Network Security
The Threats Facing a Network
Almost every computer is now connected to a network, and that connection is exactly what attackers try to exploit. Keeping a network secure means understanding two things together: the threats that criminals use, and the defences that block them. Those threats aim at two very different weak spots — the technology itself, and the people who use it.
There are six common forms of attack you should be able to describe: malware, social engineering (such as phishing), brute-force attacks, denial of service attacks, data interception and theft, and SQL injection.
Malware
The word malware is short for ‘malicious software’. Malware is any program written to damage, disrupt or gain unauthorised access to a computer system. It usually reaches a machine when a user opens an infected email attachment, downloads a dodgy file, or plugs in an unknown USB stick.
A virus hides inside a file or program and spreads to other files when that program is run, often corrupting data as it goes. A worm is similar but more dangerous on a network, because it can copy itself and spread between computers on its own, without anyone opening a file.
A Trojan is disguised as a useful or harmless program, so the user installs it themselves, only for it to open a back door for the attacker. Ransomware encrypts the user’s files and demands a payment to unlock them, while spyware quietly records what the user does, such as capturing passwords as they are typed.
Social Engineering and Phishing
Social engineering attacks the human user rather than the machine. Instead of breaking through technical defences, the attacker tricks a person into handing over information or access. Because it targets people, staff are often called the ‘weak point’ — even the strongest firewall is useless if an employee simply gives their password away.
The most common example is phishing, where fake emails or text messages pretend to come from a trusted source, such as a bank or the IT department. They usually contain a link to a fake login page designed to steal whatever the victim types in. A sense of urgency, like ‘your account will be closed today’, is a classic warning sign.
Brute-Force Attacks
A brute-force attack is an attempt to crack a password by trying every possible combination in turn until the right one is found. Attackers use software to test thousands of guesses per second, which is why short, common passwords such as ‘123456’ fall almost instantly, while long, unusual passwords take far longer to break.
Denial of Service Attacks
A denial of service attack, or DoS, floods a server with so many requests at once that it becomes overwhelmed and cannot respond to genuine users. The aim is usually not to steal data but to make a website or service unavailable, which can cost a business money and damage its reputation. When the flood comes from many computers at the same time, it is called a distributed denial of service, or DDoS.
Data Interception and Theft
Data interception and theft means capturing data while it travels across a network. Using software called a packet sniffer, an attacker on an unsecured network — such as free public Wi-Fi — can read the packets passing by and pick out useful information like usernames and passwords.
SQL Injection
SQL injection targets the databases that sit behind many websites. If an input box, such as a login field, is not properly protected, an attacker can type in database commands instead of a normal answer.
Databases are searched using a language called SQL. When a website builds its search out of text typed by the user without checking it first, a carefully written entry can change the meaning of that search. This can trick the database into revealing every record, skipping a password check, or even deleting a whole table. The fix is to validate and clean all input before it ever reaches the database.
Many successful attacks rely on human error rather than clever code. People are described as the ‘weak point’ of security because they can be tricked by social engineering, choose weak passwords, or click a malicious link — which is why staff training matters as much as the technology.
Finding and Removing Vulnerabilities
A vulnerability is any weakness an attacker could exploit. One of the best ways to find them is penetration testing, where security experts are paid to attack a system on purpose, in a controlled way, so that weak points can be discovered and fixed before real criminals find them.
Once weaknesses are known, several prevention methods work together to close them:
- Anti-malware software scans files and memory for malicious programs, then blocks, quarantines or removes anything it finds; it must be updated regularly to recognise new threats.
- A firewall monitors and filters the traffic passing between a network and the outside world, blocking any connection that breaks its rules.
- User access levels control what each person is allowed to see or change, so an ordinary user cannot reach the sensitive files that only an administrator should touch.
- Strong passwords — long, with a mix of letters, numbers and symbols — slow down brute-force attacks, especially when combined with a limit on the number of login attempts.
- Encryption scrambles data using a key, so that even if it is intercepted it is useless to the attacker without that key.
- Physical security protects the hardware itself with measures such as locked server rooms, keycard entry and CCTV, stopping anyone from simply walking up to a machine.
No single method is enough on its own, so organisations layer them, an idea known as defence in depth. A firewall might block an attack from the internet, anti-malware catches anything that slips through, encryption protects the data if it is stolen anyway, and access levels limit the damage a single stolen account can do. If one layer fails, the others still stand.
Prevention methods work best in combination: penetration testing finds the weaknesses, then firewalls, anti-malware, user access levels, strong passwords, encryption and physical security each block a different kind of attack.