Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
Network Attacks: DoS, Spoofing, Sniffing
Three things attackers go after
Think of the post. An attacker can block the post office door so nothing gets through (availability). They can forge the return address on a letter (identity). Or they can steam letters open, read them, and even change them (confidentiality and integrity).
Network attacks fall into the same three groups, and the exam usually wants the one control that best matches the attack.
Denial of service
A denial-of-service (DoS) attack stops genuine users reaching a service by exhausting its bandwidth, processing, memory or connections. A distributed DoS (DDoS) comes from many sources at once, usually a botnet, so you can’t simply block one address.
- Volumetric: floods of traffic fill the pipe (UDP and amplification attacks).
- Protocol: abusing how protocols work, such as a SYN flood, which starts thousands of TCP handshakes and never finishes them, leaving half-open connections.
- Application-layer: lots of normal-looking requests to expensive functions like search or login.
Controls: DDoS protection services and content delivery networks, upstream filtering by the ISP, rate limiting, SYN cookies, spare capacity, and a DDoS response plan. A big attack overwhelms your own firewall before it can filter, so mitigation has to happen upstream.
Example. An online retailer’s site is knocked offline by a DDoS attack on its busiest sales day. Its on-premises firewall is overwhelmed before it can filter anything. Mitigation needs to happen upstream, through the ISP or a cloud DDoS protection service with enough capacity to soak up the traffic.
Identity attacks: spoofing
Spoofing fakes an identity: an IP address, MAC address, email sender or caller ID.
- Ingress filtering blocks incoming packets that claim to come from internal addresses.
- Egress filtering stops internal machines sending packets with forged source addresses.
- ARP spoofing / poisoning on a local network links the attacker’s MAC address to another machine’s IP, diverting its traffic. Dynamic ARP inspection and port security stop it.
- Email spoofing is countered with SPF, DKIM and DMARC.
Confidentiality and integrity attacks
- Sniffing (eavesdropping): capturing traffic. Switched networks reduce exposure, but encryption is the real defence.
- Man-in-the-middle (on-path): the attacker sits between two parties, passing traffic on and perhaps changing it. Countered by mutual authentication, certificate validation and encrypted protocols.
- Replay attack: a valid message (like a login exchange) is captured and sent again later. Countered by timestamps, nonces (one-time numbers), sequence numbers and one-time session tokens.
- Session hijacking: taking over a logged-in session, for example by stealing its cookie. Countered by TLS, secure cookie settings and session timeouts.
- DNS poisoning and hijacking: fake DNS records, or a hijacked domain registration, send users to a malicious site. Countered by DNSSEC, hardened resolvers and registrar locks.
Reconnaissance
Before attacking, attackers scan ports, map networks and find out which software versions are running. Firewall logs and IDS can spot scanning, and exposing fewer services gives attackers less to find.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Best control against sniffing | Encryption |
| Control against replay attacks | Timestamps, nonces or sequence numbers |
| Control against IP spoofing | Ingress and egress filtering |
| Control against man-in-the-middle | Mutual authentication / certificate validation |
| Attack using many compromised computers | Distributed denial of service (botnet) |
| Control against email spoofing | SPF, DKIM, DMARC |
In short
- A denial-of-service (DoS) attack overwhelms a system so legitimate users can't use it; a distributed DoS (DDoS) uses many sources, often a botnet.
- Spoofing falsifies an identity, such as an IP address, MAC address, email sender or caller ID.
- Sniffing (eavesdropping) captures network traffic; encryption is the main countermeasure.
- Man-in-the-middle (on-path) attacks intercept and possibly alter communications between two parties.
- Replay attacks resend captured valid messages; timestamps, nonces and session tokens prevent them.
- DNS attacks (poisoning, hijacking) redirect users to malicious sites.
- Port scanning and reconnaissance often precede attacks; monitoring can detect them.
Exam traps
- Best defence against sniffing is encryption, not switches alone.
- Mutual authentication and certificate validation counter man-in-the-middle attacks.
- Ingress and egress filtering stops spoofed source addresses entering or leaving the network.
- DDoS mitigation usually needs upstream help: ISP or cloud scrubbing services.
- A SYN flood exploits the TCP handshake by leaving half-open connections.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Denial of service
Attack and matching control