Network Security Risks

Networks let devices share files, messages and services, but the data they carry is often personal, financial or confidential. That is what makes them a target: anyone who can reach the network, from another device on the same Wi-Fi or from the other side of the world, may try to steal, change or destroy that data or stop it being available.

Threats to networks

Social engineering attacks the person rather than the technology, so a firewall cannot stop it. A phishing email looks genuine but pushes you to hand over a password or click a link. Because it relies on trust, training staff to spot it matters as much as software does.

A denial of service (DoS) attack steals nothing; it makes a service unavailable. If a hospital's appointment booking system is flooded, patients cannot book and staff must fall back on paper lists. Requests sent from thousands of infected computers at once are also hard to block.

A brute-force attack relies on speed rather than cleverness, trying thousands of combinations every second. Short, common passwords fall quickly, while a long password of mixed characters would take far too long to guess.

Data interception happens because data crossing a network passes through cables and radio signals that other people may be able to read. Traffic on an unencrypted wireless connection can be captured as it passes, so even a secure device can leak data once it sends it.

These threats are why an organisation must protect its systems and data, and why it first looks for its own weaknesses using penetration testing and ethical hacking.

Penetration testing (pen testing) is the deliberate attempt to find security holes in an organisation's own systems, carried out with the permission of the organisation that owns them. Testers break in on purpose, but they are on the organisation's side.

Finding a weakness before an attacker does is the whole point. If a tester finds an unlocked door into the network, the organisation can lock it; if a criminal found it first, data could be stolen, changed or destroyed. Penetration testing therefore lets an organisation fix weaknesses and reduce risk rather than wait to be attacked.

What a test involves

A test follows four stages:

1. Identify targets of potential attacks — decide which servers, databases or accounts are worth attacking, such as the system holding customers' payment details.
2. Identify possible entry points — look for ways in, such as an out-of-date login page or a router still using the default admin password.
3. Attempt to break in — try the attack, carefully, to prove the entry point really works.
4. Report the findings — write up what was found and how serious it is, so the organisation knows what to fix first.

For example, a tester for a chain of bike shops might find an old order form that lets anyone view past orders. After breaking in to prove it, they report it and the shop fixes the form.

White box and black box

A test can be white box or black box. In a white box test, the testers are given credentials and system information, so they simulate an attack by an insider and can test what someone with authorised access could do. In a black box test they get no inside knowledge, so they attack from outside as an external hacker would.

Either way the test is authorised, because the owner has given permission, so it is not a criminal attack. Even a thorough test does not prove a network has no weaknesses — it only shows that the weaknesses the testers looked for were not found or have been fixed.

White box penetration testing is an authorised test that simulates an attack by a malicious insider — someone who already has legitimate access to an organisation's systems and knows how they are set up.

The organisation gives the testers permission to look for weaknesses, which makes the test legal and planned rather than a criminal attack. Testers report what they find so it can be fixed.

What the testers start with

White box testers may be given basic credentials, such as a standard staff login, so they can begin inside the system rather than guessing passwords from outside. They may also be given network and system information: the layout of the network, the names of servers, which software and versions are running, and how the different parts connect. This inside knowledge lets them aim at the places most likely to be weak instead of trying random attacks.

What they can check

• Internal policies and procedures — for example, whether accounts for people who have left are closed quickly, or whether staff really follow the password rules.
• Access rights — whether a login meant for a part-time receptionist can open files it should not, such as payroll records.
• Controls — whether logging, permissions and approval steps actually stop someone with a low-level account from doing damage.
• System pathways — the routes through menus, services and data. Testers follow these routes to see if a normal user can reach administrator tools or sensitive areas.

A youth theatre runs an online booking system. Its white box testers are given a volunteer's login and the network layout, which shows the booking database shares a server with the group's email. They sign in as the volunteer, follow the booking pages to an admin menu a volunteer should not reach, and try to read a file of another volunteer's details. Their report shows which access rights and controls let an insider go too far.

Because the tester already has inside knowledge, the test shows what an authorised insider could do — which is different from black box testing.

Black box penetration testing is an authorised test that imitates an external hacking or cyber warfare attack launched by an outsider against an organisation's computer systems. It is used to find out how well the organisation's outward-facing defences hold up against someone attacking from outside.

The tester is given no internal details about the target system's credentials or network layout. They do not receive staff usernames, passwords or a map of the network. Instead, they must find weaknesses from the outside in the same way an external attacker would, starting only with what any outsider could discover.

Even though the tester has been given no internal details, the test is authorised. The organisation has given permission for the tester to try to break in. This is what separates black box penetration testing from a criminal attack: the work is agreed in advance and is done to improve security, not to cause harm.

What the test shows

Black box testing shows what harm an outsider with no internal details could cause. Because the tester can only use outside access, anything they can reach shows what an external attacker might also reach. The organisation can then see where its external defences are weak and fix them before a real attacker finds them.

For example, a small cinema chain hires a black box tester and gives them only the company's public website address. The tester has no staff logins and no network map, so they probe only what an outsider could see. If they can reach the booking system's admin area, the chain has learned that an outsider might do the same, and it can strengthen that defence before a real attacker finds it.

Ethical hacking means using hacking techniques after the owner of the computer system or data has given approval. Hacking is often associated with illegal activity, but it is not always illegal. The key difference is permission: the owner must authorise the work.

Black hat and white hat

Black hat hacking means accessing a computer system or its data without consent from whoever owns it. The hacker has no permission, so the activity is illegal.

White hat hacking uses similar techniques to black hat hacking, but it has the owner's permission. White hat hackers are not criminals: they use their skills to help an organisation find weaknesses before a criminal does.

For example, imagine a school's online quiz stores the correct answers inside the web page. If a student digs out those answers to beat the quiz without permission, that is black hat hacking. If the school pays a security tester to try the same trick and report the flaw, that is white hat hacking.

Reporting what they find

If ethical hackers find security holes, they inform the organisation and help to fix the problem. They do not keep the weakness secret or exploit it for personal gain. For example, a tester might discover that an online shop shows another customer's order when the order number in the address is changed. They report it to the shop, and the developers add a check so only the correct customer can see the order. Fixing the weakness before an attacker finds it protects the organisation's data and systems.

Penetration testing and ethical hacking are both authorised ways of identifying network vulnerabilities. Both rely on the owner's permission and both aim to find weaknesses so that they can be repaired.