Security Threat Landscape

Overview

CCNA security starts with knowing common threats (malware, social engineering, DoS) and matching controls (ACLs, switch security, firewalls). This guide maps attack types to mitigations at exam depth.

Security fundamentals

CCNA expects you to recognize common threats and map them to layered defenses: firewalls, ACLs, switch security (port security, DHCP snooping), device hardening, and encryption.

Malware

Malware is malicious software. Know these types for the exam:

Hacking tools (awareness)

Penetration testers use the same tools as attackers to find weaknesses:

• Password crackers
• Packet sniffers (Wireshark) — read unencrypted traffic
• Ping sweepers
• Port and vulnerability scanners

Reconnaissance and social engineering

Reconnaissance gathers information about a target before attacking — from passive sources (WHOIS, job listings) to active tools (ping sweeps, port scans).

Social engineering manipulates people into revealing credentials or sensitive data — often via phone or email, with no technical exploit required.

Phishing is social engineering via fake emails or websites impersonating trusted brands to steal passwords or payment data.

Data exfiltration

Data exfiltration is unauthorized data leaving an organization — by external hackers after compromise, or insiders (malicious or accidental, e.g., email with secrets, lost USB drive).

Denial of Service (DoS)

A DoS attack floods a target with more traffic than it can handle, denying service to legitimate users. Single-source DoS can be blocked by filtering that source.

TCP SYN flood

DDoS and botnets

Distributed DoS (DDoS) attacks originate from many sources (botnet), making simple source blocking ineffective. Infected hosts connect outbound to C2 servers — bypassing inbound firewall rules.

Spoofing

Spoofing fakes identity:

Reflection and amplification

Reflection attacks spoof the victim's address as the source, causing reflectors to flood the victim with responses. Amplification uses protocols that return much larger responses than requests (e.g., DNS, NTP) to multiply attack volume.

Man-in-the-middle (MITM)

The attacker inserts into the communication path between legitimate hosts — reading or modifying traffic. ARP spoofing is a classic L2 MITM attack on IPv4 LANs.

Password attacks

When a login prompt is reachable:

1. Enumeration — discover valid usernames
2. Guessing, brute force, dictionary attacks — obtain passwords

Mitigation: account lockout, strong passwords, MFA, limit management access with ACLs/VTY restrictions.

Buffer overflow

Malformed or oversized data sent to a service can crash it (DoS) or allow arbitrary code execution (compromise).

Packet sniffers

On a compromised host or in the traffic path, sniffers capture packets. Unencrypted protocols (Telnet, HTTP, SNMPv1/v2c communities) expose credentials immediately. Use SSH, HTTPS, and SNMPv3.

IDS and IPS

Both use signatures (known attack patterns) and anomaly detection (unusual behavior). Require tuning to minimize false positives/negatives.

IPS vs firewalls

Next-Generation Firewalls (NGFW) blur the line — deep packet inspection, application awareness, IPS, and VPN termination in one platform (e.g., Cisco Firepower on ASA).

Stateful firewalls

Stateful firewalls maintain a connection table tracking two-way flow state. Return traffic for permitted outbound sessions is allowed automatically.

Example policy:

• Deny all inbound from outside to inside
• Permit outbound web from 10.10.10.0/24
• Return web traffic permitted by state table

Packet filters (ACLs) vs stateful firewalls

ACLs on routers are stateless packet filters:

• No connection table
• Affect one direction only
• Outbound ACL only → return traffic allowed (no ACL on inbound)
• ACLs both directions → need explicit permits for outbound and return

Internal vs external threats

Cryptography (CCNA awareness)

Symmetric vs asymmetric

HMAC (MD5, SHA) provides integrity using a shared symmetric key.

PKI and TLS

PKI uses a trusted Certificate Authority (CA) to solve key distribution. TLS (successor to SSL) secures HTTPS:

1. Server presents certificate signed by trusted CA
2. Browser verifies with CA public key
3. Symmetric session keys negotiated for bulk encryption
4. HMAC ensures integrity

VPN overview (awareness)

Site-to-site VPNs encrypt traffic over untrusted networks (Internet) using IPsec (ESP common; AH less common).

IPsec phases:

1. IKE Phase 1 — authenticate peers, build secure channel
2. IKE Phase 2 — negotiate IPsec SA (transform set)
3. Data transfer — encrypt interesting traffic

Interesting traffic is defined by an extended ACL — ties VPN config to ACL knowledge.

Remote access VPN connects individual users to the corporate network (client VPN).

CCNA-level mitigation summary

Exam checklist