Network Security
How attacks work, what defenses actually matter, and how to build a network that holds up under real-world threats.
Why network security matters more than ever
Network security used to be primarily a concern for large organizations. That's no longer true. The shift to remote work, the proliferation of smart home devices, and the industrialization of cybercrime have made home and small business networks significant targets. Attackers don't need to specifically target you — automated tools scan the entire internet continuously, probing for weak passwords, unpatched vulnerabilities, and misconfigured devices.
The consequences of a compromised network range from bandwidth theft to ransomware that encrypts your files, credential theft from banking and email accounts, your devices being conscripted into botnets used for distributed attacks, and personal or financial data being sold on criminal marketplaces.
Understanding the modern threat landscape
Cybercrime has professionalized significantly. Rather than lone hackers, most attacks today come from organized groups with defined roles: developers who write malware, operators who deploy it, and negotiators who handle ransom payments. Ransomware-as-a-service platforms let non-technical criminals launch sophisticated attacks by renting tools and infrastructure from specialists.
Understanding who attacks networks and why helps prioritize defenses. Opportunistic attackers use automated tools to find easy targets — weak passwords, unpatched systems, default credentials. Targeted attackers research specific organizations or individuals before striking. Nation-state actors focus on critical infrastructure, government systems, and large corporations.
Most common attack vectors in 2025
- Phishing and social engineering
- Credential stuffing from data breaches
- Unpatched software vulnerabilities
- Weak or default passwords on devices
- Malicious email attachments and links
- Public WiFi interception
- Supply chain compromises
What attackers typically want
- Financial credentials (banking, crypto)
- Personal identity information for fraud
- Ransomware payment via encrypted files
- Computing resources for mining or DDoS
- Corporate trade secrets or intellectual property
- Email access to launch further phishing
- Data to sell on dark web markets
Common network attacks explained
Man-in-the-Middle (MITM) attack
An attacker positions themselves between you and a server, intercepting and potentially modifying traffic. On public WiFi, this can be done by setting up a rogue access point with the same name as the legitimate network (evil twin attack). Victims connect to the attacker's device, which relays traffic to the actual internet — watching everything that passes through.
How to protect yourself:
- Always use HTTPS (check the padlock)
- Use a VPN on public WiFi
- Avoid sensitive transactions on public networks
- Enable HSTS in your browser
Warning signs:
- SSL certificate errors or warnings
- Unexpected redirects to login pages
- Multiple WiFi networks with same name
- Unusually slow connections
DNS hijacking
Attackers intercept or modify DNS responses to redirect your browser to malicious servers. This can happen at the router level (compromised home router pointing to attacker-controlled DNS servers), through malware on your device, or via a compromised DNS provider. You type a legitimate URL, but end up at a fake site that looks identical — designed to steal your credentials.
How to protect yourself:
- Use encrypted DNS (DoH or DoT)
- Change your router's admin password
- Keep router firmware updated
- Run periodic DNS leak tests
Check now:
Run a DNS leak test →Ransomware
Ransomware is malicious software that encrypts your files and demands payment (typically in cryptocurrency) for the decryption key. It spreads through phishing emails with malicious attachments, drive-by downloads from compromised websites, exploitation of remote access vulnerabilities (RDP, VPN), and lateral movement after gaining initial access to a network.
Modern ransomware often exfiltrates data before encrypting it — threatening to publish sensitive information if the ransom isn't paid. This "double extortion" tactic makes backups alone an insufficient defense.
- Maintain offline or immutable backups (3-2-1 rule: 3 copies, 2 media types, 1 offsite)
- Keep all software and OS updated immediately when patches release
- Disable RDP if not needed; use VPN + MFA if required
- Train users to recognize phishing — the most common initial access vector
- Use email filtering to block malicious attachments
DDoS (Distributed Denial of Service)
A DDoS attack floods a target with traffic from thousands of compromised devices (a botnet), overwhelming its capacity to respond to legitimate requests. Home users are rarely targeted by DDoS, but they can be unwitting participants — their unprotected IoT devices (cameras, routers, smart TVs) are often recruited into botnets.
Protect your IoT devices: change default credentials, update firmware, and consider placing them on a separate guest network segment isolated from your main devices.
Securing your home network: a practical guide
Most home network compromises are preventable with basic configuration changes. The problem is that routers arrive with default settings designed for easy setup, not security. Changing these defaults takes 30–60 minutes and dramatically reduces your attack surface.
Router hardening
- Change admin credentials — Default usernames (admin, root) and passwords are published in manufacturer manuals online. Attackers use automated tools to scan for routers with default credentials. Use a unique, strong password for your router admin interface.
- Disable remote management — Unless you specifically need to manage your router from outside your network, disable WAN access to the admin interface. This removes a significant attack surface.
- Update firmware — Manufacturers release firmware updates to fix security vulnerabilities. Many routers can auto-update; enable this if available. Check manually quarterly if not.
- Disable WPS — Wi-Fi Protected Setup has known vulnerabilities (the WPS PIN can be brute-forced). Disable it unless you specifically need it.
WiFi configuration
- Use WPA3 — WPA3 is the current WiFi security standard, offering stronger protection than WPA2, particularly against password guessing attacks. If your router supports it, enable WPA3 (or WPA2/WPA3 transition mode for older device compatibility).
- Strong WiFi passphrase — Use a 16+ character random passphrase. A short password can be cracked by offline dictionary attacks if an attacker captures the 4-way handshake. Longer passphrases make this impractical.
- Guest network — Create a separate guest network for visitors and IoT devices. This network should be isolated from your main network so that a compromised smart device cannot reach your computers and files.
- Disable SSID broadcast? — Hiding your network name (SSID) provides minimal security — it's easily discovered by passive WiFi scanning. Focus on strong encryption and passwords instead.
Firewalls: what they do and how to use them
A firewall monitors and controls network traffic based on defined rules. It acts as a gatekeeper, blocking connections that don't meet your security policy. Most routers include a basic firewall by default; many operating systems include a host-based firewall; and enterprise networks use dedicated firewall appliances.
Stateful packet inspection
Modern firewalls track the state of connections — not just individual packets. They know whether a packet is part of an established connection, a new connection, or unsolicited inbound traffic. This allows them to permit responses to your outbound requests while blocking unrequested inbound connections. Your home router uses this by default.
Application layer filtering
Next-generation firewalls can inspect traffic at the application level — identifying and controlling specific applications, not just ports. They can distinguish between legitimate HTTPS traffic and HTTPS-tunneled malware C2 traffic. This capability requires deep packet inspection and is typically found in enterprise products.
Host firewall best practices
- Enable the OS firewall on every device (Windows Defender Firewall, macOS Firewall)
- Block all inbound connections by default; only allow what you need
- Review and remove firewall rules created by applications you've uninstalled
- Use outbound filtering to detect applications phoning home unexpectedly
- Consider a DNS-based filter (Pi-hole, NextDNS) for network-wide blocking
- Log dropped connections to identify scanning attempts
Zero trust: the modern security architecture
Traditional network security assumed that everything inside the network perimeter was trusted and everything outside was not. This model breaks down when attackers get inside the perimeter (via phishing, compromised credentials, or a single vulnerable device) and move laterally through the network unchallenged.
Zero trust replaces "trust but verify" with "never trust, always verify." Every access request — regardless of where it comes from, inside or outside the network — must be authenticated and authorized based on multiple factors: identity, device health, location, time, and the specific resource being accessed.
Verify explicitly
Authenticate and authorize every access request using all available data points: identity, device posture, location, time, and behavioral analytics. Never assume a connection is safe because of where it originates.
Least privilege access
Grant only the minimum access needed for a specific task, for the minimum necessary time. Don't give admin accounts to users who don't need them. Don't keep services running that aren't actively used.
Assume breach
Design systems assuming that attackers may already be inside. Use network segmentation to limit lateral movement. Encrypt data at rest and in transit. Monitor for suspicious behavior within the network, not just at the perimeter.
Network monitoring and threat detection
You cannot defend against threats you cannot see. Monitoring your network traffic creates visibility into what's actually happening on your network — identifying anomalies that may indicate a compromise, an infected device, or unauthorized access.
What to monitor at home
- Devices connected to your network — know what should be there
- Router admin logs — look for unexpected login attempts
- DNS queries — unusual domains or known malware C2 indicators
- Bandwidth usage per device — unexpected high usage can indicate compromise
- New port forwarding rules — malware sometimes opens inbound ports
Useful home monitoring tools
- Pi-hole — DNS-based network filter that blocks malicious domains and provides query logs
- Wireshark — Deep packet analysis for investigating specific traffic
- nmap — Port scanning to see what services are exposed on your network
- Your router's UI — Most modern routers show connected devices and basic traffic logs
What to do if your network is compromised
Despite best efforts, breaches happen. Having a response plan prepared means you act effectively instead of panicking. The goal is to contain the damage, eradicate the threat, and recover operations as quickly as possible.
- 1Contain — Immediately disconnect affected devices from the network. Isolate the infection before it spreads further. Do not power off devices if law enforcement involvement is anticipated — forensic evidence may be lost.
- 2Assess — Determine what was accessed, what data may be affected, and how the attacker got in. Check router logs, running processes, and recently created or modified files. This helps understand the scope and prevents re-infection.
- 3Eradicate — For severely compromised devices, a clean reinstall of the operating system is safer than trying to remove malware. Malware can persist in ways that are difficult to detect and remove completely. Reset your router to factory defaults and reconfigure it securely.
- 4Change credentials — Change all passwords for accounts that may have been accessible from the compromised network. Start with email, banking, and password manager. Enable 2FA everywhere. Assume all stored passwords were compromised.
- 5Recover and improve — Restore from clean backups. Address the vulnerability that allowed the initial compromise. Review and improve your security posture so the same attack cannot succeed again.
Home network security checklist
Router and WiFi
- □ Change default router admin username and password
- □ Use WPA3 or WPA2 with a strong 16+ character passphrase
- □ Disable WPS (Wi-Fi Protected Setup)
- □ Disable remote management from WAN
- □ Update router firmware — enable auto-update if available
- □ Create a separate guest network for IoT and visitors
- □ Review port forwarding rules — remove anything unused
Devices and accounts
- □ Enable OS firewall on all computers
- □ Keep operating systems and apps updated
- □ Use unique passwords via a password manager
- □ Enable 2FA on all important accounts
- □ Run regular backups — test that they restore correctly
- □ Change default credentials on all IoT devices
- □ Disable unused services (Bluetooth, WiFi, remote desktop)
Key takeaways
- → Most attacks exploit defaults and known vulnerabilities — patching and changing defaults stops the majority.
- → Network segmentation (guest WiFi, VLANs) limits how far an attacker can move after initial access.
- → Use WPA3, strong WiFi passphrases, and updated router firmware as your first three actions.
- → Encrypted DNS prevents ISPs and attackers from seeing which sites you visit.
- → Backups that are tested and stored offline are your best defense against ransomware.
- → Have a simple incident response plan ready before you need it.