Question
What are three of the most common categories of network attacks on enterprise networks?
Answer
The three most common enterprise network attacks are: Distributed Denial of Service (DDoS), Data Breaches, and Malware (including ransomware).
| Attack Type | Description | Example |
|---|---|---|
| DDoS | Coordinated attack from many compromised devices ("zombies") to overwhelm a target's website or resources | Mirai botnet attack (2016) took down DNS (Domain Name System) provider Dyn |
| Data Breach | Compromise of servers or hosts to steal confidential information | Equifax breach (2017) — 147 million records |
| Malware | Malicious software infecting hosts — viruses, worms, trojans, ransomware | WannaCry ransomware encrypted data and demanded payment |
Key insight: While these attacks get the headlines, they often start with a Layer 2 compromise on the local network. If an attacker gains access to the LAN (Local Area Network), they can escalate to any of these attack types. That's why securing the switch infrastructure (Layer 2) is critical — it's the foundation everything else sits on.
Go deeper:
Denial-of-service attack (Wikipedia) — DDoS via botnets and the Mirai/Dyn 2016 example.- Data breach (Wikipedia) — breaches, threat actors and notification law.
- Malware (Wikipedia) — viruses, worms, trojans and ransomware (the WannaCry category).
Note saved — thanks!
Question
What network security devices protect the enterprise perimeter, and what does each do?
Answer
The three main perimeter security devices are: VPN (Virtual Private Network)-enabled routers (encrypted remote access), Next-Generation Firewalls (deep packet inspection), and Network Access Control devices (AAA (Authentication, Authorization, and Accounting) enforcement).
| Device | Function | Key Features |
|---|---|---|
| VPN-Enabled Router | Provides secure encrypted tunnels for remote users across public networks | IPSec (Internet Protocol Security), SSL (Secure Sockets Layer) VPN; VPN services can be integrated into the firewall |
| Next-Generation Firewall (NGFW) | Deep inspection and control of network traffic | Stateful packet inspection, application visibility, NGIPS (intrusion prevention), AMP (advanced malware protection), URL (Uniform Resource Locator) filtering |
| Network Access Control (NAC) | Controls who can access the network and enforces policies | Authentication, authorization, accounting (AAA); Cisco ISE is an example; manages access across wired, wireless, and VPN |
Important: These perimeter devices protect against external threats. But if an attacker is already inside the LAN (Local Area Network) (rogue device, compromised host, malicious insider), perimeter defenses don't help. That's where Layer 2 security (port security, DHCP (Dynamic Host Configuration Protocol) snooping, DAI (Dynamic ARP Inspection)) becomes essential.
Go deeper:
- Next-generation firewall (Wikipedia) — deep-packet-inspection and application-aware filtering.
- Network segmentation (Wikipedia) — why perimeter zoning + defense-in-depth limits lateral movement.
Note saved — thanks!