Essential Terminologies
Understanding the tactics and techniques adopted by attackers is key to successful cyber defense. Everything in network security revolves around three linked ideas: what you're protecting (asset), what could go wrong (threat), and the weakness that lets it go wrong (vulnerability). Add risk to describe the potential for loss, and you have the core vocabulary of the whole course.
Mnemonic — AT-VR
"A Thief Visits Rich houses" → Asset (the rich house/valuables), Threat (the thief), Vulnerability (unlocked window), Risk (the chance the thief actually breaks in and the loss that follows). If any one of these is missing, there's no real security problem — no asset means nothing to steal, no vulnerability means the thief can't get in.
Causes of Vulnerabilities
- Hardware or software misconfiguration
- Insecure or poor design of network
- Inherent technology weaknesses
- End-user carelessness
- Intentional end-user acts
Examples of Risks
- Disruption of business
- Loss of productivity
- Loss of privacy
- Theft of information
- Legal liability
- Damage to reputation and consumer confidence
Examples of Motives (Why Attackers Attack)
- Disruption of business continuity
- Manipulating data
- Damaging reputation of the target
- Theft of information
Motive is expressed through TTPs — the "how" that turns a motive into an actual attack:
- Tactics — the general strategy
- Techniques — the specific methods
- Procedures — the exact steps performed
An organization's customer database is the asset. A disgruntled ex-employee is the threat actor, motivated by revenge (motive = damaging reputation). An unpatched web server is the vulnerability. If exploited, the risk materializes as data theft, legal liability under regulations like GDPR/HIPAA, and reputational damage.
Types of Threat Actors & Attacks
Not all attackers are the same — their skill level, motive, and resources differ drastically. The slides group attacks into network-level, application-level, and wireless-specific categories, each requiring different defenses.
Network-Level Attacks
Target infrastructure directly — e.g. sniffing, spoofing, DoS/DDoS, MITM, session hijacking, and routing attacks that exploit protocols/devices rather than applications.
Application-Level Attacks
Target software running on top of the network — e.g. SQL injection, XSS, buffer overflows, and other flaws in how an application handles input.
Wireless-Specific Attacks
Exploit the broadcast nature of Wi-Fi — e.g. rogue access points, evil twin attacks, WEP/WPA cracking, jamming, and Bluetooth-based attacks.
Attacker Hacking Methodologies & Frameworks
| Framework | What It Describes |
|---|---|
| CEH Hacking Methodology | The structured phase-by-phase approach ethical hackers/attackers follow (recon → scanning → gaining access → maintaining access → clearing tracks). |
| Lockheed Martin's Cyber Kill Chain | Seven-stage model of an intrusion: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives. |
| MITRE ATT&CK Framework | A knowledge base of real-world adversary tactics and techniques (TTPs), used to map and detect attacker behavior. |
Mnemonic — Kill Chain Order
"Real Weapons Deliver Explosive Impact, Creating Actions" → Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & control, Actions on objectives. Remember: attackers must complete every earlier link before reaching the last one — break any link in the chain and the attack fails.
Importance & Goal of Network Security
A completely secure and robust network can be designed only with proper implementation and configuration of network security elements. These elements work together as layers.
The ultimate goal of network defense is to protect an organization's information, systems, and network infrastructure from unauthorized access, misuse, modification, service denial, or any degradation and disruption. Organizations rely on Information Assurance (IA) principles to attain defense-in-depth security — IA principles act as enablers for an organization's security activities.
Information Assurance (IA) Principles
These five principles are the backbone of nearly every security decision you'll make in this field. Four of them (CIA + one more) map perfectly onto the classic "CIA Triad" extended model, and the last two describe accountability in communication.
Mnemonic — CIANA
"CIANA guards the gate" → Confidentiality (no peeking), Integrity (no tampering), Availability (no downtime), Non-repudiation (no denying), Authentication (no faking identity). All five IA principles spell CIANA — say it like a name and you'll never forget the five pillars.
Alice sends "Transfer amount 500" to a Server. Confidentiality stops a Man-in-the-Middle from reading the amount. Integrity stops the MITM from changing 500 to 5000. Availability ensures the server is actually up to process it. Authentication makes sure it's really Alice sending it — and Non-repudiation stops Alice from later denying she sent the transfer.
Network Defense: Benefits & Challenges
- Protect information assets
- Comply with government and industry regulations
- Ensure secure communication with clients and suppliers
- Reduce the risk of being attacked
- Gain a competitive edge by providing more secure services
- Distributed Computing Environments — vast, complex networks create serious vulnerabilities attackers exploit
- Emerging Threats — attacks evolve daily, becoming more sophisticated and organized
- Lack of Network Security Skills — organizations fail to keep pace due to a skills shortage
Types of Network Defense Approaches
Defense approaches differ by when they act relative to an attack — before, during, or after.
Preventive
Methods/techniques used to avoid threats or attacks before they happen.
Reactive
Methods/techniques used to detect attacks as they occur on the network.
Retrospective
Methods that examine causes of an attack, then contain, remediate, eradicate, and recover from the damage.
Proactive
Methods used to make informed decisions about potential future attacks before they occur.
Mnemonic — PRRP Timeline
"Please Remember, Recovery's Painful" in timeline order: Proactive (predict before) → Preventive (block before) → Reactive (detect during) → Retrospective (clean up after). Think of it as a clock: Proactive/Preventive sit before 12, Reactive sits at 12 (the moment of attack), Retrospective sits after.
Network Security Controls
Controls fall into three broad families. Each answers a different question: administrative controls answer "what's our policy?", physical controls answer "who can touch the hardware?", and technical controls answer "what does the system itself enforce?"
The management implements administrative access controls to ensure the safety of the organization.
- Regulatory framework compliance
- Security policy
- Employee monitoring & supervising
- Information classification
- Security awareness & training
Security measures taken to prevent unauthorized access to physical devices.
- Locks, fences, badge systems
- Security guards, mantrap doors
- Biometric systems, lighting
- Motion detectors, CCTVs, alarms
Security measures taken to protect data and systems from unauthorized personnel.
Access Controls
Authentication
Authorization
Auditing
Security Protocols
Network Security Devices
Mnemonic — APT Controls
"A Prison Tour" → Administrative (the rules of the prison), Physical (the walls, locks, and guards), Technical (the cameras, keycards, and alarm systems). Three layers, three different "guards" protecting the same asset.
Regulatory Frameworks
Complying with regulatory frameworks is a collaborative effort between governments and private bodies to encourage voluntary/mandatory improvements to cybersecurity. IT security regulatory frameworks contain a set of guidelines and best practices.
| Regulatory Framework | Organizations Within Scope |
|---|---|
| HIPAA | Any company/office dealing with healthcare data — doctor's offices, insurers, business associates, employers |
| Sarbanes-Oxley Act (SOX) | U.S. public company boards, management, and public accounting firms |
| FISMA (2002) | All federal agencies — must develop a method of protecting information systems |
| Gramm-Leach-Bliley Act (GLBA) | Companies offering financial products/services — loans, investment advice, insurance |
| PCI-DSS | Companies handling credit card information |
PCI-DSS Requirement 3 says "Encrypt cardholder data" (the regulatory framework) → this drives the organization's Encryption Policy → which specifies standards like DES, AES, RSA → which are implemented via concrete procedures, practices, and guidelines for data encryption.
ISO/IEC 27000 Series (Selected)
| Standard | Objective |
|---|---|
| ISO/IEC 27001 | Formal ISMS specification |
| ISO/IEC 27002 | Information security controls |
| ISO/IEC 27005 | Information security risk management |
| ISO/IEC 27032 | Cybersecurity |
| ISO/IEC 27033-1 to -5 | Network security |
| ISO/IEC 27035 | Incident management |
| ISO/IEC 27037 | Digital evidence (forensics) |
| ISO/IEC 27039 | Intrusion prevention |
| ISO/IEC 27799 | ISO27k in healthcare |
Security Policy
A security policy is a well-documented set of plans, processes, procedures, standards, and guidelines required to establish an ideal information security status of an organization. It informs people how to work safely and defines/guides employee actions on sensitive operations, data, or resources.
Key Elements
- Brief and clear
- Enforceable by law
- Sufficient guidance
- Clear communication
- Defined scope and applicability
- Recognizes areas of responsibility
Contents
- High-level security requirements
- Policy description based on requirement
- Security concept of operation
- Allocation of security enforcement to architecture elements
Types (Scope)
- EISP — Enterprise Information Security Policy (org-wide direction)
- ISSP — Issue-Specific Security Policy (e.g. remote access, passwords)
- SSSP — System-Specific Security Policy (e.g. DMZ, encryption, access control)
Internet Access Policies
No restrictions on Internet/remote access — nothing is blocked.
Known dangerous services/attacks blocked; policy starts open, known holes get plugged.
Everything is forbidden — no internet, or severely limited; users often find ways around it.
Maximum security while allowing known necessary access — all blocked by default, safe services enabled individually.
Mnemonic — Openness Scale
"Promiscuous → Permissive → Prudent → Paranoid" reads as a slider from most open to most locked-down. Promiscuous = wide open door. Permissive = door open, but bad guests are turned away. Prudent = door locked, only invited guests let in. Paranoid = no door at all.
Password Policy — Design Considerations
Password Length and Formation
Minimum length and complexity rules for how a password is constructed.
Password Blacklists
Common/breached passwords are disallowed.
Password Duration
How long a password remains valid before it must be changed.
Common Password Practice
General guidance for everyday safe password habits.
Complexity of Password
Rules requiring a mix of character types to resist guessing/cracking.
Employee Awareness & Training
Organizations must provide formal security awareness training for employees when they join and periodically thereafter, so employees:
- Know how to defend themselves and the organization against threats
- Follow security policies and procedures for working with IT
- Know whom to contact if they discover a security threat
- Can identify the nature of data based on data classification
- Protect physical and informational assets of the organization
Training Methods
- Classroom style training
- Online training
- Round table discussions
- Security awareness website / hints
- Short films, seminars
Social Engineering Awareness
- Phone → impersonation: don't give out confidential info
- Dumpsters → dumpster diving: shred docs, erase magnetic data before trashing
- Email → phishing/malicious attachments: don't download unknown attachments, differentiate legit vs targeted phishing
Advantages of Security Policy Training
Effective implementation of policy; policies are followed and not just enforced; creates awareness on compliance issues; helps the organization enhance its network security.
Network Security Protocols
The chapter closes by naming the essential protocols that provide authentication, authorization, and secure communication over the network — these are studied in more depth in later chapters.
| Protocol | Category |
|---|---|
| RADIUS | AAA (Authentication, Authorization, Accounting) |
| TACACS+ | AAA (Cisco-favored alternative to RADIUS) |
| Kerberos | Network authentication protocol using tickets |
| PGP | Email encryption & signing (Pretty Good Privacy) |
| S/MIME | Secure email standard (encryption + signatures) |
| Secure HTTP (S-HTTP) | Secures individual HTTP messages |
| HTTPS | HTTP over TLS/SSL |
| TLS | Transport Layer Security — encrypts data in transit |
| SSL | Predecessor of TLS |
| IPsec | Secures IP traffic at the network layer (VPNs) |
Exam Tips & Tricks
IA = CIANA
The 5 IA principles are Confidentiality, Integrity, Availability, Non-repudiation, Authentication. Expect a scenario question asking you to match an attack (MITM, DoS) to the principle it violates.
Asset-Threat-Vulnerability-Risk chain
Threat needs a vulnerability to exploit an asset; the result is risk. Questions often ask you to pick which term matches a given description.
Don't confuse defense approaches
Preventive = before attack (avoid). Reactive = during (detect). Retrospective = after (recover). Proactive = before, but based on predicting future attacks — not the same as preventive.
3 Control Categories
Administrative (policy/people), Physical (locks/guards), Technical (systems/software) — every named example in the slides fits one of these three.
Know PCI-DSS & HIPAA scope
PCI-DSS → credit card data. HIPAA → healthcare data. These are the two most commonly tested regulatory frameworks.
Protocol families
RADIUS/TACACS+/Kerberos = AAA & authentication. PGP/S-MIME = email security. HTTPS/TLS/SSL/IPsec = transport/network layer encryption.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Asset | Something of value that needs protecting |
| Threat | Potential danger to an asset |
| Vulnerability | Weakness a threat can exploit |
| Risk | Likelihood × impact of a threat exploiting a vulnerability |
| TTPs | Tactics, Techniques, Procedures — how motive becomes an attack |
| Threat actors | Script kiddies, hacktivists, organized cybercriminals, insiders, state-sponsored/APT, cyber terrorists |
| Attack levels | Network-level, application-level, wireless-specific |
| Cyber Kill Chain | Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives |
| MITRE ATT&CK | Knowledge base of real adversary TTPs |
| Elements of network security | Controls + Protocols + Devices |
| Goal of network defense | Protect info/systems/network from unauthorized access, misuse, modification, DoS, disruption |
| Confidentiality | No unauthorized disclosure (stop MITM reading data) |
| Integrity | No unauthorized modification (stop MITM altering data) |
| Availability | Authorized access without disruption (stop DoS) |
| Non-repudiation | Sender cannot deny sending a message |
| Authentication | Verifying identity before granting access |
| Defense benefits | Protect assets, comply with regs, secure comms, reduce risk, competitive edge |
| Defense challenges | Distributed environments, emerging threats, lack of skills |
| Preventive | Avoid attacks before they happen |
| Reactive | Detect attacks as they happen |
| Retrospective | Contain/remediate/recover after attack |
| Proactive | Anticipate and prepare for future attacks |
| Administrative controls | Regulatory compliance, policy, monitoring, classification, training |
| Physical controls | Locks, fences, badges, guards, mantraps, biometrics, CCTV, alarms |
| Technical controls | Access control, authentication, authorization, auditing, protocols, devices |
| HIPAA | Healthcare data protection |
| SOX | Public company financial reporting controls |
| FISMA | Federal agency information system protection |
| GLBA | Financial products/services companies |
| PCI-DSS | Credit card data handling companies |
| ISO/IEC 27001 | Formal ISMS specification |
| Security policy | Documented plans/procedures/standards for ideal security posture |
| EISP / ISSP / SSSP | Enterprise-wide / issue-specific / system-specific policies |
| Internet access policies | Promiscuous (open) → Permissive → Prudent → Paranoid (closed) |
| Password policy considerations | Length/formation, blacklists, duration, common practice, complexity |
| Social engineering training areas | Phone (impersonation), dumpsters (diving), email (phishing) |
| AAA protocols | RADIUS, TACACS+, Kerberos |
| Email security protocols | PGP, S/MIME |
| Transport/network security protocols | HTTPS, TLS, SSL, IPsec |