Attacks cross the network — the wires, routers and connections between machines. This lesson covers the classic network attacks and the defences that contain them, mapping neatly onto the CIA triad from Foundations.
Man-in-the-middle: attacking confidentiality and integrity
In a man-in-the-middle (MITM) attack, the adversary secretly positions themselves between two parties, relaying — and possibly altering — the traffic while both sides believe they're talking directly. On an open Wi-Fi network this is alarmingly easy. It breaks confidentiality (they read your data) and integrity (they can change it).
The defence is one you already understand: TLS (the Core lesson). By authenticating the server with a certificate and encrypting the channel, TLS makes a MITM see only noise and be unable to impersonate the real site. This is why "is there a padlock?" is genuine security advice, not superstition — and why an invalid-certificate warning must never be clicked past on a login page.
Denial of service: attacking availability
Some attackers don't want in — they want you down. A denial-of-service (DoS) attack floods a system with more requests than it can handle, exhausting its bandwidth or resources so legitimate users can't get through. A distributed DoS (DDoS) does this from thousands of compromised machines at once, and can generate staggering volumes of traffic. This is a direct assault on availability, the third leg of the triad. Defence is about absorbing and filtering: large content- delivery networks soak up the flood, and filters drop obviously malicious traffic before it reaches the origin.
Containment: firewalls, segmentation, zero trust
The other half of network security is limiting where an attacker who's already inside can go — directly countering the lateral movement stage from the last lesson:
- Firewalls control which traffic may pass between networks, blocking unexpected connections by default.
- Segmentation splits the network into isolated zones, so a breach in one area can't automatically reach the crown jewels in another.
- Zero trust is the modern culmination: drop the old assumption that anything "inside the network" is trusted. Instead, verify every request — every user, device and service authenticates and is authorised for each access, as if there is no safe perimeter at all. Given that attackers routinely get inside, assuming they will and limiting the blast radius is now the default philosophy.
Notice that no defence is perfect — TLS can be misconfigured, DDoS filtering can be overwhelmed, a firewall rule can be too loose. Which raises the question the Expert level is built around: since something will eventually get through, how do you detect it and respond? That's next.