Concepts, attacks and defences for network environments. Application-layer protocol detail is in Protocol Table and Port Numbers.
Core Concepts
CIA triad
- Confidentiality: only authorised access (encryption, access control)
- Integrity: data not altered (hashing, signatures, checksums)
- Availability: services reachable (redundancy, DDoS defence)
Threat vocabulary
- Vulnerability: a weakness. Threat: something that can exploit it. Exploit: the method. Risk = likelihood × impact
- Zero-day: unknown to the vendor, no patch
- Defence in depth: layered controls so one failure is not fatal
- Least privilege, separation of duties, need to know
- Zero Trust: never trust by location, verify every request
AAA
- Authentication: who are you (password, certificate, MFA)
- Authorization: what may you do
- Accounting: what did you do (logs) Protocols: RADIUS (UDP 1812/1813, network access), TACACS+ (TCP 49, device admin, encrypts whole payload), Kerberos (tickets, port 88), LDAP, SAML / OIDC / OAuth for web SSO. See Directory Access Protocols.
MFA factors: something you know, have, are, plus location / time.
Common Attacks
Reconnaissance
- Port scanning (nmap), banner grabbing, OS fingerprinting, DNS enumeration, social engineering
Network-layer
| Attack | What happens | Defence |
|---|---|---|
| ARP poisoning / spoofing | Fake ARP replies redirect traffic (MITM) | DAI, static ARP, segmentation |
| MAC flooding | CAM table overflows, switch floods | Port security |
| VLAN hopping | Reach other VLANs via DTP or double tagging | Disable DTP, change native VLAN |
| DHCP starvation / rogue DHCP | Exhaust pool or serve bad config | DHCP snooping |
| IP spoofing | Forged source addresses | Ingress/egress filtering, uRPF |
| DNS poisoning / spoofing | Fake DNS answers | DNSSEC, trusted resolvers |
| Route / BGP hijack | Bogus routes | Route filtering, RPKI, authentication |
| Smurf / ping of death / fragmentation | ICMP abuse | Filtering, patching |
Denial of Service
- DoS (one source) and DDoS (many, botnets)
- Volumetric (UDP/ICMP flood, amplification via DNS, NTP, memcached), protocol (SYN flood fills half-open connections), application (HTTP flood, Slowloris)
- Defences: rate limiting, SYN cookies, CDN / scrubbing, anycast, 3. Azure Networking DDoS Protection and AWS Shield (2. AWS IAM and Security)
Man-in-the-middle and wireless
- On-path / MITM, SSL stripping
- Evil twin (fake AP), rogue AP, deauth attacks, WPS brute force, bluejacking / bluesnarfing (Bluetooth Protocols)
- Wi-Fi security: WEP (broken) → WPA (TKIP) → WPA2 (AES-CCMP) → WPA3 (SAE, protected management frames). Enterprise = 802.1X + RADIUS, Personal = pre-shared key. See Wifi
Application and credential
- Phishing / spear phishing / whaling, vishing, smishing
- Password attacks: brute force, dictionary, credential stuffing, password spraying, rainbow tables (defeated by salting)
- SQL injection, XSS, CSRF, directory traversal
- Malware: virus, worm, trojan, ransomware, rootkit, keylogger, botnet
Defences and Controls
Firewalls and segmentation
- ACLs: ordered permit / deny rules, implicit deny any at the end, place standard ACLs near the destination and extended near the source
- DMZ (screened subnet): public-facing servers between two firewalls
- Segmentation / microsegmentation with VLANs, subnets, security groups
- NAC (Network Access Control): posture-check devices before access
- Honeypots / honeynets: decoys to study attackers
Encryption
| Type | Detail |
|---|---|
| Symmetric | One shared key, fast: AES (128/192/256), ChaCha20; legacy 3DES, DES |
| Asymmetric | Key pair, slow: RSA, ECC, Diffie-Hellman for key exchange |
| Hashing | One-way, integrity: SHA-256, SHA-3 (MD5 / SHA-1 are weak) |
| Digital signature | Hash signed with the private key: integrity + authenticity + non-repudiation |
- PKI: Certificate Authority (CA) issues X.509 certificates; chain of trust; CRL / OCSP for revocation
- TLS secures HTTP (443), SMTP, LDAPS; use TLS 1.2+
- IPsec secures at layer 3, SSH replaces Telnet, SFTP / FTPS replace FTP, HTTPS replaces HTTP, SNMPv3 replaces v1/v2c
Secure vs insecure protocols
| Insecure | Secure replacement |
|---|---|
| Telnet (23) | SSH (22) |
| FTP (21) | SFTP (22) / FTPS (990) |
| HTTP (80) | HTTPS (443) |
| SNMP v1/v2c | SNMPv3 |
| LDAP (389) | LDAPS (636) |
| POP3/IMAP/SMTP plain | TLS versions (995, 993, 587/465) |
Hardening
- Change default credentials, disable unused ports and services, patch / firmware updates
- Disable Telnet, HTTP management, WPS, unused switch ports; secure console / VTY access with SSH and ACLs
- Role-based access control, banners, logging, NTP for accurate timestamps
- Physical security: locks, badges, cameras, mantrap, locked racks, cable management
Detection, Response and Governance
- IDS / IPS, SIEM (correlates logs), honeypots, NetFlow analysis
- Vulnerability scanning (Nessus, OpenVAS) vs penetration testing (active exploitation, scoped and authorised)
- Incident response phases: Preparation → Identification → Containment → Eradication → Recovery → Lessons learned
- Policies: acceptable use, BYOD, password, change management, incident response, disaster recovery and business continuity plans
- Backups: 3-2-1 rule (3 copies, 2 media, 1 offsite); full / incremental / differential
- Compliance: PCI DSS, HIPAA, GDPR, POPIA (South Africa)