Skip to content

Common Threats and Attack Vectors of Network Devices

Threat Description Attack Vector
Unauthorised access Gain unauthorised control of a network device, and then the complete network. Password attacks (brute force, dictionary & hybrid) - Exploit known vulnerabilities, e.g. RCE Social Engineering/Phishing attack to trick network administrators into disclosing sensitive information such as usernames and passwords of devices
Denial of Service (DoS) Disruption of critical devices and services to make them unavailable to genuine users. Flooding devices with fake requests, Exploiting vulnerabilities in logical or resource handling, Manipulating network packets
Man-in-the-Middle Attacks Intercept the network requests between two parties by masquerading as each other to steal sensitive information or alter/manipulate the requests. ARP spoofing, DNS spoofing, Rogue access points
Privilege escalation Gaining higher-level privileges or rights to perform restricted actions, e.g. accessing sensitive information or executing malicious code. Weak passwords, or use of the same passwords for user and admin accounts, Exploiting vulnerabilities, Misconfigurations
Bandwidth theft/ hotlinking Linking a bandwidth-intensive resource (image or video) from an external website to its original website, without permission. This can cause increased traffic to the original website. Scraping large volumes of data, DoS attacks, Malware attacks

Common Hardening Techniques

  • Updating & Patching: Outdated OS and applications contain vulnerabilities that attackers can exploit.
  • Disabling unnecessary services & ports
  • Principle of Least Privilege (POLP):

  • Logs Monitoring:

    • Syslog: A protocol to standardise the transfer of log messages, with the purpose of storing and analysing log messages to a central server.
    • SNMP: Traps a notification sent by a network device to a management system when a predefined event occurs.
    • NetFlow: A protocol used to collect and analyse network traffic data for monitoring and security analysis.
    • Packet Captures: Capturing network traffic and storing it for analysis using a tool like Wireshark.

  • Backup regularly

  • Enforcing Strong Passwords
  • Multi-Factor Authentication (MFA)
  • Secure Protocols
    • HTTPS
    • SSH
    • SSL/TLS
    • IPsec
  • Removal/Blocking of Insecure Protocols
    • FTP
    • HTTP
    • SMTP and more...

Hardening Virtual Private Networks VPN [Standard Hardening Practices]

  • Use strong encryption algorithm
  • Keep VPN gateway software up-to-date
  • Implement strong authentication
  • Change default settings
  • Enable Perfect Forward Secrecy (PFS): in OpenVPN generates unique session keys for each session to strengthen the security of the VPN connection.

Hardening routers, Switches & Firewalls

  • Setting up the device: fill in all relevant details like hostname, timezone, logging, and more. These features assist in conducting incident handling in case of a compromise.
  • Change default credentials
  • Enable secure network protocols
  • Disabling unnecessary scripts
  • Securing Wi-Fi
  • Monitor traffic
  • Configuring port forwarding
  • Monitoring scheduled tasks
  • Update firmware

Tools for Network Monitoring