Common Types of Attacks
Common Types of Attacks
A network exists to provide access, and every form of access creates exposure. This chapter explains how technology-based, human, environmental, and physical attacks work—and connects each threat to practical hardening, segmentation, access-control, and monitoring defenses.
Understand the Attack Before Choosing the Defense
Networks are inherently exposed because they share resources with users and devices that are not physically beside the system. Installing a network interface creates a path for legitimate communication—but potentially also for reconnaissance, deception, interception, disruption, or unauthorized access.
Technology-based
Exploits protocols, software, firmware, devices, or configurations. Examples include DDoS, DNS poisoning, VLAN hopping, ARP spoofing, and malware.
Human-based
Manipulates trust, urgency, fear, curiosity, or authority. Phishing and other social-engineering techniques target decision-making rather than code.
Physical/environmental
Targets facilities, equipment, media, or physical access. Theft, tampering, tailgating, shoulder surfing, heat, water, and power events can all affect security.
DoS, DDoS, Reflection, and Amplification
A denial-of-service (DoS) attack exhausts bandwidth, CPU, memory, connection tables, or another limited resource so legitimate users cannot obtain service. A distributed DoS (DDoS) uses many compromised devices—often a botnet coordinated through command-and-control infrastructure—making source filtering and response more difficult.
| Attack form | How it works | Key distinction |
|---|---|---|
| Reflective DoS | Third-party systems reply to requests carrying the victim's spoofed source address | The response is reflected toward the victim |
| Amplified DoS | A small query produces a much larger response, commonly through exposed DNS or NTP services | Response volume is larger than request volume |
| Friendly/unintentional DoS | Legitimate demand unexpectedly exceeds capacity | No malicious traffic is required |
| Physical DoS | Damage, disconnection, or theft makes equipment unavailable | The service fails through physical loss |
| Permanent DoS / phlashing | Firmware is deliberately corrupted | The device may become unusable until repaired or replaced |
On-Path, DNS Poisoning, VLAN Hopping, and ARP Spoofing
On-path attack
The attacker positions between communicating parties to eavesdrop, intercept, relay, or modify traffic while each party believes it is communicating directly with the other.
DNS poisoning/spoofing
False DNS information maps a trusted name to an attacker-controlled address. The victim may reach a convincing fake service and disclose credentials.
VLAN hopping
Double-tagged Ethernet frames exploit native-VLAN handling to reach a different VLAN. Avoid using the native VLAN for users and harden trunk configurations.
ARP spoofing/poisoning
Forged ARP messages associate the attacker's MAC address with another host's IP address, often the default gateway, enabling interception or disruption on the local segment.
Rogue DHCP, Rogue AP, Evil Twin, and Deauthentication
| Threat | What the attacker controls | Likely effect | Useful defenses |
|---|---|---|---|
| Rogue DHCP | Unauthorized DHCP replies | Victims receive a malicious gateway, DNS server, or other configuration | DHCP snooping, switch-port controls, monitoring |
| Rogue AP | Unauthorized access point connected to the wired network | Creates an unmanaged wireless entry point | Wireless scanning, NAC, switch-port security |
| Evil twin | Fraudulent AP imitating a trusted SSID | Users connect to the attacker's wireless service | 802.1X/EAP certificate validation, user awareness, WIDS/WIPS |
| Deauthentication | Forged 802.11 management frames | Clients are disconnected, sometimes to push them toward an evil twin | Protected management frames, wireless monitoring |
A rogue AP and an evil twin can overlap, but they are not identical. Rogue describes unauthorized infrastructure; evil twin describes impersonation of a legitimate wireless identity.
Password Attacks, Spoofing, and MAC Flooding
Dictionary attack
Tries likely passwords from wordlists and known credential patterns. Long, unique passwords and MFA make common guesses less useful.
Brute-force attack
Systematically attempts combinations. Online attacks face rate limits and lockouts; offline attacks against stolen hashes can proceed without contacting the service.
MAC or IP spoofing
Forges a source identity to impersonate a trusted device, bypass weak filters, redirect replies, or conceal the true origin. A source address alone is not strong authentication.
MAC flooding
Overloads a switch's CAM/MAC address table with fabricated source addresses. If entries cannot be learned normally, some traffic may be flooded beyond its intended port.
Malware Changes the Host—and Often the Network
Malware is code intentionally designed to damage, disrupt, spy on, or gain unauthorized access to systems. Network teams may observe command-and-control traffic, unusual DNS requests, lateral movement, bandwidth spikes, scanning, or unexpected encryption even when the initial infection is host-based.
Ransomware
Encrypts or exfiltrates data and demands payment. Segmentation, tested offline backups, least privilege, patching, and detection reduce impact.
Trojan
Disguises malicious functionality as legitimate software. Trusted distribution, application controls, and user awareness reduce installation risk.
Keylogger
Records keystrokes to steal credentials and sensitive data. Endpoint protection and MFA can limit the usefulness of captured passwords.
Rootkit
Hides malicious activity by altering low-level operating-system behaviour. Detection and recovery may require trusted offline tools or rebuilding the system.
Spyware
Collects activity or information without informed consent, often sending the results to an external service.
Cryptominer
Consumes CPU/GPU and electrical resources to mine cryptocurrency, degrading performance and increasing operational cost.
Attackers Exploit Trust and Physical Opportunity
| Technique | Meaning | Primary response |
|---|---|---|
| Social engineering | Manipulates a person into revealing information or performing an unsafe action | Security awareness, verification procedures, and low-friction reporting |
| Phishing | Uses fraudulent messages or sites to steal credentials or deliver malware; spear phishing targets a specific person or group | Email/web controls, MFA, awareness, and independent verification |
| Tailgating | An unauthorized person follows an authorized person into a restricted area without permission | Mantraps, badges, guards, and challenge culture |
| Piggybacking | An authorized person knowingly permits the unauthorized entry | Policy, awareness, enforcement, and access controls |
| Dumpster diving | Retrieves sensitive material from discarded items | Secure disposal, shredding, and media destruction |
| Shoulder surfing | Observes screens, PINs, passwords, or confidential work | Privacy screens, positioning, vigilance, and protected entry |
Device and Protocol Hardening
Hardening removes avoidable exposure and makes remaining services more resistant to attack. Begin with an approved secure baseline, then maintain it through configuration control, patching, monitoring, and periodic validation.
Secure the device
Change default credentials, use MFA where supported, patch firmware and software, restrict management access, back up configurations, enable logging, and disable unnecessary accounts and services.
Use secure protocols
Replace Telnet with SSH, HTTP with HTTPS, and insecure file-transfer methods with appropriate protected alternatives such as SCP or SFTP. TFTP has no native authentication or encryption.
Close unused paths
Disable unused TCP/UDP services, switch ports, virtual interfaces, radio functions, and administrative interfaces. Document exceptions rather than leaving them open by habit.
Manage keys
Use approved algorithms and key sizes, protect private keys, rotate keys according to policy, revoke compromised material, and re-key systems after suspected exposure.
ACL Processing
An access control list (ACL) evaluates ordered permit/deny rules from top to bottom. The first matching rule determines the action, and many ACL designs include an implicit deny after the explicit rules. Place specific rules carefully and test them so legitimate management or business traffic is not accidentally blocked.
VLANs, Firewalls, DMZs, 802.1X, and NAC
Layer 2
VLANs separate broadcast domains. Port security and MAC filtering can restrict edge access, though MAC addresses can be spoofed and should not be the only control.
Layer 3–7
ACLs and firewalls control permitted flows between subnets, VLANs, security zones, applications, and external networks.
Screened subnet / DMZ
Places public-facing services between external and internal trust zones so compromise does not provide direct access to the private network.
802.1X provides port-based network authentication using a supplicant, authenticator, and authentication server. Network Access Control (NAC) can additionally assess device identity, posture, antivirus status, patch state, or policy compliance before granting normal access. Noncompliant devices may be denied or placed into a remediation network.
IoT, Industrial Networks, Surveillance, and Locks
IoT and IIoT
Smart devices and industrial sensors often prioritize cost, availability, or long service life. Inventory them, change defaults, patch where possible, restrict Internet access, and isolate them from user and server networks.
ICS and SCADA
Industrial control and supervisory systems monitor or control physical processes in manufacturing and utilities. Safety, deterministic operation, vendor constraints, and downtime risk require carefully planned security changes.
Video surveillance
Fixed and PTZ cameras may use coaxial CCTV or Ethernet/IP networks. IP cameras frequently use PoE, so secure camera VLANs, credentials, storage, management access, and switch power capacity.
Physical locks
Door, cabinet, rack, cable, equipment, and USB locks deter unauthorized access, theft, tampering, and accidental misuse. Locks work best with access records, alarms, guards, and surveillance.
Identify the Attack from the Evidence
Select an observation to reveal the most precise attack term and the clue that distinguishes it.
The attack or defensive control will appear here.