Security Week Finale: Vulnerabilities, Threats, & Zero-Day

In networking, a Vulnerability is a weakness (like a window left unlocked), and a Threat is the actor who wants to exploit it (the burglar). As a Support Associate, your job is to “patch” the vulnerabilities before a threat actor finds them.

1. Common Network Attacks

On the Network+ exam, we will need to be able to distinguish between different ways a network can be hit.

• DoS/ DDoS (Distributed Denial of Service): Flooding a server with so much junk traffic that it crashes. In a business, this might look like a website being “down” during the day because of a botnet attack
• Man-in-the-Middle (MITM)/On-Path Attack: An attacker sits between two devices (like a teacher and the grading portal) and intercepts the traffic.
• Ransomware: The nightmare scenario. Malware encrypts all of the businesses files and demands payment for the key.
• Zero-Day Attack: An attack that exploits a vulnerability that the software vendor doesn’t know about yet. There are “zero days” of protection available.

2. Who are the “Bad Actors”?

Not every threat is a hacker in a hoodie.

Script Kiddies: Inexperienced people (like us) using pre-made tools to cause trouble (common in schools!).

Insider Threats: A disgruntled employee or a curious student who already has access to the building.

State Actors: Highly sophisticated, government-sponsored groups looking for sensitive data.

3. Vulnerability Management: Patch or Perish

How do we stay ahead? We use Vulnerability Scanners (Like Nessus or OpenVAS). These tools scan your network and tell you: “Hey, that switch in the basement is running old firmware with a known security hole.”

The “Support Associate” Grind: This is why we do firmware updates and Windows Updates. Every “Update” you install is usually a patch for a vulnerability that hackers had already figured out how to use.

4. The “Support Associate” Reality: The Human Firewall

At your business the biggest “Vulnerability” isn’t a server its typically an email.

• Business Email Compromise (BEC): An attacker pretends to be the CEO or someone with huge authority and asks an employee to “quickly buy gift cards” or “change a direct deposit bank account.”
• Your Job: Educate. If a staff member asks you if an email looks “fishy”

🧪 The “Exam Tip” for Network+

We should know the difference between Vulnerability Scanning and Penetration Testing:

• Vulnerability Scanning: A passive search for weaknesses. It says “There is a hole here.”
• Penetration Testing: An active attempt to break in It says “I used that hole to get into your database.”

What’s Next?

We have officially conquered Security Week! We’ve covered the logic, the physical, the hardening, and the threats

Next week, we move into our Final Sprint: Cloud & Virtualization. We’ll talk about how the “Server Room” is moving into the cloud (AWS/Azure), what a “Hypervisor” is, and why we are more likely to use Virtual Machines for everything.