Lecture Notes: Network Attacks and
Defense Strategies
1. Essential Terminologies Related to Network Security
Understanding network security requires familiarity with some key terminologies:
Term Definition
Any attempt to compromise the confidentiality, integrity, or
Network Attack
availability of a network resource.
A potential cause of an unwanted incident, which may result in
Threat
harm to a system or organization.
Vulnerability Weakness in a system or network that can be exploited by threats.
Exploit Technique or method used to take advantage of a vulnerability.
Malicious software designed to damage, disrupt, or gain
Malware
unauthorized access to systems (e.g., viruses, worms, ransomware).
Security device/software that monitors and controls
Firewall
incoming/outgoing network traffic.
Intrusion Detection Monitors network/system activities for malicious activities or
System (IDS) policy violations.
Intrusion Prevention Detects and prevents malicious activities by blocking them
System (IPS) automatically.
2. Attacker Hacking Methodologies and Frameworks
Attackers follow structured methodologies to compromise networks. Understanding these
helps in designing defense strategies.
2.1 Phases of Hacking
1. Reconnaissance (Footprinting & Scanning)
o Collecting information about the target network.
o Tools: Nmap, Whois, Shodan.
2. Gaining Access
o Exploiting vulnerabilities to enter the system.
o Tools: Metasploit, SQLMap.
3. Maintaining Access
o Installing backdoors or rootkits to stay undetected.
o Tools: Netcat, Meterpreter.
4. Clearing Tracks
o Erasing logs to avoid detection.
o Tools: Log cleaners, anti-forensics scripts.
2.2 Attacker Frameworks
Framework Description
Model describing the stages of a cyber attack: Reconnaissance →
Cyber Kill
Weaponization → Delivery → Exploitation → Installation → Command &
Chain
Control → Actions on Objective.
MITRE Knowledge base of adversary tactics and techniques based on real-world
ATT&CK observations.
Threat modeling framework focusing on Spoofing, Tampering, Repudiation,
STRIDE
Information Disclosure, Denial of Service, Elevation of Privilege.
3. Fundamental Goals, Benefits, and Challenges in
Network Defense
3.1 Goals of Network Defense
1. Confidentiality: Protect sensitive data from unauthorized access.
2. Integrity: Ensure data is accurate and unaltered.
3. Availability: Ensure network services are accessible when needed.
4. Authentication & Authorization: Verify users and control access.
3.2 Benefits
Protects critical business and personal data.
Reduces risk of financial loss and legal liabilities.
Maintains user trust and system reliability.
Ensures regulatory compliance.
3.3 Challenges
Rapidly evolving threats and malware.
Insider threats and social engineering.
Complexity in securing multi-layered networks.
Balancing security with system usability.
4. Continual/Adaptive Security Strategy
Adaptive security is a proactive approach that continuously monitors and adapts to new
threats.
Key Components:
1. Predict: Identify potential threats using threat intelligence.
2. Prevent: Implement preventive controls (firewalls, antivirus, patching).
3. Detect: Monitor network and systems for anomalies.
4. Respond: Take immediate action to mitigate attacks.
5. Recover: Restore services and update defense measures.
Flowchart: Adaptive Security Cycle
[Predict] → [Prevent] → [Detect] → [Respond] → [Recover] → [Predict]
(Loop continues for continuous protection)
5. Defense-in-Depth Security Strategy
Defense-in-depth implements multiple layers of security to protect networks.
Layers of Defense:
1. Perimeter Security: Firewalls, gateways, VPNs.
2. Network Security: IDS/IPS, VLANs, segmentation.
3. Endpoint Security: Antivirus, host-based firewalls.
4. Application Security: Web app firewalls, secure coding.
5. Data Security: Encryption, DLP (Data Loss Prevention).
6. Physical Security: Locked server rooms, access controls.
Diagram: Defense-in-Depth
+-------------------+
| Physical Layer |
+-------------------+
| Data Security |
+-------------------+
| Application Layer |
+-------------------+
| Endpoint Layer |
+-------------------+
| Network Layer |
+-------------------+
| Perimeter Layer |
+-------------------+
6. Security Controls
Security controls are measures implemented to protect networks from attacks. They are
classified into three main types:
6.1 Administrative Controls
Policies, procedures, and regulations.
Examples:
o Security awareness training.
o Incident response plan.
o User access policies.
6.2 Technical Controls
Hardware/software mechanisms.
Examples:
o Firewalls, IDS/IPS.
o Antivirus/antimalware.
o Encryption and authentication protocols.
6.3 Physical Controls
Protect the physical environment of network assets.
Examples:
o Locked doors and cabinets.
o Surveillance cameras.
o Biometric access systems.
Diagram: Security Controls Classification
Security Controls
|
---------------------------------------
| | |
Administrative Technical Physical
7. Summary Diagram: Network Attack & Defense
Strategy
[Attacker]
|
-----------------------------
| | |
Reconnaissance Attack Exploitation
|
-----------------
| |
Defense Strategies Adaptive Security
|
------------------------------
| | |
Administrative Technical Physical
Controls Controls Controls
References:
1. William Stallings, Network Security Essentials, 7th Edition.
2. Eric Cole, Network Security Bible, 2nd Edition.
3. NIST SP 800-53, Security and Privacy Controls for Information Systems and
Organizations.
4. MITRE ATT&CK Framework, https://attack.mitre.org.
