threats (APT)

13.3 Detecting, Preventing, and Containing Threats

13.3.1 Threat Intelligence

13.3.2 IDS and IPS

13.3.3 Logging and Monitoring

13.3.4 Security Information and Event Management (SIEM) Systems

13.3.5 Endpoint Protection

13.3.6 Firewalls

13.3.7 Email and Web Application Filtering

13.3.8 Network Access Control