[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.1.b
AP Cybersecurity · Securing Networks
Exploiting Network Vulnerabilities
Getting in is the first problem. Moving sideways afterwards is what makes it a breach.
key ideaGetting in is the first problem. Moving sideways afterwards is what turns it into a breach.
exam-day recap
- Every network attack answers two questions: how they reached the network, and what they could do once inside.
- Lateral movement is using one compromised device to reach others on the same LAN.
- A firewall filters traffic entering or leaving a network; absent or misconfigured, floods, mapping and spoofing become possible.
- Port security limits which and how many devices may use a physical port; without it, plugging in is joining.
- A rogue access point is a wireless AP plugged into an open network port, giving wireless access to the internal network.
- A beacon frame is a wireless AP's periodic announcement that anything within range can hear, even from outside.
- Local networks assumed being connected implies being trusted — which is why the inside is often softer than the edge.
- A firewall protects the edge, not the interior; once inside, an adversary is not in its path.
- Wireless coverage is a physical boundary: signal reaching the pavement extends the network past the walls.
- Lateral movement is what converts one compromised device into a breach; controls limiting movement matter as much as those limiting entry.
The idea
The two questions
Every network attack answers two: how did they reach the network, and what could they do once inside. Controls at the boundary answer the first; segmentation and authentication answer the second, and organizations usually invest far more in the first.
Lateral movement
An adversary who compromises one device leverages that access to compromise others on the LAN. It is the reason a single infected laptop is a network incident rather than a device incident.
FirewallFilters traffic entering or leaving a network. Absent or misconfigured, floods, mapping and spoofing all become possible.
Port securityA switch feature limiting which and how many devices may use a physical port. Without it, plugging in is joining.
Rogue access pointA wireless AP plugged into an open network port, giving the adversary wireless access to the internal network — possibly from outside the building.
Beacon frameA wireless AP's periodic announcement. Anything within range can hear it, including someone standing outside the physical space.
Lateral movementUsing one compromised device to reach others on the same LAN.
| Vulnerability | How it is exploited | What it enables |
|---|
| no firewall, or a misconfigured one | malicious traffic sent into the network | DoS, mapping the internal structure, spoofing a legitimate device |
| an open data port with no port security | the adversary physically plugs in | joins the LAN — then DoS, MAC flooding, MAC spoofing |
| an open port plus a rogue AP | a wireless AP is plugged into the port | internal network reachable wirelessly, perhaps from outside |
| signal spilling outside the building | beacons and frames picked up from the street | information about the network; a foothold for wireless attacks |
| no device or user authentication | the adversary simply joins | attacks launched from inside the network |
| weak wireless encryption | the encryption is broken | traffic intercepted, stolen, or altered |
| a single compromised device | lateral movement | the rest of the LAN |
Row 7 is the multiplier. The other six get an adversary onto the network; the seventh is what gets them to the data — and it is the one segmentation is designed to stop.
Why it works that way
Reach ittraffic, a port, or the air
Join itwhere nothing authenticates you
Spreadlateral movement across the LAN
Local networks were designed on the assumption that being connected implies being trusted. That assumption is what an adversary buys the moment they plug in, join wirelessly, or compromise one machine — and it is why the inside of a network is often softer than its edge.
four uncomfortable facts
- A physical port with no port security is an open invitation: plugging in is joining.
- Wireless signal does not stop at the wall — coverage is a security boundary, not just a convenience.
- Networks that do not authenticate devices and users make joining trivial.
- One compromised device is a foothold, not an endpoint. Assume the adversary will move.
Worked analysis
EX 1
The socket in the waiting room
A clinic has an active network port in a public waiting area. What can an adversary do, and what stops it?
1
State what plugging in achieves
Without port security, the device joins the LAN immediately.
2
List the attacks that follow
DoS, MAC flooding to force broadcast mode, or MAC spoofing to impersonate a trusted device.
3
Note the worse option
Plugging in a rogue access point extends the internal network wirelessly, possibly to the car park.
4
Give the controls
Disable unused ports, enable port security, and put public areas on a separate segment.
5
Note the layering
Even if one control fails, segmentation limits what the port reaches.
EX 2
Signal that reaches the pavement
A war-driving adversary detects a company's wireless network from the street. Nothing has been attacked yet. What is the exposure?
1
Name what is available
Beacons and frames from an AP broadcasting outside the physical space.
2
State what that yields
Information about the wireless network — its type, its security, where coverage extends.
3
State the next step
Attempting to break the wireless encryption to intercept or alter data.
4
Note the physical-security connection
Wireless coverage is a boundary the building plan does not show.
5
Give the controls
Reduce transmit power and reposition APs, use strong wireless encryption, and require device authentication to join.
EX 3
One laptop, whole network
An employee's laptop is infected by a phishing attachment. Within a day, three servers show unauthorized logins. Explain the mechanism.
1
Name the initial compromise
One device, via a human layer failure.
2
Name what followed
Lateral movement — leveraging that access to compromise other devices on the LAN.
3
Say what made it easy
A flat network with shared credentials and no restriction on machine-to-machine traffic.
4
Give the controls
Segmentation, least-privilege accounts, and monitoring for unusual internal connections.
5
State the design principle
Assume one device will be compromised, and design so that it is not enough.
Common traps
A firewall protects the edge, not the interior
It filters what crosses the boundary. Once an adversary is inside — by plugging in, joining wirelessly, or infecting a laptop — it is not in the path.
An unused port is not a safe port
Without port security an active socket is an open door. Disable what is unused rather than trusting that nobody will notice it.
Wireless coverage is a physical boundary
Signal reaching the pavement extends the network past the walls. Adversaries standing outside secure spaces can collect beacons and frames.
Getting in is not the whole attack
Lateral movement is what converts one compromised device into a breach. Controls that limit movement matter as much as controls that limit entry.
Check yourself
What can an adversary do by sending malicious traffic into a network with no firewall?
Show answer
Flood it to create a denial of service, map the internal structure of the network, or spoof a legitimate device. A misconfigured firewall allows the same things.
Why is an open data port dangerous?
Show answer
Without port security, plugging in grants LAN access through the switch port — enabling DoS, MAC flooding and MAC spoofing. A rogue access point plugged into it extends the network wirelessly.
What does an adversary standing outside the building gain from wireless signal?
Show answer
They can pick up beacon frames and signals from an AP broadcasting beyond the physical space, gathering information about the network and attempting to break its encryption.
What is lateral movement, and why does it matter?
Show answer
Using one compromised device to compromise others on the LAN. It is what turns a single infected machine into an organization-wide incident, and it is why segmentation matters.