Network Monitoring Handbook:
The Complete Guide to Network Monitoring

Malware Threats

Ransomware has become the most popular type of cyber security threat in recent years. According to Statista, over 51 percent of organizations that got hit with ransomware ended up paying the ransom. Cybercriminals are coming up with new ways to infiltrate networks with ransomware. Once infiltrated, all your documents will be locked till you pay the ransom, and there is no guarantee that your documents will be released even if you do pay the ransom.

Spyware and Adware

These are software programs surreptitiously installed on your computers without your consent. Once installed, an adware program will collect information about your browsing habits and show you targeted advertisements. Spyware, on the other hand, collects your personal information such as email address, passwords, financial information, and even credit card numbers. These programs subject you to a high risk of identity theft.

Distributed Denial of Service (DDoS)

This is one of the most powerful weapons that cybercriminals have against legitimate networks. A DDoS attack is carried out by overwhelming the target user’s networks with malicious traffic. When the network gets overwhelmed, legitimate users will experience a denial of service. DDoS is often used as an act of sabotage, protest, or even revenge and, as a successful attack prevents legitimate users from accessing the target's website, it causes both business disruption, with associated financial implications, and reputational damage.

Social Engineering/Phishing Attacks

These attacks use psychological manipulation to make unwitting people click on malicious links containing worms or malware. According to Purplesc, 98 percent of all cyberattacks are executed through social engineering. A naïve corporate employee clicking on a malicious link will provide a hacker with access to huge volumes of sensitive information. It remains more prevalent because of the ease with which it can be carried out. The recent dramatic increase in remote working has led to an even more dramatic rise in these attacks with many specifically referencing Covid-19 or typical lockdown activities such as watching TV streaming services.

SQL Injection Attack

Most modern databases are based on Structured Query Language (SQL). It is also widely used in web servers for storing data for websites. By injecting malicious SQL code into one of these data-driven applications, hackers can gain access to private data and even destroy it without a trace. This type of attack poses one of the major threats to data privacy and confidentiality.

Man-in-the-Middle Attack

This occurs when an attacker intercepts a private communication between two users. By gaining access to this private message, the attacker can either steal the data shared between the users or send forged messages impersonating another user.

Cryptojacking

This type of attack has become increasingly popular recently with the emergence of cryptocurrencies into the mainstream. This involves the use of another person’s computer for mining cryptocurrency. Since businesses come with large networks and bandwidths capable of crypto mining, they are often victims of illegal cryptojacking. This is conducted through a regular social engineering attack where mining codes are downloaded in a user’s computer after clicking a malicious link. Once infected, the hacker can execute the code and start mining cryptocurrencies.

Packet-Filtering Firewalls

This is the most basic type of firewall that can be installed in a network. It creates a checkpoint at a switch or a router and filters the data packets that pass through it. Various factors such as packet origin, destination, packet type, port number, etc., are identified before the packets are allowed to pass. This can be very helpful as a basic security device, but sophisticated attackers can easily bypass them through IP spoofing.

Application Layer Firewalls

As the name implies, this firewall operates at the application layer of the network as a gateway and filters the incoming traffic. When data packets arrive at this point, this firewall connects with the source of the data and checks the incoming traffic. Apart from routine inspection, they can also perform detailed inspections to determine if the traffic contains malware.

Circuit-Level Firewalls

This firewall operates by verifying the transmission control protocol (TCP) handshake. It applies different types of security mechanisms to make sure that the packet is legitimate at the TCP check. Once the TCP handshake is established, there is no further filtering or monitoring of data packets. This is one of the simplistic types of firewalls that approves or denies traffic quickly.

Stateful Inspection Firewalls

By combining the packet inspection technology and the TCP handshake check technology, the stateful inspection firewalls have created a higher level of security in comparison with the other two. Despite offering high-level protection, these firewalls are resource intensive and may put an additional strain on networks. This could even slow down the packet transfer as a result.

Next Generation Firewalls

Recently, there have been various firewalls that are being touted as next generation. There are many features that can be considered next generation. Some of them include surface-level packet check, TCP handshake check, and deep-level packet check. These firewalls can also work together with intrusion detection systems to create a solid defense against cyberthreats.

Signature-Based

This method uses patterns of predefined signatures to detect and prevent incoming attacks. If an incoming attack matches any of the signatures already defined by the administrator, the system will deploy the appropriate prevention techniques to deter the attack.

Statistical Anomaly-Based

This method uses anomalous activities originating from within to deter a potential attack. For instance, if there is an unusual surge in network traffic during unusual hours, the system will check the protocols and determine what is normal for that network at that time. Upon detection, the network administrator will be notified instantly of the behavior. In this method, the baselines for alarm must be configured intelligently. Otherwise, you might face a lot of false alarms in the system.

Policy-Based

In this approach, network administrators configure security policies for the system based on organizational requirements and the network infrastructure. Any activities that violate these policies will trigger a notification and alert the administrator. Based on the severity of the trigger, the administrator will take the necessary actions.

Access Control

A network that provides uncontrolled access to everyone is extremely vulnerable to an attack. While malicious insiders and outsiders are a massive threat, a small negligence by a naïve employee can also wreak havoc on your network. It is for this reason that you need to limit the access of people who use your network. By incorporating a strong security policy, you can prevent unauthorized devices and people from entering your network.

Endpoint Security

Endpoints often become the target for attackers as they provide easy access to a network. By incorporating endpoint monitoring in your system, you can add an extra layer of security to your network. Endpoint monitoring solutions like RMM can monitor your devices in real-time and detect any signs of intrusion.

Anti-Malware

There are different types of malware used by hackers to infect a network. These viruses, worms, trojans, spyware, etc., can also spread across a network and lie undetected for days or months till a hacker decides to attack the network. With an anti-malware or anti-virus system, you can detect these infections early and resolve the damages they may cause to a network.

Application Security

Applications are vulnerable to various attacks. Hackers often figure out security loopholes in applications over time. Hence, all applications need to be up to date. With regular patching, you can prevent hackers gaining control of your outdated applications.

Behavioral Analytics

A baseline should be established by the network administrator on what normal behavior looks like in a network. This baseline should be configured in behavioral analytics software so that it can spot anomalies or breaches in your network as soon as they appear. This early detection is critical in minimizing data loss and increasing uptime.

Email Security

Your email offers the easiest route for an attacker to target a system. It still is one of the most prevalent ways in which a network could be compromised. A social engineering email containing a suspicious link can easily lure an unwitting employee to click on it. You need to incorporate email security to prevent incoming attacks as much as possible or outgoing messages from carrying certain types of files. Such attacks have become increasingly sophisticated, so it is important that you use a modern email security system specifically designed to protect against them. Many well-established email security solutions were designed for older, less sophisticated attacks, so may not be as effective as you need.

Data Loss Prevention

This is something you can incorporate exclusively in your databases. This tool can prevent data leakages when they are in transit, in use, or at rest. You can use this to block your sensitive data from being leaked outside of your organizational boundaries.

Network Segmentation

This involves dividing network traffic based on certain classifications. This helps direct the right traffic to the right destination and filter out the rest. It helps network security by preventing traffic from unknown or unauthorized sources. Moreover, if the network is compromised, this helps confine the damages only within the compromised segment.

Mobile Security

Mobile devices can often be a target of security threats as they contain plenty of personal information. It is also becoming widely prevalent that employees use their mobile devices for certain aspects of work. Mobile security solutions ensure that network traffic stays private and does not leak through mobile devices.

Virtual Private Network (VPN)

VPNs are used to authenticate communication between an endpoint and a secure network. This tool also creates an encrypted line between an endpoint and a network. This prevents external eavesdropping when communication takes place.

Web Security

This is the best way to prevent visits to malicious sites, either unwittingly or intentionally. With a web security tool, you can limit access to certain sites that could contain malware. In addition to limiting traffic, this also protects your employees and customers from other web-based threats.