Network Security Cheat Sheet

A concise overview of core network security concepts.

Firewalls

• Definition: A network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies.
• Types:
  • Packet Filtering: Inspects packets and allows/blocks based on IP, port, or protocol.
  • Stateful Inspection: Tracks the operating state and characteristics of network connections.
  • Proxy Firewalls: Acts as an intermediary for requests from clients seeking resources from other servers.
  • Next-Generation Firewall (NGFW): Combines traditional firewall technology with additional functionality, such as encrypted traffic inspection and intrusion prevention systems (IPS).

DDoS (Distributed Denial of Service)

• Definition: A malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.
• Attack Types:
  • Volumetric: Overwhelms bandwidth (e.g., UDP floods).
  • Protocol: Consumes actual server resources or intermediate communication equipment (e.g., SYN floods).
  • Application Layer: Targets web applications (e.g., HTTP floods).
• Mitigation: Rate limiting, Anycast network routing, IP reputation filtering, and scrubbing centers.

MitM (Man-in-the-Middle)

• Definition: An attack where the perpetrator secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other.
• Methods: ARP spoofing, DNS spoofing, session hijacking, Wi-Fi eavesdropping.
• Prevention:
  • Use strong encryption (TLS/SSL).
  • Implement HTTP Strict Transport Security (HSTS).
  • Use Virtual Private Networks (VPNs).
  • Implement certificate pinning in applications.

WAF (Web Application Firewall)

• Definition: A specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service.
• Purpose: Protects web applications against common zero-day exploits, malware infections, impersonation, and known vulnerabilities (like the OWASP Top 10).
• Key Protections: Cross-Site Scripting (XSS), SQL Injection (SQLi), file inclusion, and cross-site forgery.
• Operation: Operates at Layer 7 of the OSI model. Policies can be customized to the specific needs of the web application.