Network Security
56 articles
Network security protects data in transit and the systems that move it. These guides cover firewalls, VPNs, zero-trust architecture, segmentation, and intrusion detection: the layered controls that limit an attacker's blast radius once they're inside.
Cloud Misconfigurations: The Settings That Leak Data
The cloud settings that actually cause breaches: public object storage, over-broad IAM, exposed metadata services, open security groups and public snapshots, with the console and CLI checks for each.
How to Secure IoT Devices: Segmentation, Updates and Defaults
A practical method for securing smart home and small office IoT: change what ships insecure, segment the network, close inbound paths, keep firmware current, and retire devices the vendor abandoned.
Principle of Least Privilege: Scope, Time, and Blast Radius
How least privilege actually works: scoping a permission by subject, action, resource and condition, deriving policy from observed usage, time-bounding access, dropping process privileges, and the failure modes.
Network Segmentation Guide: Zones, Microsegmentation & Rollout
How to design network segmentation: choosing a model, deciding where boundaries go, writing the policy matrix, and rolling default-deny into production without outages.
Privileged Access Management: Vaults, JIT and Tiering
How PAM works: discovering privileged accounts, vaulting and rotating credentials, brokered sessions, just-in-time elevation, the tiered admin model, and machine secrets that never see a human.
Public WiFi Safety: What Actually Puts You at Risk
What public WiFi really exposes now that most traffic is encrypted: rogue access points, captive portal tricks, DNS manipulation, device discovery, and where a VPN genuinely helps.
Zero Trust Architecture: NIST 800-207 in Practice
What zero trust actually specifies: the seven tenets of NIST SP 800-207, the policy engine and enforcement point, how ZTNA differs from a VPN, and the parts of the model that are hard to deploy.
Active Directory Security: Structure, Tiering & Hardening
How Active Directory is built, the tiered administration model, the weaknesses attackers exploit, and a hardening checklist for defenders.
ARP Spoofing: LAN Poisoning & DAI Defense
How ARP cache poisoning lets an attacker intercept traffic on a local network, why the protocol is trivial to abuse, and how to shut it down.
BGP Hijacking: Route Hijacks, Leaks & RPKI Defense
How BGP route hijacking and route leaks reroute internet traffic, why the protocol trusts by default, and how RPKI and route filtering defend against it.
Bluetooth Security: Pairing, Attacks, and Defense
How Bluetooth pairing works, the association models that decide whether it resists eavesdropping, the main attack classes, and practical defenses.
Certificate Transparency: CT Logs and Mis-Issuance
How Certificate Transparency works: append-only CT logs, SCTs, catching mis-issued certificates, and monitoring your own domains.
Common Ports Attackers Target, and How to Harden Them
A defensive reference to commonly targeted TCP/UDP ports: service, protocol, why attackers care, and one hardening note per port from FTP to MongoDB.
DCSync Attack: Abusing Replication to Steal Hashes
How DCSync abuses Active Directory replication to pull password hashes from a domain controller, why it needs no code on the DC, and how to monitor and defend.
DHCP Spoofing: Rogue Servers & DHCP Snooping
How rogue DHCP servers hijack a network's default gateway and DNS, why the protocol has no authentication, and how DHCP snooping stops the attack.
DNS over HTTPS vs DNS over TLS: Encrypted DNS Compared
DoH and DoT both encrypt DNS queries. This guide compares how they work, their privacy tradeoffs, and why enterprises treat them differently.
DNS Spoofing: Cache Poisoning & the DNSSEC Defense
How DNS spoofing and cache poisoning redirect victims to attacker servers, why plain DNS is forgeable, and how DNSSEC and encrypted DNS help.
DNS Tunneling: Exfiltration & C2 Hidden in DNS
How attackers smuggle data and command-and-control traffic inside DNS queries, why the channel is so hard to block, and how to detect it.
DNSSEC: Signing DNS to Stop Spoofing
How DNSSEC signs DNS records to prevent forged answers, how the chain of trust works from the root down, and where DNSSEC stops and starts.
Evil Twin Attacks: Rogue Clone Wi-Fi & How to Stay Safe
How evil twin access points clone a real network to capture traffic and credentials, why they fool devices, and how to defend on public Wi-Fi.
Golden Ticket Attack: Forged Kerberos TGTs
How a stolen krbtgt hash lets attackers forge Golden Tickets, why it grants domain-wide persistence, and how krbtgt rotation and monitoring shut it down.
How HTTPS Works: TLS, Certificates & the Padlock
A plain guide to HTTPS: how HTTP runs over TLS, what certificates prove, what the padlock does and does not mean, and what HTTPS protects.
How Kerberos Works: Tickets, the KDC & Why AD Needs It
A plain walkthrough of Kerberos: the KDC, TGT and TGS tickets, the full ticket-exchange flow, and why it anchors Active Directory security.
How SSH Works: Key Exchange, Host Keys, and Public-Key Auth
A plain guide to SSH: how the encrypted channel is set up, what host keys prove, and why public-key authentication beats passwords.
How Tor Works: Onion Routing and the Three-Hop Circuit
How Tor anonymises traffic: onion routing, guard, middle and exit relays, the three-hop circuit, what Tor protects, and where it fails.
HSTS: Strict Transport Security & Preload
How HSTS stops SSL stripping: the Strict-Transport-Security header, max-age, includeSubDomains, the preload list, and safe deployment.
Kerberoasting: Cracking Service Accounts Offline
How kerberoasting requests service tickets to crack SPN account passwords offline, why managed and long passwords defeat it, and how blue teams detect it.
Lateral Movement: How Attackers Spread Across a Network
How attackers move host to host after initial access, the techniques they reuse, and how segmentation, credential hygiene, and detection contain the spread.
Living Off the Land: LOLBins, Detection, and Defense
Living off the land turns a system's own trusted tools into the attack. How LOLBins like rundll32, mshta and certutil get abused, and how to detect the misuse.
Man-in-the-Middle: On-Path Interception & TLS Defense
How man-in-the-middle attacks intercept and relay traffic from an on-path position, the techniques attackers use to get there, and how TLS stops them.
NFC Security: Contactless Risks & the Real Threat Model
How NFC works, the difference between relay, skimming, and cloning attacks, why tokenized payments blunt most fears, and the defenses that matter.
NTLM Relay: How Captured Authentication Becomes Access
How NTLM relay attacks forward captured Windows authentication to other services, why SMB signing and channel binding stop them, and how to detect the abuse.
OAuth 2.0: Roles, Grant Types, and Tokens
A plain guide to OAuth 2.0: the four roles, the grant types and when to use them, access and refresh tokens, and how to deploy it safely.
Packet Sniffing: Passive Capture on Switched Networks
How packet sniffing captures network traffic, why switched networks limit passive capture, and how encryption turns intercepted packets into noise.
Pass the Hash: Authenticating Without the Password
How pass-the-hash reuses stolen NTLM hashes to authenticate without cracking them, why Credential Guard and tiering stop it, and how blue teams detect it.
Pass the Ticket: Reusing Kerberos Tickets for Access
How pass-the-ticket reuses stolen Kerberos TGTs and service tickets to authenticate, why the technique evades password defenses, and how blue teams detect it.
Port Scanning: SYN, Connect & UDP Scans
How port scanning works, the difference between SYN, connect, and UDP scans, what the scan looks like from the defender's side, and how to detect it.
RDP Security: Why Exposed Remote Desktop Gets You Ransomed
Why internet-facing RDP is a top ransomware entry point, and how NLA, gateways, MFA, and lockout policies close the door. A hardening guide.
Rogue Access Point: Unauthorized APs, Wireless IDS & 802.1X
What a rogue access point is, how unauthorized APs breach a network, and how wireless intrusion detection and 802.1X port control shut them down.
Silver Ticket Attack: Forged Kerberos Service Tickets
How attackers forge Kerberos service tickets from a service account hash, why Silver Tickets bypass the domain controller, and how to detect and defend.
SMB Security: Signing, SMBv1 & Stopping Lateral Movement
How the SMB file-sharing protocol gets abused, why SMBv1 must die, what SMB signing prevents, and how segmentation limits the damage.
SSH Hardening Guide: Key-Only Auth, Bastions, and Lockdown
Practical SSH hardening: enforce key-only login, disable root, allowlist users, front access with a bastion, and rate-limit brute force.
SSL Stripping: Downgrading HTTPS to HTTP & the HSTS Defense
How SSL stripping downgrades a victim's HTTPS connection to plain HTTP from an on-path position, and why HSTS and preload close the gap.
VLAN Hopping: Switch Spoofing & Double Tagging
How VLAN hopping breaks network segmentation using switch spoofing and double tagging, and how disabling trunk negotiation and port security stop it.
mTLS: Mutual TLS & Client Certificate Auth
How mutual TLS works: client certificates, why mTLS underpins zero-trust service authentication, and how to run it without breaking things.
PKI: Certificate Authorities and the Chain of Trust
How public key infrastructure works: certificate authorities, chains of trust, revocation, and how strangers verify identity online.
Wi-Fi Deauth Attacks: Deauth Frames & 802.11w Defense
How 802.11 deauthentication frames force devices off Wi-Fi, why the attack is so easy, what it enables, and how protected management frames stop it.
WPA3: What It Fixes and When to Use It
How WPA3 improves on WPA2 with SAE, forward secrecy, and protection from offline password guessing, plus transition mode and when to switch.
Best VPNs: Tested and Ranked for Privacy
Six VPNs ranked by what matters: independent no-log audits, jurisdiction, RAM-only servers, and real seizure tests.
Cloud Security Fundamentals: Protecting Your Infrastructure
The cloud doesn't secure your data for you. The shared responsibility model, the most common cloud misconfigurations, and how to lock down AWS, GCP and Azure.
DDoS Attacks: How They Work and How to Defend
DDoS attacks can take down any website in minutes. Learn the different attack types, how botnets operate, and the layered defenses that actually work.
Encryption: How Your Data Stays Private
Encryption protects everything from your messages to your bank account. Learn how symmetric and asymmetric encryption work, and why it matters.
How to Secure Your WiFi Network
Your WiFi is the front door to your home network. Learn how attackers exploit weak configurations and exactly how to lock yours down.
Network Security Fundamentals: Firewalls, VPNs & IDS
Cut through the noise on firewalls, VPNs, and zero trust, what they actually protect, where they fail, and how to layer them effectively.
Firewall and How Does It Protect You
Firewalls are your network's first line of defense. Learn how packet filtering, stateful inspection, and next-gen firewalls actually work.
VPN and How It Actually Works
VPNs are everywhere, but most explanations are wrong. Learn what a VPN really does, how the encryption works, and when you actually need one.