Four words
| Term | Meaning | Example |
|---|---|---|
| Vulnerability | A weakness | A router that still accepts Telnet, with password cisco |
| Exploit | Something that uses a weakness | A script that tries common passwords on port 23 |
| Threat | Someone or something that could use an exploit | An attacker on the guest Wi-Fi |
| Mitigation | What reduces the risk | SSH only, strong secrets, an ACL on the vty lines |
Common attacks
| Attack | What happens |
|---|---|
| Denial of service (DoS / DDoS) | Flood a device or link until real users can't get through |
| Spoofing | Fake a source address (IP, MAC) to hide or to pretend to be someone else |
| Reflection and amplification | Spoofed small requests make servers send big answers to the victim |
| Man-in-the-middle | Get between two devices (ARP spoofing, a rogue DHCP server) to read or change traffic |
| Reconnaissance | Scan and probe to learn what's on the network |
| Malware | Viruses, worms, trojans, ransomware |
| Social engineering | Phishing, spear phishing, whaling, vishing, smishing, pretexting, tailgating |
| Password attacks | Guessing, dictionary and brute-force attacks |
A security program
- User awareness: everyone knows the risks (phishing tests, posters, reminders).
- User training: formal lessons for people with specific jobs.
- Physical access control: locked rooms, badges, cameras. Anyone at a console port can reset the passwords, so the network room must be locked.
Passwords and beyond
Good password policy: long passphrases, no reuse, no shared accounts, changed after a leak (not every month for no reason). Better still, add another factor:
| Factor | Examples |
|---|---|
| Something you know | Password, PIN |
| Something you have | Phone app code, hardware key, smart card |
| Something you are | Fingerprint, face |
Multi-factor authentication (MFA) needs two different kinds: a password plus a phone code is MFA, two passwords are not. Certificates prove identity with a key pair signed by a certificate authority (CA), as web servers and VPNs do.
VPNs
| Type | Who | How |
|---|---|---|
| Site-to-site | Two offices, all their traffic | IPsec between the two routers or firewalls; users notice nothing |
| Remote access | One laptop to the office | A VPN client (TLS or IPsec) on the laptop |
IPsec gives confidentiality (encryption), integrity (hashes), authentication (pre-shared keys or certificates) and anti-replay. Plain IPsec carries only unicast; GRE over IPsec also carries routing protocol multicasts.
Remember: Vulnerability = weakness, exploit = what uses it, threat = who could, mitigation = what stops it. MFA = two different kinds of factor.