Types of Security Attacks

Computer Network & Network Security System — Network Security, NEC licence examination syllabus (Nepal Engineering Council).

Types of Security Attacks: knowing your enemy's playbook

Every attack falls into one of two families — knowing which tells you how dangerous it really is.

🕵️ Passive vs Active Attacks

PassiveThe attacker only OBSERVES — eavesdropping, traffic analysis. Doesn't modify anything, which makes it very hard to even detect it's happening.

ActiveThe attacker actively CHANGES something — masquerade (pretending to be someone else), replay (resending captured legitimate data later), modification, Denial of Service (DoS).

Passive attacks threaten confidentiality; active attacks threaten integrity and availability — mapping straight back to the CIA triad from the last topic.

Malware (viruses, worms, trojans, ransomware) is the broad category of malicious software designed to damage, steal from, or take control of a system.

💡 One-liner: "Why are passive attacks harder to detect than active ones?" → Passive attacks don't alter data or system behaviour, so there's no visible sign anything happened — unlike active attacks, which leave detectable changes.

The consequence of the passive/active split

The classification is not just taxonomy. It determines what defence is even possible, and that is the examinable point.

🛡️ Detect or prevent

PassiveNothing is altered and no trace is left, so these attacks cannot be detected — only prevented, by making the observed data useless. That means encryption.

ActiveSomething changes, so these can be detected — and prevention is often impractical, since you cannot stop someone sending packets. That means checksums, sequence numbers, monitoring and recovery.

So the two families demand opposite strategies. Against eavesdropping, monitoring is useless and encryption is everything; against modification and denial of service, encryption alone does not help and detection with recovery is the realistic goal.

💡 The standard question is "why are passive attacks harder to deal with than active ones?" — not because they do more damage, but because you never learn they happened. An organisation can be monitored for years with no indication at all, which is why the defence must be preventive by design.

Replay, which is neither quite

Replay deserves attention because it defeats the obvious defences. The attacker captures a legitimate, correctly encrypted, correctly signed message and simply sends it again later.

Encryption does not help — the message was validly encrypted. Signatures do not help — it was validly signed. Nothing about the message is forged; the only thing wrong is when it arrives. A captured "transfer $100" instruction replayed fifty times is fifty valid transfers.

The defence must therefore make each message unique in time: a sequence number, a timestamp, or a nonce — a value used once, so a repeat is recognisable. This is why protocols include such fields even when everything is already encrypted, a design detail that otherwise looks redundant.

Syllabus points

Passive: eavesdropping, traffic analysis
Active: masquerade, replay, modification, DoS
Malware overview

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.