“Take good care of your network Infrastructure”
An organisation’s network infrastructure is usually large and complex.They are helpful for the business operations but they also pose a huge security threat when not properly maintained. When an attack is targeted against an organisation, the network would be the first to be compromised.
What is a Network Attack?
Network attacks happen when an attacker tries to gain unauthorised access to the network with an aim to steal data, infect the system with malware and to perform other malicious actions.
The attackers can be classified into two types;
- Active Attackers: Active attackers can gain access to the network and also modify the data, encrypt it or even delete information.
- Passive attackers: Passive attackers are the ones who gain access to the network and monitor the traffic to steal data without modifying it. These attacks are the most dangerous because the organisations will not be aware that the attack has taken place and what information has been compromised/stolen.
Types of Network Attacks:
Virus:
A computer virus is a form of malware that reproduces itself when implemented. When the user runs a program that has a virus embedded in it, the virus takes control of the system and reproduces through the files or network. Viruses are of different types based on their functionality.
Worms:
A worm is a type of malware that self-replicates and is one of the very dangerous and fast spreading malware. It takes advantage of the Network transport features like email attachments and instant messaging. Worms have the ability to edit, delete files and even inject additional malware into the system. In addition to these, it can also install a backdoor so that a hacker can gain access to the system by avoiding the authentication process.
It is very hard to contain the worm because it spreads rapidly.
Denial of Service:
A Denial of service attack(DOS) is a cyber attack in which the attackers (hackers) aim is to render a system or network resource unavailable for the user by disrupting the services by constantly flooding it with requests.
A distributed denial-of-service (DDoS) attack is a cyber attack where multiple devices attack a victim’s system/server simultaneously by disturbing the normal traffic and overwhelming the target/victim or its surrounding infrastructure with multiple requests at once.
Man in the Middle Attack: (MITM)
A man in the middle attack follows the eavesdropping principle. A man in the middle attack happens when the attacker intercepts conversation between the sender and the recipient. By intercepting this conversation the hacker will be able to collect information and if the conversation is not encrypted, the attacker will be able to easily steal data and also alter it.
Session Hijacking:
The session Hijacking is a type of MITM attack where the hacker hijacks the session between a client and a trusted network.
Replay Attack:
A replay attack is where the attacker is in between conversation and collects data and uses this data later by impersonating one of the participants.
This type of attack is usually stopped by using a session id or a nonce and the right method of encryption.
IP Spoofing:
IP Spoofing is an impersonation attack, where the hacker creates an ip packet with a false source IP address with an aim of impersonating another computer system. This makes the receiving system believe that the packet is from a genuine source. This type of attack is popular in the Denial of service attack which aims to overwhelm networks with traffic at once.
Privilege Escalation:
This is one of the common ways for an attacker to gain unauthorised access to a system.
The attacker looks for weaknesses in a system and tries to exploit it and gain access and thereby use this to gain privileged access. There are two types of Privilege escalation, Horizontal and vertical. Horizontal privilege escalation allows the attacker to gain access to resources which are usually denied to users, whereas vertical privilege escalation is when an attacker gains higher access than the administrator.
Insider Threat:
Insiders are one of the most dangerous threat actors. They pose the major threat to an organisation. Since insiders have access to the system and network and are fully aware of the network and know where the network is vulnerable to an attack. This fact makes it harder to detect and protect against.
How to Mitigate Network Attacks?
Every organisation or home device is prone to attacks if it is connected to the internet. So it is important to safeguard your network by implementing appropriate safety measures.
- One of the most important steps is to implement and monitor the firewall rules. Firewalls help to stop unauthorised access to the network by blocking unknown traffic from entering your network.
- There must be a proper antivirus(AV) and antimalware(AM) software installed in the system. If an AV or AM detects a program that has malicious code embedded in it, it quarantines the program separately and prevents it from attacking.
- Another safety measure would be to set up a VPN connection. A VPN is used to create a far more secure connection between remote computers and other “local” computers and servers.
A good Network security is important for an organisation to avoid the risk of being attacked. It helps to safeguard the workstations from such attacks. If a network is secure, the users can work without any hindrance and the fear of being attacked.
If your system is compromised or if you would like to be prepared you can contact us at info@rootfloe.com for a free consultation.
Shivashankar is a Business Associate at Rootfloe and has a masters degree in Cyber security from Royal Holloway University of London.
https://www.rootfloe.com
Business Associate
