Network, Endpoint, and Identity Threats

Introduction

Modern cyberattacks rarely depend on a single weakness. An attacker may first collect information about an organisation, impersonate a trusted system, exploit an insecure service, obtain a user’s credentials, and then move through the network. Understanding this sequence is essential because network, endpoint, and identity controls are interdependent. A strong firewall cannot compensate for weak authentication, and a well-managed identity system cannot fully protect an unpatched endpoint.

This chapter examines threats affecting three closely related security domains:

• Networks: the communications paths and services that connect systems.
• Endpoints: laptops, servers, mobile devices, applications, and other devices at the edge of a network.
• Identities: users, administrators, service accounts, devices, and the permissions assigned to them.

The emphasis is on recognising attack patterns, understanding their effects, and selecting appropriate preventive, detective, and corrective controls. The discussion is intended for legitimate defensive, educational, and authorised professional use.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain reconnaissance, spoofing, interception, and denial-of-service threats.
2. Identify how insecure protocols and endpoint weaknesses create attack opportunities.
3. Describe lateral movement and privilege escalation in a compromise sequence.
4. Distinguish password attacks from authentication and authorization failures.
5. Apply practical controls such as segmentation, patching, multifactor authentication, least privilege, and monitoring.
6. Analyse a combined network, endpoint, and identity incident.
7. Discuss ethical, governance, and privacy considerations in defensive security work.

1. A Systems View of Threats

A useful way to analyse a threat is to connect four elements:

1. Asset: what must be protected, such as a database, account, endpoint, or network service.
2. Threat actor: a person, group, insider, criminal organisation, or automated process capable of causing harm.
3. Vulnerability: a weakness that may be exploited, including technical flaws, misconfiguration, poor processes, or human error.
4. Impact: the consequence, such as loss of confidentiality, integrity, availability, privacy, safety, or regulatory compliance.

A vulnerability does not automatically produce an incident. Exploitation generally requires an exposure path and an attacker opportunity. Conversely, even a technically minor weakness may be serious when it affects a highly privileged account or a safety-critical system.

The confidentiality, integrity, and availability model remains useful:

• Confidentiality: preventing unauthorised disclosure.
• Integrity: preventing unauthorised alteration or destruction.
• Availability: ensuring authorised users can access systems when needed.

Identity failures often threaten confidentiality and integrity, while denial-of-service primarily threatens availability. Many incidents affect all three.

2. Reconnaissance and Exposure Discovery

Reconnaissance is the collection and analysis of information about a target. It may be passive, such as reviewing public websites, job advertisements, domain registration information, or published documents. It may also be active, such as authorised vulnerability scanning or service enumeration. The distinction is important: active probing can affect systems and may be unlawful without written permission.

Reconnaissance can reveal:

• Internet-facing IP addresses and domain names.
• Email naming conventions and organisational roles.
• Technology platforms and software versions.
• Remote-access services and cloud applications.
• Security policies, suppliers, and business relationships.
• Publicly exposed credentials or sensitive documents.

Reconnaissance is not itself proof of compromise. It becomes dangerous when information is used to select attack paths, craft convincing social-engineering messages, or identify vulnerable services.

Defensive approach

Organisations should maintain an accurate inventory of domains, certificates, cloud resources, public applications, and remote-access systems. They should remove unnecessary exposure, apply secure configuration baselines, monitor for unauthorised assets, and establish rules for authorised scanning. Public information should be reviewed periodically because outdated documents and staff profiles can disclose useful operational details.

3. Spoofing and Impersonation

Spoofing occurs when an attacker falsifies an identity or technical attribute to appear trustworthy. Common forms include:

• IP spoofing: falsifying a source network address, often to conceal origin or support reflection attacks. Because reliable two-way communication normally requires valid responses, IP spoofing is not a universal method for pretending to be a legitimate user.
• DNS spoofing or poisoning: causing a name to resolve to an unauthorised destination.
• ARP spoofing: misleading devices on a local network about the hardware address associated with an IP address.
• Email spoofing: manipulating message headers or domains so that a message appears to come from a trusted sender.
• Caller-ID or messaging spoofing: presenting a false telephone number or sender identity.
• Website or login-page impersonation: creating a fraudulent interface that collects credentials or authentication tokens.

Spoofing attacks exploit assumptions. Users assume that a familiar display name is genuine; devices assume that local address-resolution messages are trustworthy; applications assume that a certificate or token is valid. Defensive controls therefore combine technical validation with user awareness.

Important controls include authenticated DNS mechanisms, secure email authentication policies, encrypted communications, certificate validation, network segmentation, switch protections, endpoint detection, and independent verification of unusual requests. Email authentication technologies such as SPF, DKIM, and DMARC reduce some forms of domain impersonation, but they do not eliminate all phishing or compromised-account risks.

4. Interception and Man-in-the-Middle Attacks

Interception is the unauthorised observation or alteration of communications. A man-in-the-middle (MitM) attack occurs when an attacker positions themselves between two communicating parties. The attacker may read traffic, modify it, replay it, or selectively block it.

Typical opportunities include:

• Untrusted wireless networks.
• Compromised routers or gateways.
• Malicious or misconfigured proxies.
• Fraudulent certificates or weak certificate validation.
• Local-network address-resolution manipulation.
• Downgrade from a secure protocol to an insecure one.

Encryption helps only when it is correctly implemented and authenticated. Confidentiality without endpoint authentication can still allow an attacker to impersonate a server. Similarly, encryption does not prevent a user from submitting credentials to a fraudulent site.

Defensive practices include using current versions of TLS, validating certificates, disabling obsolete protocols, protecting wireless networks, using virtual private networks where appropriate, and monitoring for unusual certificate or routing changes. Applications should avoid silently accepting invalid certificates because this removes a critical trust check.

5. Insecure Protocols and Services

Many older protocols were designed for trusted networks and transmit information without adequate confidentiality or authentication. Examples include Telnet, FTP, HTTP for sensitive transactions, and older file-sharing or administrative protocols when improperly configured. Clear-text protocols can expose usernames, passwords, commands, and data to anyone able to observe the traffic.

Protocol risk should be assessed in context. A protocol may be technically secure but still unsafe because of weak configuration, obsolete cryptographic algorithms, exposed management interfaces, or poor access control. Conversely, a legacy protocol may be necessary temporarily for a specialised system, but it should be isolated and closely monitored.

A practical protocol review asks:

1. Is the communication encrypted in transit?
2. Are both endpoints authenticated where necessary?
3. Are modern cryptographic algorithms and certificate practices used?
4. Does the service expose more functionality than required?
5. Is the service reachable from untrusted networks?
6. Are logs sufficient to detect misuse?

Secure replacements, network segmentation, application-layer protection, and compensating controls should be documented when immediate replacement is impossible.

6. Denial-of-Service Threats

A denial-of-service (DoS) attack attempts to reduce or eliminate the availability of a service. A distributed denial-of-service (DDoS) attack uses many systems or network locations, often through a botnet or abused infrastructure.

DoS mechanisms include:

• Volumetric attacks: consuming bandwidth.
• Protocol attacks: exhausting state tables or network-device resources.
• Application-layer attacks: generating expensive requests that consume server or database capacity.
• Resource exhaustion: consuming CPU, memory, connection pools, or storage.

Availability risk is not determined solely by traffic volume. A modest number of computationally expensive requests can affect a poorly designed application, while a large volume may be absorbed by a resilient distributed service.

Defensive measures include capacity planning, rate limiting, connection controls, caching, resilient architecture, upstream filtering, content-delivery services, service-provider coordination, and an incident response plan. Organisations should define which functions are essential and prepare degraded-service procedures. DDoS protection should not be treated as a substitute for secure application design.

7. Endpoint Weaknesses

An endpoint is any device or system that communicates with a network. Common weaknesses include:

• Missing security updates.
• Unsupported operating systems.
• Excessive local administrator rights.
• Unnecessary software or services.
• Weak endpoint configuration.
• Insecure removable media practices.
• Disabled or ineffective malware protection.
• Poor backup and recovery arrangements.
• Inadequate logging.
• Uncontrolled personal or unmanaged devices.

Endpoint compromise may begin with a malicious attachment, drive-by download, stolen credential, vulnerable service, or supply-chain component. Once compromised, an endpoint can serve as a platform for credential theft, persistence, surveillance, or movement to other systems.

A baseline endpoint programme should include asset inventory, supported software versions, automated patch management, secure configuration, application control where suitable, endpoint detection and response, disk encryption, screen-lock policies, protected backups, and removal of unnecessary privileges. Controls must be usable: overly disruptive security measures may encourage users to bypass them.

8. Lateral Movement

Lateral movement is the process of moving from one compromised system or account to additional systems. It is often a central stage in a larger intrusion. An attacker may use stolen credentials, remote administration tools, shared accounts, trust relationships, vulnerable services, or legitimate management mechanisms.

The danger of lateral movement is amplified by excessive connectivity and implicit trust. If every workstation can communicate freely with every server, a single compromised device may provide broad access. Flat networks also make detection more difficult because unusual connections appear normal.

Defensive architecture should limit unnecessary communication through segmentation, internal firewalls, identity-aware access policies, privileged-access workstations, and separate administration networks. Monitoring should identify unusual authentication patterns, new remote connections, access to administrative shares, abnormal use of management tools, and movement between systems that do not normally communicate.

A key principle is to assume that prevention may fail. Segmentation and monitoring reduce the scope and duration of compromise even when an endpoint has already been breached.

9. Privilege Escalation

Privilege escalation occurs when a user, process, or attacker gains permissions beyond those originally granted. It may be:

• Vertical: a normal user obtains administrator or system-level privileges.
• Horizontal: one user accesses another user’s resources at the same privilege level.

Causes include unpatched software, insecure service permissions, exposed secrets, weak access-control rules, misconfigured cloud roles, excessive default privileges, and flaws in applications. Privilege escalation is especially serious because it can enable security-control disabling, data access, persistence, and further lateral movement.

Controls include least privilege, separation of duties, just-in-time administration, privileged access management, application isolation, secure service-account design, patching, code review, and auditing of privilege changes. Administrative privileges should be assigned to named individuals rather than shared accounts wherever possible.

10. Password Attacks and Credential Theft

Passwords remain common because they are inexpensive and familiar, but they are vulnerable to reuse, guessing, phishing, malware, and poor storage practices. Important attack categories include:

• Password spraying: trying a small number of common passwords across many accounts to avoid rapid lockout.
• Credential stuffing: using credentials obtained from one breach against other services.
• Brute-force guessing: repeatedly trying many candidates against a target.
• Offline cracking: analysing stolen password hashes without interacting with the live service.
• Phishing: persuading a user to reveal a password or approve an authentication request.
• Keylogging or infostealing: capturing credentials through malicious software.

Secure password storage requires salted, slow, memory-hard password hashing rather than reversible encryption or plain text. A salt is a unique random value stored with each password record; it prevents identical passwords from producing identical stored values and reduces the usefulness of precomputed tables. Password managers, breached-password screening, rate limiting, monitoring, and multifactor authentication provide additional protection.

Multifactor authentication combines different factor categories:

• Something the user knows, such as a password.
• Something the user has, such as a hardware security key.
• Something the user is, such as a biometric characteristic.

Two passwords are not two independent factors. Strong phishing-resistant methods, particularly hardware-backed public-key authentication, are preferable for high-risk accounts.

11. Authentication and Authorization Failures

Authentication answers, “Who or what are you?” Authorization answers, “What are you allowed to do?” Confusing these functions causes serious design errors. A valid login does not justify unrestricted access.

Authentication failures include weak identity proofing, poor session management, missing multifactor authentication, insecure password recovery, token theft, and failure to revoke accounts promptly. Authorization failures include insecure direct object references, missing server-side access checks, excessive roles, privilege inheritance errors, and inconsistent enforcement across application interfaces.

Access decisions should be enforced on the server, not merely hidden in a user interface. Every request should be evaluated against the authenticated identity, resource, action, and relevant policy. Important principles include:

• Least privilege: grant only the access needed for assigned duties.
• Default deny: reject access unless explicitly permitted.
• Separation of duties: divide sensitive tasks among more than one role.
• Need to know: restrict information access to a legitimate requirement.
• Lifecycle management: create, review, modify, and revoke access promptly.

Identity governance should include joiner, mover, and leaver processes; periodic access reviews; service-account ownership; emergency-access controls; and logs that record both successful and failed decisions.

12. A Defensive Threat Chain Model

The following model helps analysts connect related events:

1. Discovery: information about systems, people, and services is collected.
2. Initial access: a vulnerable service, stolen credential, malicious file, or deceptive message is used.
3. Execution and persistence: malicious activity runs and attempts to survive restart or account changes.
4. Privilege escalation: greater permissions are obtained.
5. Credential access: additional secrets or tokens are collected.
6. Lateral movement: other systems or accounts are reached.
7. Impact: data is stolen, changed, encrypted, or made unavailable.

This sequence is not universal. Attackers may skip steps, repeat them, or operate through a compromised supplier. Nevertheless, it supports defence-in-depth: controls should prevent, detect, contain, and recover from each stage.

13. Illustrative Case Study: The Compromised Finance Workstation

Background

A medium-sized organisation allowed employees to access a cloud finance application and an internal file server. Remote administration was available through a gateway, and several older workstations had local administrator rights.

Problem

An employee received a convincing message appearing to come from a supplier. The message directed the employee to a fraudulent sign-in page. The stolen password was reused on another service, and multifactor authentication was not enabled for the employee’s account.

The attacker signed in, accessed the finance application, and used the employee’s workstation session to reach internal resources. Because the network was largely flat and administrative shares were broadly accessible, the attacker attempted to move to a file server. Monitoring detected an unusual login time and a new workstation-to-server connection, but the alert was not investigated immediately.

Analysis

The incident involved several linked weaknesses:

• Reconnaissance enabled a credible supplier impersonation.
• Email and website spoofing supported credential theft.
• Password reuse increased the value of one stolen password.
• Missing multifactor authentication allowed password-only access.
• Local administrator rights increased endpoint risk.
• Flat network design facilitated lateral movement.
• Broad authorization allowed access beyond the employee’s business need.
• Delayed alert handling extended the attacker’s opportunity.

No single control failure explains the entire incident. The compromise resulted from interacting weaknesses in identity, endpoint, network, and monitoring controls.

Approach and solution

The organisation reset affected credentials, revoked sessions, isolated the workstation, preserved logs, and reviewed access to financial data. It then implemented phishing-resistant multifactor authentication for privileged and high-value accounts, prohibited known-compromised passwords, removed unnecessary local administrator rights, segmented finance systems, restricted server administration paths, and introduced regular access reviews. Detection rules were improved for unusual geographic locations, impossible travel patterns, abnormal workstation-to-server access, and privilege changes.

Outcome and learning points

The organisation reduced the likelihood that a stolen password would be sufficient for access and limited the potential movement from an endpoint to sensitive servers. The case demonstrates that security is a system property. Identity controls, endpoint hardening, network segmentation, and response procedures must reinforce one another.

14. Governance, Ethics, and Legal Considerations

Security testing and reconnaissance must be authorised, proportionate, and documented. Written scope should identify permitted systems, timing, methods, data handling, emergency contacts, and stop conditions. Testing live systems without permission may violate criminal, privacy, communications, or computer misuse laws.

Monitoring also requires governance. Logs may contain personal data, credentials, health information, or employee activity. Organisations should define retention periods, restrict access, protect logs from alteration, and use monitoring for legitimate security purposes. Incident response should preserve evidence while respecting privacy, employment obligations, and applicable breach-notification requirements.

Security professionals should avoid collecting more data than necessary, disclose vulnerabilities responsibly, protect discovered secrets, and distinguish suspicious behaviour from proof of malicious intent. Automated tools and artificial intelligence can assist with alert triage, anomaly detection, and asset discovery, but they can produce false positives, embed bias, expose sensitive data, or make incorrect correlations. Human review remains essential for high-impact decisions.

15. Practical Security Baseline

A certificate-level practitioner can contribute significantly by applying a disciplined baseline:

1. Maintain an accurate inventory of assets, identities, software, and external exposure.
2. Remove unsupported systems and apply security updates according to risk.
3. Use secure protocols and disable obsolete clear-text services.
4. Require multifactor authentication, especially for administrators and remote access.
5. Store passwords using approved salted, adaptive hashing methods.
6. Apply least privilege and review access after role changes.
7. Remove unnecessary local administrator rights.
8. Segment sensitive systems and restrict east-west traffic.
9. Monitor authentication, privilege changes, endpoint behaviour, and unusual connections.
10. Prepare tested backup, containment, recovery, and communication procedures.
11. Conduct authorised vulnerability assessments and remediate findings.
12. Train users to verify unusual requests without blaming them for reporting mistakes.

These measures should be prioritised according to business impact, exploitability, exposure, and available resources. Security is a continuous process of assessment, improvement, and verification rather than a one-time installation of tools.

Challenges and Limitations

No control is perfect. Multifactor authentication can be weakened by session theft or social engineering; segmentation can fail through misconfiguration; endpoint tools can be disabled; and access reviews can become meaningless if managers approve them without examination. Legacy operational technology may not support modern agents or protocols. Small organisations may lack specialist staff, while large organisations may struggle with complexity and inconsistent policy enforcement.

Effective programmes therefore combine technology with architecture, governance, training, measurable procedures, and incident practice. Controls should be tested through audits, exercises, configuration reviews, and carefully authorised simulations. Residual risk should be documented and accepted by an accountable authority rather than hidden.

Chapter Summary

Network, endpoint, and identity threats are closely connected. Reconnaissance identifies possible attack paths; spoofing and interception undermine trust; insecure protocols expose communications; and denial-of-service attacks threaten availability. Endpoint weaknesses provide a foothold, while privilege escalation and stolen credentials increase an attacker’s power. Lateral movement becomes easier when networks are flat, administrative access is broad, and monitoring is weak. Authentication confirms identity, whereas authorization determines permitted actions; both must be designed and enforced correctly.

Defence depends on layered measures: accurate asset inventory, secure protocols, patching, endpoint protection, segmentation, least privilege, strong password practices, multifactor authentication, access governance, logging, and tested response plans. Ethical and legal boundaries are essential when conducting reconnaissance, testing, monitoring, or incident response. The central professional lesson is that resilience comes from reducing opportunities, limiting impact, detecting abnormal behaviour, and recovering effectively when prevention fails.

Key Terms

Reconnaissance: Collection and analysis of information about a target.

Spoofing: Falsifying an identity, address, message source, or technical attribute.

Interception: Unauthorised observation, modification, replay, or blocking of communications.

Man-in-the-middle attack: An attack in which an adversary positions themselves between communicating parties.

Insecure protocol: A protocol that lacks adequate confidentiality, authentication, integrity, or secure configuration.

Denial of service: An attempt to reduce or prevent legitimate access to a service.

Endpoint: A device or system that communicates with a network.

Lateral movement: Movement from one compromised system or account to additional systems or accounts.

Privilege escalation: Obtaining permissions greater than those originally granted.

Authentication: Verification of an identity claim.

Authorization: Determination of what an authenticated identity may access or do.

Password spraying: Trying a small set of common passwords against many accounts.

Credential stuffing: Reusing credentials obtained from one source against other services.

Multifactor authentication: Authentication using two or more independent factor categories.

Least privilege: Granting only the access required for a legitimate task.

Network segmentation: Dividing a network to restrict communication and limit compromise.

Session management: Processes and controls governing authenticated sessions and tokens.

Salt: A unique random value combined with a password before password hashing.

Privilege management: Administration and control of elevated permissions.

Defense in depth: Using multiple complementary controls so that one failure does not cause total compromise.

Review Questions

Short Answer Questions

1. What is the difference between authentication and authorization?
2. Define lateral movement and explain why network segmentation limits it.
3. Name two examples of insecure or obsolete communication practices.
4. What is the purpose of a salt in password storage?
5. State two forms of multifactor authentication.

Long Answer Questions

1. Explain how reconnaissance, spoofing, credential theft, and endpoint compromise can form one connected attack sequence.
2. Compare vertical and horizontal privilege escalation and describe controls for each.
3. Discuss why encryption alone does not eliminate man-in-the-middle attacks.
4. Explain how a flat network increases the consequences of endpoint compromise.
5. Develop a practical security baseline for a small organisation with limited technical staff.

Analytical / Application Questions

1. A user’s account logs in from an unusual location, accesses a new server, and then triggers several failed administrator logins. Analyse the possible threat chain and identify immediate defensive actions.
2. An organisation cannot replace a legacy clear-text protocol for twelve months. Propose compensating controls and explain their limitations.
3. A manager approves every access review without examining the permissions. Evaluate the governance failure and recommend a sustainable access-review process.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes authentication from authorization?

A. Authentication determines what a user may do, while authorization verifies identity.

B. Authentication verifies identity, while authorization determines permitted actions.

C. Authentication encrypts data, while authorization compresses data.

D. Authentication detects malware, while authorization removes malware.

Correct Answer: B. Authentication verifies identity, while authorization determines permitted actions.

Question 2

Which control most directly limits lateral movement across internal systems?

A. Network segmentation

B. Increasing screen brightness

C. Deleting security logs

D. Disabling software updates

Correct Answer: A. Network segmentation

Question 3

What is the main purpose of a unique salt in password storage?

A. To make a password readable by administrators

B. To replace multifactor authentication

C. To reduce the usefulness of precomputed password tables

D. To permit passwords to be stored in plain text

Correct Answer: C. To reduce the usefulness of precomputed password tables

Question 4

Which example is a password attack involving a small number of common passwords across many accounts?

A. Credential stuffing

B. Password spraying

C. Disk encryption

D. Certificate validation

Correct Answer: B. Password spraying

Question 5

Which statement about encryption is most accurate?

A. Encryption always proves that the communicating endpoint is genuine.

B. Encryption removes the need for access control.

C. Encryption can protect confidentiality but requires authentication and correct validation to resist impersonation.

D. Encryption prevents all denial-of-service attacks.

Correct Answer: C. Encryption can protect confidentiality but requires authentication and correct validation to resist impersonation.

Question 6

Which situation is an example of vertical privilege escalation?

A. A user accesses another user’s document at the same privilege level.

B. A standard user obtains administrator permissions.

C. A server is moved to a different network segment.

D. A password is changed after an employee leaves.

Correct Answer: B. A standard user obtains administrator permissions.

Question 7

Which threat primarily targets service availability?

A. Denial-of-service attack

B. Password hashing

C. Access review

D. Disk encryption

Correct Answer: A. Denial-of-service attack

Question 8

Which practice is most appropriate for high-value administrative accounts?

A. Password reuse across systems

B. Shared administrator accounts

C. Phishing-resistant multifactor authentication

D. Permanent unrestricted privileges

Correct Answer: C. Phishing-resistant multifactor authentication

Question 9

What is a key weakness of a flat internal network?

A. It prevents all communication between systems.

B. It can allow a compromise on one endpoint to reach many other systems.

C. It automatically encrypts every internal connection.

D. It eliminates the need for monitoring.

Correct Answer: B. It can allow a compromise on one endpoint to reach many other systems.

Question 10

Which activity normally requires explicit authorization before it is performed against live systems?

A. Reviewing an organisation’s public security policy

B. Reading a published security standard

C. Conducting active vulnerability scanning

D. Learning the meaning of least privilege

Correct Answer: C. Conducting active vulnerability scanning