Network Attack and Defense

Learning outcomes:

  • Describe common network threats, such as scanning, sniffing, and wireless attacks
  • Explain how firewalls, a DMZ, and DNS security protect a network
  • Describe how network monitoring and logging help detect attacks
  • Compare false positives with false negatives, and allowlists with denylists

Would you like to download my PowerPoint to follow along?

  • What is a network?
  • Network threats: scanning
    • IP scans and port scans
    • Network reconnaissance
    • Mapping with tools such as Zenmap
  • Network threats: sniffing
  • Network threats: wireless
    • Scanning and cracking tools, such as Aircrack-ng and Reaver
    • Encryption types: WEP, WPA, WPA2, and WPA3
    • Wi-Fi broadcasting, demo with airodump-ng
  • Network threats: Internet of Things
    • Bluetooth
    • Personal and body area networks (PAN and BAN)
    • Home automation, such as Zigbee, Nest, and Alexa
  • Network threats: hardware
    • Vulnerable devices, such as routers and printers
    • Secure communications
  • Firewalls
    • Network based and host based
    • Packet filtering against application firewalls
    • Rules allow or deny traffic by port, protocol, and where it comes from
    • Rules are checked in order, and the first rule that matches wins
    • The default policy decides what happens to traffic no rule matches: deny all or allow all
  • Network management: DNS
    • How DNS works
    • Authoritative and non-authoritative answers
    • DNS hijacking for ads, statistics, and censorship
    • DNS caches and DNS cache poisoning
    • DNSSEC
    • Split DNS
  • Network management: DMZ
    • Common services: web, email, FTP, and VoIP servers
  • Network management: monitoring
    • Testing
    • Network tomography, the health of links
    • Route analysis
    • Internal and external monitoring
    • Example software: Nagios
  • Network management: logging
    • Log faults (application and system) and info (users, files)
    • Log integrity: dedicated log servers and redundancy
    • Log review, audits, and analysis
    • Forensics after the fact
  • Red flags and false alarms
    • Allowlists and denylists
      • Allowlist: only the things on the list are allowed
      • Denylist: everything is allowed except the things on the list
      • You'll still see whitelist and blacklist in older tools, documentation, and job postings. The industry is moving away from those terms because they tie white to good and black to bad, and the new terms say what the list does.
    • False positives and false negatives

Suggested Activities and Discussion Topics:

  • Activity: run Wireshark for a few minutes on your own network. What protocols do you see?
  • Discussion: is a false positive or a false negative worse for a business? Why?
  • Discussion: what devices on your home network could be a weak point?
  • Try my Firewall Simulator: build some rules and see which traffic gets through.
  • Follow the instructions on this PDF (accessible HTML version)

Would you like to see some more classes? View all classes