{"id":20127,"date":"2026-09-29T02:21:03","date_gmt":"2026-09-29T06:21:03","guid":{"rendered":"https:\/\/www.netwitness.com\/?post_type=glossary&#038;p=20127"},"modified":"2026-10-13T05:32:12","modified_gmt":"2026-10-13T09:32:12","slug":"network-attack","status":"publish","type":"glossary","link":"https:\/\/www.netwitness.com\/cyber-glossary\/network-attack\/","title":{"rendered":"Network Attack"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"20127\" class=\"elementor elementor-20127\" data-elementor-post-type=\"glossary\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d7f09d2 e-flex e-con-boxed e-con e-parent\" data-id=\"d7f09d2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7565758 elementor-widget elementor-widget-heading\" data-id=\"7565758\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is Network Attack?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-da689aa elementor-widget elementor-widget-text-editor\" data-id=\"da689aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A network attack is an attempt to compromise systems, services, communications, or data by exploiting or misusing a network and the devices connected to it.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The attack may attempt to:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Gain unauthorized network access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Intercept communications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Steal credentials or sensitive information<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Manipulate network traffic<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exploit a network vulnerability<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Discover systems and services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Move between internal systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Establish command-and-control communications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exfiltrate information<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Disrupt or disable services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">NIST describes an attack broadly as malicious activity intended to collect, disrupt, deny, degrade, or destroy information system resources or information. Its definitions also include attempts to gain unauthorized access or compromise system confidentiality, integrity, or availability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A computer network attack therefore does not have to begin with an obviously malicious packet. An attacker may first compromise an account through phishing, exploit a vulnerable internet-facing service, or abuse credentials obtained elsewhere. The network attack becomes visible as that access is used to communicate with systems, enumerate resources, move laterally, control compromised hosts, or transfer data.<\/span><\/p><p><span data-contrast=\"auto\">A network attack is malicious activity that targets, uses, or travels through a computer network to gain unauthorized access, disrupt services, manipulate communications, steal information, or compromise connected systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Some network attack are easy to recognize. A distributed denial-of-service attack that overwhelms an internet-facing service with traffic leaves an obvious operational impact. Others are deliberately quiet. An attacker using valid credentials may move between internal systems, query network services, and communicate with external infrastructure without generating anything that immediately looks malicious.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That difference matters. Modern network attack detection depends on more than finding a known malware signature or blocking a suspicious IP address. Security teams increasingly need to understand how systems normally communicate, recognize changes in those patterns, and preserve enough network evidence to reconstruct what happened when a network attack is discovered.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c0a0ede e-con-full e-flex e-con e-child\" data-id=\"c0a0ede\" data-element_type=\"container\" data-e-type=\"container\" id=\"synonyms\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a3b8a4f elementor-widget__width-initial elementor-widget elementor-widget-heading\" data-id=\"a3b8a4f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0fdb30d e-con-full e-flex e-con e-child\" data-id=\"0fdb30d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1a15d76 elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"1a15d76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Cyberattack<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Breach<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Cyber Intrusion<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Exploit<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Malicious Attack<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Intrusion<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Compromise<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Penetration<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Security Attack<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Denial-of-service (DoS) Attack<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Man-in-the-middle (MITM) Attack<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Distributed Denial-of-Service (DDoS) Attack<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9397ba4 elementor-widget elementor-widget-heading\" data-id=\"9397ba4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Does a Network Attack Work?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef941d5 elementor-widget elementor-widget-text-editor\" data-id=\"ef941d5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">There is no single sequence followed by every attacker. A short-lived denial-of-service attack behaves very differently from an advanced persistent threat that remains inside an environment for an extended period.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Still, many attacks in network security can be understood as a progression of behaviors.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3><strong>1. Initial Access:<\/strong><\/h3><p><span data-contrast=\"auto\">The attacker first needs a way into the environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Possible attack vectors include compromised credentials, exposed services, vulnerable applications, phishing, social engineering, third-party access, malware, or a compromised supplier.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The initial access technique does not necessarily constitute a network attack on its own. For example, phishing primarily targets a person. What happens after a credential is stolen or malware executes can create extensive malicious network activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3><strong>2. Network Discovery:<\/strong><\/h3><p><span data-contrast=\"auto\">Once inside, attackers often need to understand where they have landed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">They may identify:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Available hosts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Open ports<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Domain resources<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">File shares<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remote management services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">High-value servers<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Trust relationships<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">This activity can create recognizable patterns such as one endpoint attempting connections across numerous addresses or ports.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3><strong>3. Credential and Privilege Abuse:<\/strong><\/h3><p><span data-contrast=\"auto\">Attackers may steal, reuse, or otherwise abuse credentials to access additional resources.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">At this point, an attacker may not need to exploit another technical vulnerability. A valid username and password can make malicious activity look surprisingly similar to legitimate administration.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3><strong>4. Lateral Movement:<\/strong><\/h3><p><span data-contrast=\"auto\">Access to one endpoint is rarely the final objective of a serious intrusion.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Attackers may use protocols and services such as SMB, RDP, SSH, remote administration utilities, or other trusted mechanisms to reach additional systems. MITRE ATT&amp;CK notes that adversaries may exploit remote services specifically to gain access to internal systems and enable lateral movement.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This is one reason network traffic monitoring inside the environment matters. Perimeter monitoring alone may miss important east-west activity occurring between internal systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3><strong>5. Command and Control:<\/strong><\/h3><p><span data-contrast=\"auto\">A compromised system may communicate with infrastructure controlled by the attacker to receive commands or return information.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The difficulty is that command-and-control traffic does not always use an unusual protocol. Attackers can communicate through HTTP, HTTPS, DNS, mail protocols, and other common services precisely because those protocols already appear throughout enterprise networks. MITRE documents this use of normal application-layer protocols to blend malicious communications with legitimate network activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3><strong>6. Exfiltration or Disruption:<\/strong><\/h3><p><span data-contrast=\"auto\">The attacker may ultimately steal data, encrypt systems, interrupt operations, manipulate information, or maintain access for future use.<\/span><\/p><p><span data-contrast=\"auto\">MITRE&#8217;s ATT&amp;CK framework describes exfiltration techniques as methods adversaries use to remove collected data from a network, sometimes through the same command-and-control channel already in use.<\/span><\/p><p><span data-contrast=\"auto\">Not every network attack reaches all six stages. But thinking in terms of an attack path helps security teams recognize that a network security compromise is often a sequence of related behaviors rather than one isolated malicious connection.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-26738ec elementor-widget elementor-widget-heading\" data-id=\"26738ec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Active vs. Passive Network Attack<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-35d293d elementor-widget elementor-widget-text-editor\" data-id=\"35d293d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span class=\"TextRun SCXW162529603 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW162529603 BCX0\">One useful way to understand the <\/span><span class=\"NormalTextRun SCXW162529603 BCX0\">different types<\/span><span class=\"NormalTextRun SCXW162529603 BCX0\"> of network attacks <\/span><span class=\"NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW162529603 BCX0\">is<\/span><span class=\"NormalTextRun SCXW162529603 BCX0\"> to separate passive attacks from active attacks.<\/span><\/span><\/p><table style=\"font-weight: 400;\" data-tablestyle=\"MsoNormalTable\" data-tablelook=\"1184\" aria-rowcount=\"9\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW261287559 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW261287559 BCX0\">Passive network attack<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW12155277 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW12155277 BCX0\">Active network attack<\/span><\/span><\/strong><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><span class=\"TextRun SCXW47297218 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW47297218 BCX0\">Observes or collects information<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW231264859 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW231264859 BCX0\">Changes, disrupts, injects, or interacts with traffic or systems<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><span class=\"TextRun SCXW265942383 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW265942383 BCX0\">Designed to avoid altering normal communications<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW9161608 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW9161608 BCX0\">Usually creates some change in system or network behavior<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><span class=\"TextRun SCXW51662445 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW51662445 BCX0\">Often focused on surveillance or information collection<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW152393356 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW152393356 BCX0\">Often focused on access, manipulation, disruption, or propagation<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"5\"><td data-celllook=\"0\"><span class=\"TextRun SCXW186779011 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW186779011 BCX0\">Examples include eavesdropping and traffic analysis<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW138035288 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW138035288 BCX0\">Examples include spoofing, session hijacking, MITM, and DoS attacks<\/span><\/span><\/td><\/tr><\/tbody><\/table><h3 aria-level=\"3\"><strong>Passive Network Attacks:\u00a0<\/strong><\/h3><p><span data-contrast=\"auto\">A passive network attacker attempts to observe communications without significantly changing them.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Packet sniffing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network eavesdropping<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Traffic analysis<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Capturing unencrypted credentials<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Monitoring communication patterns<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Because passive attacks may not cause obvious operational changes, they can be difficult to recognize without strong network visibility and encryption.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>Active Network Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\">An active network attack interacts with the target environment. The attacker may generate malicious traffic, impersonate another system, change communications, exploit a service, move between devices, or deliberately degrade availability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include:<\/span><\/p><ul><li><span data-contrast=\"auto\">Spoofing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Man-in-the-middle attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Session hijacking<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Credential-based attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">DoS and DDoS attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exploitation of network services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Malicious lateral movement<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6de16b4 elementor-widget elementor-widget-heading\" data-id=\"6de16b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Common Types of Network Attacks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ed15f5d elementor-widget elementor-widget-text-editor\" data-id=\"ed15f5d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">There is no perfect list of network attack because attack techniques frequently overlap. The same intrusion may combine stolen credentials, malware, network reconnaissance, lateral movement, spoofing, and command-and-control traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Unauthorized Access Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\">An unauthorized access attack occurs when someone obtains access to a network, service, device, or resource without permission.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Access may result from:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Stolen passwords<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Weak authentication<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exposed remote access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Misconfigured services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exploited vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Compromised privileged accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Once access is obtained, the attacker may conduct reconnaissance, escalate privileges, access sensitive systems, or begin moving laterally.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Credential Stuffing:<\/strong><\/h3><p><span data-contrast=\"auto\">Credential stuffing uses previously compromised username-and-password combinations against other services in the hope that users reused credentials.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The network may show repeated authentication attempts, attempts against numerous accounts, unusual source locations, or successful logins inconsistent with the user&#8217;s normal behavior.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Credential stuffing highlights why identity and network evidence often need to be investigated together.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Malware-Based Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/malware\/\" target=\"_blank\" rel=\"noopener\">Malware<\/a> can create network activity at several points in an intrusion.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A compromised endpoint might:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Download additional payloads<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Resolve suspicious domains<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Contact command-and-control infrastructure<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Scan internal systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Spread to another host<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Transfer stolen information<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/unified-network-visibility-solutions\/\" target=\"_blank\" rel=\"noopener\">Network visibility<\/a> can therefore provide useful evidence even when malware is first discovered somewhere else.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Man-in-the-Middle (MITM) Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\">A Man-in-the-Middle attack occurs when an attacker positions themselves between communicating parties and intercepts or potentially alters their communications.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Depending on the technique, the attacker may capture credentials, observe sensitive information, manipulate requests, or redirect communications.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Strong encryption and certificate validation significantly reduce many forms of MITM risk, but defenders should also monitor for unexpected changes in routing, name resolution, address mappings, or communication patterns.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Spoofing:<\/strong><\/h3><p><span data-contrast=\"auto\">Spoofing involves impersonating another device, address, identity, or service.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">IP spoofing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">ARP spoofing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">DNS spoofing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Email spoofing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">The objective depends on the network attack. Spoofing may be used to redirect traffic, bypass simple trust controls, impersonate a legitimate system, or facilitate another attack such as a MITM scenario.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. DoS Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\">A denial-of-service (DoS) attack attempts to make a service or resource unavailable by overwhelming it, exhausting resources, or exploiting a condition that prevents legitimate use.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Sudden changes in connection volume, request rates, protocol behavior, or resource consumption can help defenders identify DoS attacks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>7. DDoS Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\">A <a href=\"https:\/\/www.netwitness.com\/blog\/enterprise-ddos-mitigation-plan\/\" target=\"_blank\" rel=\"noopener\">distributed denial-of-service (DDoS)<\/a> attack uses numerous systems or traffic sources to overwhelm a target.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">The distributed nature of the activity makes DDoS attacks more difficult to address than a single-source denial-of-service event because simply blocking one origin is unlikely to stop the network attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>8. Network Reconnaissance and Scanning:<\/strong><\/h3><p><span data-contrast=\"auto\">Network reconnaissance helps an attacker understand an environment before taking further action.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Scanning behavior can reveal:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Active hosts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Open ports<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Available services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network architecture<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Potentially vulnerable systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">A single connection to a server may be unremarkable. One workstation attempting connections across dozens of previously unrelated systems and ports is much more interesting.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This is where behavioral context becomes important for advanced threat detection.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>9. Lateral Movement:<\/strong><\/h3><p><span data-contrast=\"auto\">Lateral movement occurs when an attacker moves from one compromised resource to additional systems within the environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Rather than using obviously malicious protocols, the attacker may use the same SMB, SSH, RDP, or remote administration services that legitimate administrators rely on.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That makes lateral movement a network analytics problem as much as a signature problem.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>10. Command-and-Control Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/ndr-detects-command-and-control-traffic\/\" target=\"_blank\" rel=\"noopener\">Command-and-control<\/a>, or C2, communication allows attackers to remotely interact with compromised systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Possible network indicators include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Repeated periodic connections<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Connections to newly observed domains<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unusual DNS activity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unexpected outbound traffic<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Irregular protocol use<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unusual ports<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Asymmetrical traffic volumes<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">MITRE&#8217;s current detection guidance specifically identifies characteristics such as unusual outbound byte counts, irregular ports, suspicious protocol use, and beacon-like communications as useful signals when investigating application-layer command and control.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>11. Phishing and Social Engineering:<\/strong><\/h3><p><span data-contrast=\"auto\">Phishing and social engineering are frequently discussed alongside network threats, but they should not automatically be classified as network attacks. They are typically methods for manipulating users or obtaining initial access. They can, however, start a network attack chain.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For example:<\/span><\/p><p><b><span data-contrast=\"auto\">Phishing email \u2192 stolen credentials \u2192 VPN access \u2192 network discovery \u2192 lateral movement \u2192 data exfiltration<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>12. Advanced Persistent Threats (APTs):<\/strong><\/h3><p><span data-contrast=\"auto\">An Advanced Persistent Threat (APT) is not a single network attack technique.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It describes a sustained intrusion in which a capable adversary attempts to maintain access and pursue objectives over time.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">An APT operation may combine:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Social engineering<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Credential theft<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerability exploitation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Malware<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Lateral movement<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">C2<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data collection<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exfiltration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Detecting these attacks often requires correlating multiple weak signals rather than waiting for one unmistakably malicious event.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>13. Supply Chain Attacks:<\/strong><\/h3><p><span data-contrast=\"auto\">A <a href=\"https:\/\/www.netwitness.com\/blog\/digital-supply-chain-security-against-ransomware\/\" target=\"_blank\" rel=\"noopener\">supply chain attack<\/a> compromises an organization through a trusted supplier, software dependency, service provider, update mechanism, or other third-party relationship.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Like phishing, a supply chain compromise may represent the entry point rather than the complete network attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Once malicious code or unauthorized access reaches the environment, defenders still need to detect what it does next: which systems communicate, where connections originate, what resources are accessed, and whether information leaves the environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>14. Insider Threats:<\/strong><\/h3><p><span data-contrast=\"auto\">Not every network security threat begins outside the organization.<\/span> <span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/use-cases\/insider-threats\/\" target=\"_blank\" rel=\"noopener\">Insider threats<\/a> can involve malicious, negligent, or compromised users who already possess some level of legitimate access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That makes insider threat detection particularly challenging. Network activity may use authorized accounts, legitimate applications, and approved protocols.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Useful indicators may therefore involve changes in behavior: unexpected access to systems, unusual data movement, abnormal working hours, new destinations, or activity inconsistent with a user&#8217;s role.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce3b4d3 elementor-widget elementor-widget-heading\" data-id=\"ce3b4d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Network Attack vs. Cyberattack vs. Network Threat vs. Vulnerability<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4f820cf elementor-widget elementor-widget-text-editor\" data-id=\"4f820cf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span class=\"TextRun SCXW225410279 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW225410279 BCX0\">These terms are related but not interchangeable.<\/span><\/span><\/p><table style=\"font-weight: 400;\" data-tablestyle=\"MsoNormalTable\" data-tablelook=\"1184\" aria-rowcount=\"9\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"0\"><b>Term<\/b><\/td><td data-celllook=\"0\"><b>Meaning<\/b><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW27019613 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW27019613 BCX0\">Network attack<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW75491946 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW75491946 BCX0\">Malicious activity that targets, manipulates, disrupts, or uses network communications, infrastructure, or connected systems<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW254525495 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW254525495 BCX0\">Cyberattack<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW455658 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW455658 BCX0\">A broader malicious action against digital systems, applications, identities, networks, or information<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW33545162 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW33545162 BCX0\">Network threat<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW169653624 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW169653624 BCX0\">Anything capable of causing harm to network resources or communications<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"5\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW25084976 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW25084976 BCX0\">Network vulnerability<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW265274533 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW265274533 BCX0\">A weakness that could be exploited to compromise a network or connected resource<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW227087043 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW227087043 BCX0\">Attack vector<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW152055961 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW152055961 BCX0\">The path or method through which an attacker <\/span><span class=\"NormalTextRun SCXW152055961 BCX0\">attempts<\/span><span class=\"NormalTextRun SCXW152055961 BCX0\"> to gain access or achieve an objective<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"7\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW73413273 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW73413273 BCX0\">Attack surface<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW243485980 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243485980 BCX0\">The collection of systems, interfaces, services, identities, connections, and other points through which an environment could potentially be attacked<\/span><\/span><\/td><\/tr><\/tbody><\/table><p><span data-contrast=\"auto\">For example, an internet-facing VPN appliance may form part of an organization&#8217;s attack surface. An unpatched flaw in that appliance is a network vulnerability. Exploiting it is an attack vector. Using the resulting access to scan internal systems and move laterally becomes part of the network attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Attack surface management helps organizations identify and reduce exposed assets and potential entry points, but reducing the attack surface does not remove the need to detect malicious activity that successfully gets through.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c608d2 elementor-widget elementor-widget-heading\" data-id=\"2c608d2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Does a Network Attack Look Like in Network Traffic?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-679c848 elementor-widget elementor-widget-text-editor\" data-id=\"679c848\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">This is where network security becomes more practical.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Attackers ultimately need systems to communicate. Even when the endpoint process is hidden, or the account appears legitimate, network activity can provide another view of what is happening.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Signals worth investigating include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Unexpected Network Scanning:\u00a0<\/strong><\/h3><p><span data-contrast=\"auto\">A workstation suddenly attempts connections to numerous IP addresses or ports that it has rarely or never accessed before.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">That may indicate reconnaissance rather than ordinary user activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. New East-West Connections:<\/strong><\/h3><p><span data-contrast=\"auto\">A system that normally communicates with two application servers suddenly begins initiating SMB or RDP sessions to systems across several network segments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">The individual connections may be legitimate protocols. The change in behavior is what matters.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Suspicious DNS Behavior:<\/strong><\/h3><p><span data-contrast=\"auto\">Examples include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Requests to newly observed domains<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unusually long or structured queries<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">High volumes of failed lookups<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Domains inconsistent with normal business activity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Repeated DNS communication with unusual patterns<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">DNS is particularly useful to attackers because it is widely permitted and essential to normal operations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Beacon-Like Communications:<\/strong><\/h3><p><span data-contrast=\"auto\">A compromised host may repeatedly contact external infrastructure at regular intervals.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">A single HTTPS connection is almost meaningless in isolation. A workstation initiating similarly sized connections to the same unusual destination every few minutes deserves more scrutiny.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Unexpected Protocol Usage:<\/strong><\/h3><p><span data-contrast=\"auto\">A protocol appearing where it does not normally belong can reveal suspicious behavior.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Examples might include SMB crossing an unexpected network boundary or a user endpoint suddenly generating remote-administration traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. Unusual Data Transfers:<\/strong><\/h3><p><span data-contrast=\"auto\">A large outbound transfer does not automatically mean data exfiltration.<\/span> <span data-contrast=\"auto\">But an unusual volume sent by a server that normally receives rather than transmits substantial data could warrant investigation, particularly when combined with other evidence.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/resources\/webinars-on-demand\/beyond-the-playbook-how-to-properly-leverage-the-mitre-attck-framework-on-demand\/\" target=\"_blank\" rel=\"noopener\">MITRE&#8217;s detection<\/a> guidance similarly emphasizes abnormal traffic volume, protocol misuse, unexpected destinations, and communication patterns when identifying C2 and potential exfiltration.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c20598a elementor-widget elementor-widget-heading\" data-id=\"c20598a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How are Network Attacks Detected?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b42699 elementor-widget elementor-widget-text-editor\" data-id=\"3b42699\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Effective network threat detection combines different levels of network evidence.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Network Traffic Monitoring:<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/network-traffic-monitoring\/\" target=\"_blank\" rel=\"noopener\">Network traffic monitoring<\/a> provides visibility into communications occurring across the environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">At a basic level, monitoring can answer questions such as:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Which systems communicated?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">When did the connection occur?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Which ports and protocols were used?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">How much information moved?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Was the communication inbound, outbound, or internal?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">That visibility becomes the foundation for deeper investigation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Network Traffic Analysis:<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/what-is-network-traffic-analysis\/\" target=\"_blank\" rel=\"noopener\">Network traffic analysis<\/a> examines communications for suspicious patterns, anomalies, relationships, and known indicators.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Rather than asking only whether a connection matches a known malicious signature, network traffic analysis and detection can consider:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Communication frequency<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Traffic direction<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Peer relationships<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Protocol behavior<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Connection timing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data volumes<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Historical baselines<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">NIST describes network intrusion detection systems as technologies that perform packet sniffing and network traffic analysis to identify suspicious activity and record relevant evidence.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Packet Capture and PCAP:<\/strong><\/h3><p><span data-contrast=\"auto\">Packet capture, commonly associated with <a href=\"https:\/\/www.netwitness.com\/blog\/pcap-file-guide\/\" target=\"_blank\" rel=\"noopener\">PCAP<\/a>, records packets traversing a network.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Flow or metadata may tell an analyst that two hosts communicated. Packet-level evidence can provide deeper context about what happened during that communication when the relevant content is available.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">PCAP is particularly valuable during investigations because an alert tells the analyst what a detection system noticed, whereas retained network evidence may help reconstruct the surrounding activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Questions might include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">What occurred immediately before the alert?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Which system initiated the connection?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">What protocol was actually used?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Did the communication continue afterward?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Did the host communicate with other systems?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>4. Deep Packet Inspection (DPI):<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/deep-packet-inspection-dpi-enhancing-network-security-with-netwitness\/\" target=\"_blank\" rel=\"noopener\">Deep packet inspection (DPI)<\/a> examines information beyond basic packet headers to understand protocol behavior and, where technically and legally appropriate, elements of packet content.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">DPI can provide richer context than IP addresses and ports alone. Its visibility may be limited when communications are encrypted unless an organization has appropriate methods for inspecting or deriving security signals from encrypted traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Network Detection and Response (NDR):<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/modules\/network-detection-and-response-ndr\/\" target=\"_blank\" rel=\"noopener\">Network detection and response (NDR)<\/a> combines network visibility, analytics, detection, investigation, and response workflows.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Instead of treating every network event independently, NDR can help identify patterns across communications and surface activity such as:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Reconnaissance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Lateral movement<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">C2 communication<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unusual internal relationships<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Suspicious DNS behavior<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data exfiltration patterns<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">NDR is particularly useful where malicious activity occurs between systems rather than exclusively at the network perimeter.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. AI\/ML and Advanced Network Analytics:<\/strong><\/h3><p><span data-contrast=\"auto\">Artificial intelligence, machine learning, and advanced network analytics can help identify behavior that does not fit established baselines or known relationships.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For example, AI\/ML may help identify:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">A device communicating with an unusual peer<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">New patterns of service usage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unexpected connection timing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Changes in traffic volume<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Behavioral similarities across multiple suspicious systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/how-machine-learning-threat-detection-works\/\" target=\"_blank\" rel=\"noopener\">Machine learning<\/a> is not a replacement for security context. Rare activity is not automatically malicious, and normal-looking activity is not automatically safe.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The value comes from combining analytics with contextual evidence such as identity, asset importance, network topology, known threats, historical behavior, and other security telemetry.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd2427e elementor-widget elementor-widget-heading\" data-id=\"fd2427e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why are Modern Network Attacks Difficult to Detect?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d0b9110 elementor-widget elementor-widget-text-editor\" data-id=\"d0b9110\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">The difficult attacks are rarely difficult because the organization cannot see <\/span><strong><i>any<\/i><\/strong><span data-contrast=\"auto\"> traffic. They are difficult because malicious traffic increasingly resembles legitimate traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li aria-level=\"3\"><strong>Attackers Use Valid Credentials: <\/strong><span data-contrast=\"auto\">An attacker authenticating with stolen credentials may look much like an employee authenticating with the same credentials. This may emerge only when the activity is viewed alongside device, location, network, asset, and behavioral context.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>Attackers Use Normal Protocols: <\/strong><span data-contrast=\"auto\">HTTP, HTTPS, DNS, SMB, RDP, and SSH all have legitimate purposes. Attackers know this.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">MITRE notes that adversaries can use normal application-layer protocols for command and control specifically to blend their activity with existing traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>More Activity Happens Inside the Perimeter: <\/strong><span data-contrast=\"auto\">After initial compromise, an attacker may spend considerable effort communicating with internal systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Monitoring only inbound and outbound traffic can therefore leave an important visibility gap.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>Encryption Limits Content Visibility: <\/strong><span data-contrast=\"auto\">Encryption is essential for protecting legitimate communications, but it can also conceal malicious content.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Security teams may need to rely more heavily on metadata, destinations, certificates, connection behavior, traffic patterns, endpoint context, and other observable characteristics when payload contents are unavailable.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>Hybrid Environments Expand the Attack Surface: <\/strong><span data-contrast=\"auto\">Enterprise communications now routinely span offices, data centers, remote employees, cloud workloads, SaaS services, third-party environments, and operational technology.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/network-security-policy-step-by-step-guide\/\" target=\"_blank\" rel=\"noopener\">Network security management<\/a> therefore has to account for traffic that no longer follows a simple internal-versus-external model.<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3feb237 elementor-widget elementor-widget-heading\" data-id=\"3feb237\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Can Organizations Prevent Network Attack?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a005d08 elementor-widget elementor-widget-text-editor\" data-id=\"a005d08\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">There is no single technology that provides complete network attack protection.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Effective <a href=\"https:\/\/www.netwitness.com\/resources\/data-sheets\/nw-network-detection-and-response\/\" target=\"_blank\" rel=\"noopener\">network attack prevention<\/a> combines controls that reduce the chance of initial compromise, restrict what attackers can reach, detect suspicious behavior, and support rapid containment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Reduce the Attack Surface:<\/strong><\/h3><p><span data-contrast=\"auto\">Maintain an accurate understanding of externally and internally exposed systems, services, applications, remote access pathways, and third-party connections.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Remove unnecessary services and correct risky configurations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Fix Known Vulnerabilities:<\/strong><\/h3><p><span data-contrast=\"auto\">Continuous vulnerability management, patching, and secure configuration reduce the number of weaknesses available for exploitation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Prioritize vulnerabilities based not only on severity but also on exposure, asset importance, exploitability, and evidence of active threat activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Strengthen Identity Controls:<\/strong><\/h3><p><span data-contrast=\"auto\">Use strong authentication, appropriate privileges, and controls around remote access and administrative accounts.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Because many network attack operate through stolen credentials, identity security is inseparable from network security.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Use Network Segmentation and Segregation:<\/strong><\/h3><p>Network segmentation and network segregation<span data-contrast=\"auto\"> restrict unnecessary communication between systems or groups of systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">A compromised employee laptop should not automatically provide unrestricted access to critical servers.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">CISA recommends segmentation as a way to contain intrusions and prevent or limit adversary lateral movement.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Monitor East-West and North-South Traffic:<\/strong><\/h3><p><span data-contrast=\"auto\">Internet-facing activity matters, but so does communication between internal systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Visibility into both directions gives defenders a stronger chance of detecting what happens after initial access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. Combine Multiple Sources of Evidence:<\/strong><\/h3><p><span data-contrast=\"auto\">Network information becomes more useful when combined with:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Endpoint telemetry<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identity activity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Threat intelligence<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">DNS information<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud telemetry<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Asset context<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Authentication logs<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">This helps distinguish unusual-but-legitimate activity from behavior that deserves immediate investigation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>7. Preserve Evidence for Investigation:<\/strong><\/h3><p><span data-contrast=\"auto\">Alerts alone may not provide enough information to understand a sophisticated network attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Retaining useful network metadata and, where appropriate, <\/span><a href=\"https:\/\/www.netwitness.com\/resources\/whitepapers\/why-full-packet-capture-is-critical-for-modern-threat-detection\/\" target=\"_blank\" rel=\"noopener\">packet capture<\/a><span data-contrast=\"auto\"> can make it easier to reconstruct the attack path and determine the scope of compromise.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2016558 elementor-widget elementor-widget-heading\" data-id=\"2016558\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Does NDR Support Network Attack Defense?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8ddcef6 elementor-widget elementor-widget-text-editor\" data-id=\"8ddcef6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Traditional security controls often focus on known indicators, endpoint behavior, or activity crossing particular boundaries.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">NDR adds another perspective: the relationships and behaviors visible in network communications.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A useful <a href=\"https:\/\/www.netwitness.com\/resources\/whitepapers\/the-modern-analyst-workflow-connecting-edr-ndr-and-siem-for-faster-investigations\/\" target=\"_blank\" rel=\"noopener\">NDR investigation<\/a> should help an analyst move beyond:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u201c<strong>This IP address generated an alert.<\/strong>\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">toward questions such as:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">What did the system communicate with before the alert?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Is this relationship new?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Did the device scan other assets?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Did the same identity appear elsewhere?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Was there evidence of lateral movement?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Did the host communicate externally?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Did suspicious activity continue after the initial detection?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Was data transferred from the environment?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">This broader context matters because attackers rarely stay inside one security control&#8217;s field of view.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Effective network attack resolution therefore depends not only on detecting suspicious activity but also on establishing what happened, determining which systems were affected, containing malicious access, removing the cause, and validating that the environment has returned to an expected state.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-071c714 elementor-widget elementor-widget-heading\" data-id=\"071c714\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Related Terms &amp; Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e2355db elementor-widget elementor-widget-text-editor\" data-id=\"e2355db\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<ol><li><b><span data-contrast=\"auto\">Cyberattack: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">cyberattack<\/span><\/b><span data-contrast=\"auto\"> is a deliberate attempt to gain unauthorized access to, disrupt, damage, manipulate, or steal data from digital systems, applications, networks, or devices.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Breach: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">network breach<\/span><\/b><span data-contrast=\"auto\"> occurs when an unauthorized individual or system successfully gains access to a network or to resources accessible through it.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Cyber Intrusion: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">cyber intrusion<\/span><\/b><span data-contrast=\"auto\"> is unauthorized activity within a system or network, which may include reconnaissance, credential abuse, lateral movement, persistence, or data theft.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Exploit: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">network exploit<\/span><\/b><span data-contrast=\"auto\"> is a technique or piece of code that takes advantage of a network vulnerability, configuration weakness, or exposed service to gain access or perform unauthorized actions.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Malicious Attack: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">malicious attack<\/span><\/b><span data-contrast=\"auto\"> is an intentional action designed to compromise the confidentiality, integrity, or availability of systems, networks, applications, or data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Intrusion: <\/span><\/b><span data-contrast=\"auto\">A <\/span><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/network-intrusion\/\" target=\"_blank\" rel=\"noopener\"><b><span data-contrast=\"auto\">network intrusion<\/span><\/b><\/a><span data-contrast=\"auto\"> occurs when an attacker or unauthorized entity enters a network or performs unauthorized activity within it.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Compromise: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">network compromise<\/span><\/b><span data-contrast=\"auto\"> occurs when an attacker successfully bypasses security controls and gains unauthorized access to network resources, communications, systems, or data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Penetration: Network penetration<\/span><\/b><span data-contrast=\"auto\"> refers to gaining access to a network by bypassing or exploiting its security controls. In authorized penetration testing, security teams perform this activity deliberately to identify weaknesses before attackers can exploit them.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Security Attack: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">network security attack<\/span><\/b><span data-contrast=\"auto\"> is malicious activity directed at network infrastructure, communications, connected systems, or services with the intent to gain access, steal information, manipulate traffic, or disrupt operations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Denial-of-Service (DoS) Attack: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">denial-of-service (DoS) attack<\/span><\/b><span data-contrast=\"auto\"> attempts to make a system, network, or service unavailable to legitimate users by exhausting resources, overwhelming it with requests, or exploiting a weakness that disrupts availability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Man-in-the-Middle (MITM) Attack: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">Man-in-the-Middle (MITM) attack<\/span><\/b><span data-contrast=\"auto\"> occurs when an attacker secretly intercepts communications between two parties and may monitor, redirect, or alter the information being exchanged.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Distributed Denial-of-Service (DDoS) Attack: <\/span><\/b><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">distributed denial-of-service (DDoS) attack<\/span><\/b><span data-contrast=\"auto\"> overwhelms a target with traffic or requests originating from many systems simultaneously, making legitimate access difficult or impossible.<\/span><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b9b8efb e-flex e-con-boxed e-con e-parent\" data-id=\"b9b8efb\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a7b41d3 elementor-widget elementor-widget-heading\" data-id=\"a7b41d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">People Also Ask<\/h2>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c2498ac e-con-full e-flex e-con e-child\" data-id=\"c2498ac\" data-element_type=\"container\" data-e-type=\"container\" id=\"faq-section\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b7af59c elementor-widget elementor-widget-n-accordion\" data-id=\"b7af59c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;expanded&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1920\" class=\"e-n-accordion-item\" open>\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"true\" aria-controls=\"e-n-accordion-item-1920\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 1. What are the types of cybersecurity threats?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1920\" class=\"elementor-element elementor-element-7f4aa81 e-con-full e-flex e-con e-child\" data-id=\"7f4aa81\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1920\" class=\"elementor-element elementor-element-0a80958 e-flex e-con-boxed e-con e-child\" data-id=\"0a80958\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-afe789b elementor-widget elementor-widget-text-editor\" data-id=\"afe789b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Cybersecurity threats can take many forms, including:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Malware and ransomware<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Phishing and social engineering<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Credential theft and credential stuffing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Insider threats<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Man-in-the-Middle attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">DoS and DDoS attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerability exploitation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Advanced Persistent Threats (APTs)<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Supply chain attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Web application attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud account and configuration compromise<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">These categories often overlap. For example, a phishing campaign may steal credentials that are later used for <\/span><b><span data-contrast=\"auto\">unauthorized network access<\/span><\/b><span data-contrast=\"auto\">, followed by internal reconnaissance, lateral movement, and data exfiltration.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For security teams, understanding the attack chain is often more useful than placing an incident into a single threat category.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1921\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1921\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 2. What are the types of network security?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1921\" class=\"elementor-element elementor-element-0cb3db5 e-con-full e-flex e-con e-child\" data-id=\"0cb3db5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1921\" class=\"elementor-element elementor-element-f66bb0a e-flex e-con-boxed e-con e-child\" data-id=\"f66bb0a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a341ecb elementor-widget elementor-widget-text-editor\" data-id=\"a341ecb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Network security is not one control or technology. It is usually built from several complementary approaches, including:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><b><span data-contrast=\"auto\">Network access control:<\/span><\/b><span data-contrast=\"auto\"> Restricts who and what can connect to network resources.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Firewalls:<\/span><\/b><span data-contrast=\"auto\"> Control traffic between networks, systems, or security zones.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">IDS\/IPS:<\/span><\/b><span data-contrast=\"auto\"> Detect or block suspicious network activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network segmentation:<\/span><\/b><span data-contrast=\"auto\"> Separates systems and workloads to limit unnecessary communication and lateral movement.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network detection and response (NDR):<\/span><\/b><span data-contrast=\"auto\"> Analyzes network activity to identify suspicious behavior and support investigation and response.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network traffic analysis:<\/span><\/b><span data-contrast=\"auto\"> Examines communications, connections, protocols, and patterns for abnormal or malicious activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">VPN and secure remote access:<\/span><\/b><span data-contrast=\"auto\"> Protect connections from remote users and locations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Encryption:<\/span><\/b><span data-contrast=\"auto\"> Protects information while it moves across networks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">DNS security:<\/span><\/b><span data-contrast=\"auto\"> Helps detect or prevent malicious use of domain-name infrastructure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Wireless network security:<\/span><\/b><span data-contrast=\"auto\"> Protects Wi-Fi networks, devices, and wireless communications.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Effective <\/span><b><span data-contrast=\"auto\">network security management<\/span><\/b><span data-contrast=\"auto\"> combines these controls rather than depending on any one of them.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1922\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1922\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 3. How can organizations prevent network security threats? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1922\" class=\"elementor-element elementor-element-5813b56 e-con-full e-flex e-con e-child\" data-id=\"5813b56\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1922\" class=\"elementor-element elementor-element-d9f0ad3 e-flex e-con-boxed e-con e-child\" data-id=\"d9f0ad3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-eb79a0d elementor-widget elementor-widget-text-editor\" data-id=\"eb79a0d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Organizations can reduce exposure to <\/span><b><span data-contrast=\"auto\">network security threats<\/span><\/b><span data-contrast=\"auto\"> by combining preventive controls with continuous detection.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Important measures include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Patch known vulnerabilities promptly.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Remove unnecessary internet-facing services.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Strengthen authentication and privileged access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">Apply least-privilege principles.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><span data-contrast=\"auto\">Use network segmentation and segregation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"6\" data-aria-level=\"1\"><span data-contrast=\"auto\">Secure remote access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"7\" data-aria-level=\"1\"><span data-contrast=\"auto\">Continuously monitor network traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"8\" data-aria-level=\"1\"><span data-contrast=\"auto\">Detect unusual east-west communication.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"9\" data-aria-level=\"1\"><span data-contrast=\"auto\">Maintain accurate asset inventories.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"10\" data-aria-level=\"1\"><span data-contrast=\"auto\">Monitor DNS and outbound connections.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"11\" data-aria-level=\"1\"><span data-contrast=\"auto\">Use threat intelligence to identify known malicious infrastructure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"12\" data-aria-level=\"1\"><span data-contrast=\"auto\">Deploy NDR, IDS\/IPS, endpoint security, and other complementary controls.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"13\" data-aria-level=\"1\"><span data-contrast=\"auto\">Preserve network evidence for investigation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"14\" data-aria-level=\"1\"><span data-contrast=\"auto\">Maintain tested incident response procedures.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Prevention alone is not enough. Some attackers will eventually bypass preventive controls, which is why <\/span><b><span data-contrast=\"auto\">network attack detection<\/span><\/b><span data-contrast=\"auto\"> and rapid response remain important parts of network defense.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1923\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1923\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 4. What are common network security threats? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1923\" class=\"elementor-element elementor-element-38bd880 e-con-full e-flex e-con e-child\" data-id=\"38bd880\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1923\" class=\"elementor-element elementor-element-f75101f e-flex e-con-boxed e-con e-child\" data-id=\"f75101f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1ae8c5a elementor-widget elementor-widget-text-editor\" data-id=\"1ae8c5a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Common <\/span><b><span data-contrast=\"auto\">network security threats<\/span><\/b><span data-contrast=\"auto\"> include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Unauthorized network access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Credential compromise<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Malware and ransomware<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">DoS and DDoS attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><a href=\"https:\/\/en.wikipedia.org\/wiki\/Man-in-the-middle_attack\" target=\"_blank\" rel=\"noopener nofollow\"><span data-contrast=\"auto\">Man-in-the-Middle attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/a><\/li><li><span data-contrast=\"auto\">Spoofing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network reconnaissance and scanning<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exploitation of vulnerable network services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Lateral movement<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Command-and-control traffic<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data exfiltration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Insider threats<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Compromised network devices<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Supply chain compromise<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">The threat itself may also change as an intrusion progresses. Stolen credentials, for example, may begin as an identity security issue but quickly become a network security problem when the attacker uses them to access internal systems and move laterally.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1924\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"5\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1924\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 5. Which type of network poses increasing challenges? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1924\" class=\"elementor-element elementor-element-606f103 e-con-full e-flex e-con e-child\" data-id=\"606f103\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1924\" class=\"elementor-element elementor-element-9ac2c15 e-flex e-con-boxed e-con e-child\" data-id=\"9ac2c15\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-da93424 elementor-widget elementor-widget-text-editor\" data-id=\"da93424\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><b><span data-contrast=\"auto\">Hybrid and highly distributed enterprise networks<\/span><\/b><span data-contrast=\"auto\"> pose increasing security challenges because users, workloads, applications, and data now operate across on-premises infrastructure, cloud environments, remote locations, SaaS platforms, and third-party services.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This changes what defenders need to monitor. Traffic may no longer pass through a single traditional network perimeter, while legitimate communication between cloud workloads, remote endpoints, and internal resources can make abnormal activity harder to distinguish.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The challenge is therefore less about one particular network technology being inherently insecure and more about maintaining consistent visibility and security controls across a growing and changing <\/span><a href=\"https:\/\/www.netwitness.com\/blog\/attack-surface-management-trends\/\" target=\"_blank\" rel=\"noopener\">attack surface<\/a><span data-contrast=\"auto\">.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1925\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"6\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1925\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 6. What constitutes a threat to a network?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1925\" class=\"elementor-element elementor-element-fc973b2 e-con-full e-flex e-con e-child\" data-id=\"fc973b2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1925\" class=\"elementor-element elementor-element-bdc6450 e-flex e-con-boxed e-con e-child\" data-id=\"bdc6450\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a802f44 elementor-widget elementor-widget-text-editor\" data-id=\"a802f44\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A <\/span><b><span data-contrast=\"auto\">network threat<\/span><\/b><span data-contrast=\"auto\"> is anything capable of compromising the confidentiality, integrity, or availability of network resources, communications, systems, or data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A threat could involve:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">An external attacker<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">A malicious or compromised insider<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Malware<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">Stolen credentials<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><span data-contrast=\"auto\">A vulnerable network service<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"6\" data-aria-level=\"1\"><span data-contrast=\"auto\">A compromised device<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"7\" data-aria-level=\"1\"><span data-contrast=\"auto\">Malicious network traffic<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"8\" data-aria-level=\"1\"><span data-contrast=\"auto\">Misconfiguration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"9\" data-aria-level=\"1\"><span data-contrast=\"auto\">A third-party compromise<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><ul><li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1080,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"10\" data-aria-level=\"1\"><span data-contrast=\"auto\">An attacker-controlled command-and-control system<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">A threat should not be confused with a vulnerability. A <\/span><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/network-vulnerability\/\" target=\"_blank\" rel=\"noopener\">network vulnerability<\/a><span data-contrast=\"auto\"> is a weakness, while a threat is something capable of exploiting that weakness or otherwise causing harm. A <\/span><b><span data-contrast=\"auto\">network attack<\/span><\/b><span data-contrast=\"auto\"> occurs when malicious action is actually taken against the environment.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"1. What are the types of cybersecurity threats?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Cybersecurity threats can take many forms, including:\\u00a0Malware and ransomware\\u00a0Phishing and social engineering\\u00a0Credential theft and credential stuffing\\u00a0Insider threats\\u00a0Network attacks\\u00a0Man-in-the-Middle attacks\\u00a0DoS and DDoS attacks\\u00a0Vulnerability exploitation\\u00a0Advanced Persistent Threats (APTs)\\u00a0Supply chain attacks\\u00a0Web application attacks\\u00a0Cloud account and configuration compromise\\u00a0These categories often overlap. For example, a phishing campaign may steal credentials that are later used for unauthorized network access, followed by internal reconnaissance, lateral movement, and data exfiltration.\\u00a0For security teams, understanding the attack chain is often more useful than placing an incident into a single threat category.\"}},{\"@type\":\"Question\",\"name\":\"2. What are the types of network security?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Network security is not one control or technology. It is usually built from several complementary approaches, including:\\u00a0Network access control: Restricts who and what can connect to network resources.\\u00a0Firewalls: Control traffic between networks, systems, or security zones.\\u00a0IDS\\\/IPS: Detect or block suspicious network activity.\\u00a0Network segmentation: Separates systems and workloads to limit unnecessary communication and lateral movement.\\u00a0Network detection and response (NDR): Analyzes network activity to identify suspicious behavior and support investigation and response.\\u00a0Network traffic analysis: Examines communications, connections, protocols, and patterns for abnormal or malicious activity.\\u00a0VPN and secure remote access: Protect connections from remote users and locations.\\u00a0Encryption: Protects information while it moves across networks.\\u00a0DNS security: Helps detect or prevent malicious use of domain-name infrastructure.\\u00a0Wireless network security: Protects Wi-Fi networks, devices, and wireless communications.\\u00a0Effective network security management combines these controls rather than depending on any one of them.\"}},{\"@type\":\"Question\",\"name\":\"3. How can organizations prevent network security threats?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Organizations can reduce exposure to network security threats by combining preventive controls with continuous detection.\\u00a0Important measures include:\\u00a0Patch known vulnerabilities promptly.\\u00a0Remove unnecessary internet-facing services.\\u00a0Strengthen authentication and privileged access.\\u00a0Apply least-privilege principles.\\u00a0Use network segmentation and segregation.\\u00a0Secure remote access.\\u00a0Continuously monitor network traffic.\\u00a0Detect unusual east-west communication.\\u00a0Maintain accurate asset inventories.\\u00a0Monitor DNS and outbound connections.\\u00a0Use threat intelligence to identify known malicious infrastructure.\\u00a0Deploy NDR, IDS\\\/IPS, endpoint security, and other complementary controls.\\u00a0Preserve network evidence for investigation.\\u00a0Maintain tested incident response procedures.\\u00a0Prevention alone is not enough. Some attackers will eventually bypass preventive controls, which is why network attack detection and rapid response remain important parts of network defense.\"}},{\"@type\":\"Question\",\"name\":\"4. What are common network security threats?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Common network security threats include:\\u00a0Unauthorized network access\\u00a0Credential compromise\\u00a0Malware and ransomware\\u00a0DoS and DDoS attacks\\u00a0Man-in-the-Middle attacks\\u00a0Spoofing\\u00a0Network reconnaissance and scanning\\u00a0Exploitation of vulnerable network services\\u00a0Lateral movement\\u00a0Command-and-control traffic\\u00a0Data exfiltration\\u00a0Insider threats\\u00a0Compromised network devices\\u00a0Supply chain compromise\\u00a0The threat itself may also change as an intrusion progresses. Stolen credentials, for example, may begin as an identity security issue but quickly become a network security problem when the attacker uses them to access internal systems and move laterally.\\u00a0\"}},{\"@type\":\"Question\",\"name\":\"5. Which type of network poses increasing challenges?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Hybrid and highly distributed enterprise networks pose increasing security challenges because users, workloads, applications, and data now operate across on-premises infrastructure, cloud environments, remote locations, SaaS platforms, and third-party services.\\u00a0This changes what defenders need to monitor. Traffic may no longer pass through a single traditional network perimeter, while legitimate communication between cloud workloads, remote endpoints, and internal resources can make abnormal activity harder to distinguish.\\u00a0The challenge is therefore less about one particular network technology being inherently insecure and more about maintaining consistent visibility and security controls across a growing and changing attack surface.\"}},{\"@type\":\"Question\",\"name\":\"6. What constitutes a threat to a network?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A network threat is anything capable of compromising the confidentiality, integrity, or availability of network resources, communications, systems, or data.\\u00a0A threat could involve:\\u00a0An external attacker\\u00a0A malicious or compromised insider\\u00a0Malware\\u00a0Stolen credentials\\u00a0A vulnerable network service\\u00a0A compromised device\\u00a0Malicious network traffic\\u00a0Misconfiguration\\u00a0A third-party compromise\\u00a0An attacker-controlled command-and-control system\\u00a0A threat should not be confused with a vulnerability. A network vulnerability is a weakness, while a threat is something capable of exploiting that weakness or otherwise causing harm. A network attack occurs when malicious action is actually taken against the environment.\"}}]}<\/script>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>What is Network Attack? A network attack is an attempt to compromise systems, services, communications, or data by exploiting or misusing a network and the devices connected to it.\u00a0 The attack may attempt to:\u00a0 Gain unauthorized network access\u00a0 Intercept communications\u00a0 Steal credentials or sensitive information\u00a0 Manipulate network traffic\u00a0 Exploit a network vulnerability\u00a0 Discover systems and [&hellip;]<\/p>\n","protected":false},"featured_media":20128,"template":"","class_list":["post-20127","glossary","type-glossary","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/glossary\/20127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/glossary"}],"about":[{"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/types\/glossary"}],"version-history":[{"count":14,"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/glossary\/20127\/revisions"}],"predecessor-version":[{"id":21298,"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/glossary\/20127\/revisions\/21298"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/media\/20128"}],"wp:attachment":[{"href":"https:\/\/www.netwitness.com\/it\/wp-json\/wp\/v2\/media?parent=20127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}