Introduction to network security threats

Networks allow devices to connect and share information, but they also create opportunities for security risks. Understanding them is essential for protecting systems, and common defences include tools like firewalls and encryption.

Types of network attacks

Network attacks aim to exploit vulnerabilities in connected systems.

Passive attacks

A passive attack involves an unauthorised person monitoring data as it travels across a network to capture sensitive information. This is often done using specialised tools like packet sniffers.

Characteristics of passive attacks:

• These attacks are difficult to spot because the attacker does not alter the data – they simply observe it quietly.
• A key defence is encryption, which scrambles data so it cannot be read even if intercepted.

Government agencies may use a form of this called lawful interception for security purposes, where data monitoring is authorised by law.

Active attacks

An active attack occurs when an attacker directly interferes with a network, often using malware or other deliberate methods to cause harm. The primary defence is a firewall, which acts as a barrier to block unauthorised access.

Insider attacks

An insider attack happens when someone inside an organisation, such as an employee, misuses their legitimate access to the network.

Brute force attacks

A brute force attack is a type of active attack focused on cracking passwords through repeated trial and error. Attackers use automated software to generate and test hundreds of possible combinations, such as mixing common words with predictable numbers.

How brute force attacks work:

• They might target one username with many passwords or try one password across multiple accounts.
• To reduce risks, use strong passwords, and implement account lockouts after a set number of failed attempts.

Denial-of-service attacks

A denial-of-service (DoS) attack aims to make a network or website unavailable to users. This is usually achieved by overwhelming the system with excessive, useless traffic, causing it to slow down or crash completely.

Malware and its impacts

Malware, short for malicious software, is any program installed on a device without the user's knowledge or permission.

Typical actions performed by malware

Once installed, malware can carry out various harmful activities:

• Deleting or modifying files - This can corrupt important data or remove it entirely.
• Scareware - Tricks users into thinking their device is heavily infected, prompting them to click malicious links or pay for fake fixes.
• Locking files - Known as ransomware, this encrypts files and demands payment for a decryption key to restore access.
• Spyware - Secretly tracks user behaviour, such as keystrokes or screen activity, and sends the data to the attacker.
• Rootkits - These change system permissions to give the attacker or malware full administrative control over the device.
• Opening backdoors - Creates hidden vulnerabilities in security that allow future unauthorised access.

How malware spreads and specific types

Malware enters devices through exploited weaknesses or user actions.

Viruses

A virus is malware that attaches itself to files, such as executable (.exe) files or autorun scripts, by copying its code into them.

How viruses work:

• It spreads when users share or open infected files.
• Activation occurs when the host file is run, allowing the virus to replicate and infect other files.

Worms

A worm is similar to a virus but does not need to attach to files – it self-replicates automatically without user intervention. Worms exploit gaps in network security to spread rapidly across connected devices.

Trojans

A trojan is malware hidden within seemingly legitimate software, tricking users into installing it. Unlike viruses and worms, trojans do not self-replicate; they rely on users downloading and running them.