Summary

There are several types of network attacks. Some of the most popular network attacks include viruses, worms, Trojans, DoS, DDoS, spyware, and phishing. Viruses are executable software that attack a host by attaching to a program or file such as an e-mail or spreadsheet. Viruses can wreak havoc on the target PC if the virus executes on the user's machine. Worms are more network-centric than viruses and do not require a host to replicate. Worms look for vulnerabilities to attack and initiate other network connections. Trojans attack by attempting to masquerade as something innocuous, such as a screen-saver or game. DoS attacks prevent legitimate network activity by attacking a vulnerability such as an expected packet size or buffer size for an application. A DDoS attack prevents legitimate network traffic by flooding the network with traffic from multiple or distributed sources, such as from zombies or botnets. Spyware is a network attack that monitors or spies on a user's activity, including keystrokes such as usernames or passwords. Phishing is a type of network attack that often sends an e-mail to an unsuspecting user and attempts to trick the user into logging on to a fake website, such as a bank or ecommerce site, through a link in the phishing e-mail. When the user logs on to the fake website, the phishing attack gathers the username and password.

Traditional network security is composed of router access lists, firewalls, and IDS appliances. Self-defending networks complement traditional network security by providing additional layers of security on the network. Self-defending networks have the ability to recommend configurations to stop certain network attacks. Self-defending networks also have the ability to automatically stop certain network attacks, including the automatic update of new configurations to the security devices within the self-defending network.

Components within the self-defending network include DDoS mitigation with Cisco Guard and Detector, the Cisco Adaptive Security Appliance (ASA), Cisco Incident Control Service (Cisco ICS), Network Admission Control (NAC) framework in routers and switches, NAC appliances, 802.1x identity, Cisco Security Agent (CSA), and centralized management. Cisco's core centralized security management products are the Cisco Security Manager (CS-Manager) and Cisco Security Monitoring, Analysis, and Response System (CS-MARS).