Network Attacks

Name: Network Attacks
Author: Martha Percival-Dangleben

Explore the different forms of network attacks and learn best methods to avoid them

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

(rhythmic instrumental music) Denial of service or DoS occurs when a computer network or application is not available to authorized users due to malicious actions performed by an attacker. The attacker causes the denial of service by flooding the network or application with requests so it crashes. The attacker can use flooding attacks such SYN Flood, exploit application vulnerabilities, or use botnets to attack the targeted device to create a Distributed Denial of Service or DDoS. DDoS occurs when multiple devices operate together to attack a target. To understand how this really works, you'll need to understand how a network functions. On a data network, a device communicates with an application via a port. To transmit the data across the network, the port and a network protocol are needed. A port is a number assigned to uniquely identify a connection for transmitting data to a specific application or service. Think of the port as an exit on the expressway, and the expressway as the network protocol. The most common network protocol used today is the Transmission Control Protocol or TCP/IP. With this protocol, a network connection is created using a three-way handshake. For example, when you open a browser and enter the URL link to access a website on the internet, the port needed to communicate with the website is 80 or 443. If the website URL link begins with http, then port 80 is used for communication. If the website URL link begins with https, then port 443 is used. Https is the secure version of http. Throughout 2021, SYN floods accounted for 54% of all network-layer attacks on average. By using the SYN Flood technique, the attacker sends a large number of messages to the server. Here's a comparison of what happens when you access a website via the normal connection process versus an attacker using the SYN Flood technique. In a normal connection, your device sends a message to the website server. The website server responds with an SYN or synchronize to request a connection to your device, sends an ACK or acknowledgement message to the client, leaves an open port to receive the response. SYN is a TCP packet that contains data. Your computer returns an ACK message to the server to acknowledge receipt of the message from the server. The TCP connection is established, and your device is able to send and receive data. In an SYN flood, the attacker sends a large number of messages from fake IP addresses to the website server. The website server responds with an SYN or synchronize to each of the fake client's IP addresses, sends an ACK or acknowledgement message to each fake client, leaves an open port to receive the response. The server waits for an ACK message from each fake client while the port for each request remains open for a certain length of time, then closes the port. An ACK is never sent from the client. Steps one through three are repeated, causing the server to crash. In 2020, Google reported that they were the victim of a DDoS attack in September of 2017 that peaked at the shocking level of 2.54 terabytes per second. According to Damian Menscher, a security reliability engineer for Google Cloud, the 2.54 terabytes per second peak was attained during a six-month campaign that utilized multiple methods of attacks to hammer Google's server infrastructure. In February 2020, Amazon Web Services reported a DDoS attack which peaked at 2.3 terabytes per second. Signs of a DoS attack can resemble signs of performance issues. Indicators of a DoS attack may include slow network performance when opening files or accessing websites, or unavailability of a particular website. You may not be able to prevent a DoS attack, but there are security measures you can put in place to help in limiting the impact of a potential attack. The following measures are best practices to be proactive. Limit ports and services to only those that are needed for an application to work. Restrict internet access to specific applications that need it. For instance, keep database servers isolated from direct internet access. Use network and web application firewalls. A web application firewall or WAF is designed to protect web applications by filtering and monitoring harmful traffic between a web application and the internet. A network firewall monitors incoming and outgoing traffic and allows or blocks specific traffic based on defined security rules. Implement redundant network and hardware infrastructure. Set up tools to monitor your website activity or traffic, and alert on activity that falls out of range. Use intrusion prevention systems to monitor suspicious traffic, and block known malicious traffic. Keep applications and firmware current with software updates and security fixes. Implement throttle limits to manage the number of requests that are sent to an application. And purchase a DoS protection service that detects abnormal traffic flows, and redirects traffic away from your network.

Intermediate Provider : Martha Percival-Dangleben 3 Lessons · 12m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

Network attacks that result in breaches of either use of resources or of theft of information not only impact an organization’s daily operations, but they also affect its reputation and financial profits when resources are not available to authorized users. Trust in the organization erodes as customers and clients discover that their personal information has been compromised or when the service they expect is not functional. These types of attacks and disruptions have unfortunately become all too common in this digital age.

These lessons on Network Attacks will discuss attacks against private and public networks and the potential impacts of those attacks. You’ll review denial of service attacks which disrupt the availability of an organization’s resources to authorized users. You’ll learn about IP spoofing and how it allows cyber criminals to lurk in your system without detection, and you’ll explore man-in-the-middle attacks. You’ll also gain key methods for arming your system to fend off these attacks.

What You'll Learn

Understand what network attacks are, how they function, and their impacts on organizations
Identify common network attack types, including denial of service attacks, IP spoofing, and man-in-the-middle attacks
Explain how denial of service attacks disrupt the availability of an organization's resources to authorized users
Describe how IP spoofing allows cyber criminals to lurk in a system without detection
Discover proactive steps to take to protect your organization's system against these attacks

Key Takeaways

Network attacks that breach resource use or steal information impact an organization's daily operations, reputation, and financial profits.
Trust in an organization erodes when customers discover their personal information has been compromised or when expected services are not functional.
Denial of service attacks disrupt the availability of an organization's resources to authorized users.
IP spoofing allows cyber criminals to lurk in a system without detection, and man-in-the-middle attacks are another form of network attack covered in the course.
The course provides key methods for arming a system to fend off these attacks.

Frequently Asked Questions

What network attacks does this course cover?

The course covers attacks against private and public networks, including denial of service attacks, IP spoofing, and man-in-the-middle attacks, along with their potential impacts.

What skills will I gain from this course?

You will build skills in areas such as attack patterns, computer network defense, denial-of-service (DoS) attacks, distributed denial-of-service (DDoS) attacks, network security, and network security design.

Will I learn how to defend against these attacks?

Yes. The course teaches key methods for arming your system to fend off these attacks and discover proactive steps to protect your organization's system.

What lessons are included in this course?

The course includes three lessons: Denial of Service, IP Spoofing, and Man-in-the-Middle Attacks.

What will I understand about network attacks after taking this course?

You will understand what network attacks are, how they function, and their impacts, as well as the different types of common network attacks.