📚 Complete Study Guide

Network Security
& Privacy

Everything from your lecture, reorganised with mnemonics and memory tricks so you actually remember it.

01

Why Do Security Breaches Happen?

Causes
🧠 Mnemonic
Humans Plant Seeds Of Havoc

Human error · Physical access · Software holes · Operating system flaws · Hackers exploiting all of the above

🧑‍💻

Human Error

Employees install pirated software carrying viruses, forget to lock workstations, or share passwords.

🚪

Physical Access

Someone walking up to a server can extract data directly — locks matter as much as firewalls.

⚙️

OS & Protocol Holes

Unpatched operating systems and flaws in TCP/IP protocols give attackers easy entry points.

🌐

Network Device Flaws

Default settings on routers and switches are well-known — change them or pay the price.

02

Types of Network Security Attacks

Threats
🧠 Master Mnemonic — remember ALL attack types
Ugly Snakes Sneak Past Every Cool Man's Identity, Destroying All Real Lives

Unstructured · Structured · Social Engineering · Password · Exploit · Compromised-Key · Man-in-the-Middle · IP Spoofing · DoS/DDoS · Application-layer · Resource · Logic Bomb

🔨 Unstructured

Script kiddies using downloaded tools. They often don't even know what they're attacking — but can still expose sensitive data.

💡 Think: "kid with a hammer"

🎯 Structured

Expert hackers with deep OS/networking knowledge who write custom tools to exploit specific vulnerabilities.

💡 Think: "surgeon with a scalpel"

🎭 Social Engineering

Exploiting human trust via fake calls or emails. Phishing — duplicating sites to steal credentials is a prime example.

💡 Think: "con artist in a suit"

🔑 Password Attacks

Dictionary attacks guess passwords using patterns. A compromised admin account = entire network at risk.

💡 Think: "skeleton key"

🐛 Exploit Attacks

Taking advantage of software bugs or misconfigurations to gain access to private data.

💡 Think: "bug in the wall"

👂 Eavesdropping

Sniffing unencrypted traffic. Wireless networks are especially vulnerable. Encryption prevents this.

💡 Think: "wiretap on unencrypted pipe"

🗝️ Compromised-Key

Attacker obtains a sender's private key and can decrypt secured traffic — requires significant skill and resources.

💡 Think: "stealing the master key"

🕵️ Man-in-the-Middle

Intercepts and modifies traffic between two nodes by rerouting packets through the attacker's machine.

💡 Think: "someone opening your mail, resealing it"

🎭 IP Spoofing

Faking a legitimate IP address to disguise malicious traffic as trusted communication.

💡 Think: "fake license plate"

💥 DoS / DDoS

DoS = one source floods a server. DDoS = thousands of infected devices attack simultaneously. Server becomes unreachable.

💡 Think: "traffic jam blocking the highway"

💣 Logic Bomb / Time Bomb

Malicious code sitting dormant until a condition is met (e.g., sys-admin doesn't log in for a month). Then it detonates.

💡 Think: "sleeping grenade"

🚪 Backdoors

Hidden accounts or commands left in systems — even by insiders. Stealth backdoors don't appear in audits.

💡 Think: "secret passage in the castle"

📧 Email Bombing

Flooding an inbox with spam until storage quota fills — a form of DoS targeting email servers.

💡 Think: "stuffing a letterbox solid"

📱 Application-Layer

Targeting server/workstation apps using viruses, Trojans, and worms to infect and extract data.

💡 Think: "Trojan horse inside the app"
03

DoS vs DDoS — Quick Comparison

Key Distinction
Attack Type Source How it works Example Severity
DoS 1 source Floods server with auth requests using invalid return addresses — server keeps waiting, gets stuck. Single attacker pinging a server non-stop High
DDoS Many sources Thousands of compromised "zombie" devices attack simultaneously — near-impossible to block. Botnet of infected devices targeting a bank Critical
04

Types of Cyber Crime

Crimes
🧠 Mnemonic
Fraudsters Terrorise Trespassing Pirates

Fraud (Computer Fraud) · Terrorism (Cyberterrorism & Hacktivism) · Trespass (Cybertrespass & Vandalism) · Piracy (Cyber-piracy / Software piracy)

💳 Computer Fraud

Deception for personal gain — assuming a false identity or altering data in online transactions.

💣 Cyberterrorism

Politically motivated hacking causing grave harm — loss of life or severe economic damage. Hacktivism is a milder version (disrupt but not destroy).

🚫 Cybertrespass

Unauthorised access to computer systems or password-protected sites. Cybervandalism = unleashing programs that corrupt data or crash networks.

📦 Cyber-piracy

Copying/distributing copyrighted software. Most widespread because it needs minimal skill and many consider it morally okay. Cracking DRM = security breach.

05

Countermeasures & Security Culture

Defence
🧠 Mnemonic — remember ALL countermeasures
Smart People Always Secure All Big Enterprises Reliably

Self-policing · Password security · Audits · Security software · Access controls (smart cards, biometrics) · Behavioral/ethical standards · Encryption · Resources (enough staff)

06

Deep Dives — Tricky Concepts

Exam Focus
How exactly does a DoS attack work? 🤔

The attacker sends a massive number of authentication requests with invalid return addresses.

The server tries to respond — but the return address doesn't exist, so it waits for a timeout before closing the connection.

While it's waiting, the attacker sends more invalid requests. The server is perpetually busy processing fake requests and cannot serve legitimate users.

Think of it like calling a restaurant, placing an order for delivery, then giving a fake address. They wait for you to answer, can't reach you, and while they're stuck on hold — real customers can't get through.

What makes stealth backdoors extra dangerous? 🚪

Regular backdoors (extra admin accounts) show up in security audits. Stealth backdoors do not.

They allow remote connections with root privileges — meaning the attacker can install anything, read anything, and destroy anything.

Even if a malicious sys-admin is fired, a stealth backdoor gives them continued access. An outside independent auditor doing surprise checks is the main defence.

Social Engineering vs Phishing — what's the difference? 🎭

Social Engineering is the broad category — any manipulation of human psychology to gain information. This includes phone calls, impersonation, pretexting.

Phishing is a specific type of social engineering done through electronic communication (email, fake websites). Entire websites are cloned to steal credentials.

Memory trick: Phishing = fishing for info by casting a fake bait (website/email) into the sea of users.

Logic Bomb vs Time Bomb — same thing? 💣

Logic Bomb: Code that triggers when a specific condition is met (e.g., a file is deleted, a name appears, a date arrives).

Time Bomb: A subtype of logic bomb where the trigger is the absence of regular input. Classic example: a sys-admin must log in monthly — if they don't, the bomb activates and can obliterate the system.

Once a time bomb activates, it is described as unstoppable.

What's the difference between Cyberterrorism and Hacktivism? ⚡

Cyberterrorism: Politically motivated attacks intending to cause grave harm — death or severe economic loss.

Hacktivism: Also political, but the intent is to disrupt operations without causing serious lasting damage. Think protest, not warfare.

Key distinction: severity of intended harm.

📊 Chapter at a Glance

3

Main causes of breaches (Human, Physical, Tech)

14

Distinct attack types to know

4

Types of cyber crime (Fraud, Terror, Trespass, Piracy)

9

Countermeasures / security culture recommendations

2

Hardware auth methods (Smart Cards + Biometrics)

∞

Importance of encryption for eavesdropping prevention

08

Practice Questions

Self-Test

Q1 — Causes of Breaches

Using the H·P·S·O·H mnemonic, explain each cause of a security breach. A company discovers that an employee installed pirated software containing malware and that a network switch still had its factory-default settings. Which two causes apply here?

Q2 — Attack Classification

Classify each of the following attacks using the attack types covered in the chapter:

a) An attacker intercepts and silently reads encrypted messages between two parties by compromising their keys.
b) Thousands of infected home routers simultaneously flood a government website.
c) A malicious sys-admin embeds code that will destroy all server data 30 days after they are terminated.
d) A hacker uses a downloaded script with no deep knowledge of the system being attacked.

Q3 — DoS vs. DDoS

Explain precisely how a DoS attack works at the protocol level (invalid return addresses, server waiting). Then explain what makes DDoS significantly harder to defend against than a standard DoS. Which network infrastructure resource is typically targeted in a volumetric DDoS?

Q4 — Cyber Crime Types

Using the F·T·T·P mnemonic, categorize the following incidents:

a) A hacker group defaces a government website to protest a new law, causing temporary disruption but no lasting damage.
b) An attacker assumes a false identity online to redirect payments to their own account.
c) A user downloads a cracked version of commercial software and distributes it freely.
d) A group infiltrates a power grid's control systems with the stated intent of causing a blackout affecting millions.

Q5 — Countermeasures

A small company's entire IT infrastructure is managed by a single system administrator who has worked there for 10 years. Using the S·P·A·S·A·B·E·R mnemonic, identify three specific countermeasures that are especially important given this single-point-of-trust risk and explain why each applies.

Q6 — Logic Bomb vs. Time Bomb

A disgruntled employee writes code that monitors the HR database. The code is set to destroy all files if the employee's name is removed from the payroll system. Is this a logic bomb or a time bomb? Explain the distinction. What is the most effective organizational countermeasure against this specific threat?

Q7 — Comparison: Cyberterrorism vs. Hacktivism

What is the key distinction between cyberterrorism and hacktivism? Both are politically motivated — what factor determines which category an attack falls into? Provide a concrete example of each that illustrates the difference clearly.

Q8 — Eavesdropping & Encryption

An employee works remotely and frequently connects to the company's internal systems over an unencrypted Wi-Fi network at a café.

a) Which attack type makes this scenario dangerous?
b) What specific countermeasure should the company require to prevent this?
c) Why are wireless networks particularly vulnerable to this type of attack compared to wired networks?