Computing · JC 2 · Computer Networks and Communication · Semester 2

Common Network Attacks and Defenses

Students will learn about common cyber threats like phishing, DDoS, and malware, and strategies to mitigate them.

About This Topic

Common network attacks and defenses introduce students to prevalent cyber threats such as phishing, Distributed Denial of Service (DDoS) attacks, and malware. In this topic, students analyze how phishing exploits human error through deceptive emails or websites to steal credentials, how DDoS floods servers with traffic to disrupt availability, and how malware like viruses or ransomware infiltrates systems to cause damage or demand payment. They also explore defenses including user awareness training, firewalls that filter traffic, intrusion detection systems (IDS) that monitor anomalies, and encryption protocols.

This content aligns with the Computer Networks and Communication unit by emphasizing practical security in networked environments. Students evaluate real-world scenarios, such as a DDoS attack halting online services or phishing campaigns targeting banks, which fosters critical analysis of vulnerabilities in Singapore's digital infrastructure. Designing best practices, like multi-factor authentication and regular updates, builds skills in risk assessment and mitigation.

Active learning suits this topic well because threats are invisible until they strike. Simulations and role-plays make attacks tangible, while collaborative defense strategies encourage debate on effectiveness, helping students internalize protections through experience rather than rote memorization.

Key Questions

1. Analyze how a Distributed Denial of Service (DDoS) attack impacts network availability.
2. Design a set of best practices to protect against phishing attacks.
3. Evaluate the effectiveness of firewalls and intrusion detection systems.

Learning Objectives

• Analyze the mechanisms by which phishing attacks exploit human psychology to compromise user credentials.
• Evaluate the impact of DDoS attacks on network service availability and user access.
• Design a layered defense strategy incorporating technical controls and user education to mitigate malware infections.
• Compare the effectiveness of firewalls and intrusion detection systems in preventing and identifying network threats.
• Synthesize information from case studies to propose solutions for securing sensitive data against common cyberattacks.

Before You Start

Introduction to Computer Networks

Why: Students need a foundational understanding of network components, protocols (like TCP/IP), and how data travels to comprehend network attack vectors.

Operating System Fundamentals

Why: Knowledge of operating system functions, file systems, and user permissions is necessary to understand how malware can infiltrate and affect a system.

Key Vocabulary

Phishing	A fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details by disguising oneself as a trustworthy entity in an electronic communication.
DDoS Attack	A cyberattack where the perpetrator seeks to make a machine or network resource unavailable to its intended users by overwhelming the target with a flood of internet traffic.
Malware	A broad category of software designed to disrupt, damage, or gain unauthorized access to computer systems, including viruses, worms, ransomware, and spyware.
Firewall	A network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between a trusted internal network and untrusted external network.
Intrusion Detection System (IDS)	A device or software application that monitors a network or systems for malicious activity or policy violations and produces reports to a management station.

Watch Out for These Misconceptions

Common Misconception

Firewalls block every type of attack.

What to Teach Instead

Firewalls primarily filter based on ports and IP addresses but miss application-layer threats like sophisticated malware. Active simulations where students test firewall rules against varied attacks reveal gaps, prompting discussions on layered defenses like IDS integration.

Common Misconception

Antivirus software alone prevents all malware.

What to Teach Instead

Antivirus detects known signatures but struggles with zero-day exploits. Hands-on labs scanning infected files show detection rates, leading students to advocate for behavioral monitoring and updates through group strategy sessions.

Common Misconception

Phishing only happens via email.

What to Teach Instead

Phishing occurs through SMS, calls, or fake apps too. Role-playing diverse phishing vectors helps students spot patterns across channels, building comprehensive vigilance via peer feedback.

Active Learning Ideas

Role-Play: Phishing Awareness Drill

Divide class into attackers and defenders. Attackers craft fake phishing emails or sites using templates. Defenders identify red flags like urgent language or suspicious links, then share detection strategies in debrief. Rotate roles for full participation.

45 min·Small Groups

Simulation Game: DDoS Impact Demo

Use online tools or simple Python scripts to simulate traffic floods on a local server. Students monitor response times before, during, and after the attack. Groups discuss mitigation like rate limiting and record quantitative impacts.

50 min·Pairs

Case Study Analysis: Malware Defense Design

Provide real malware incident reports. In groups, students outline step-by-step defenses including antivirus scans, backups, and patch management. Present and peer-review plans for completeness.

35 min·Small Groups

Evaluation: Firewall vs IDS Challenge

Set up scenarios with network diagrams. Students compare firewall rules and IDS alerts in pairs, predicting outcomes for given attacks. Class votes on best configurations after explanations.

40 min·Pairs

Real-World Connections

• Cybersecurity analysts at DBS Bank in Singapore analyze network logs to detect and respond to potential phishing attempts targeting customers, protecting millions of accounts.
• Network engineers managing the infrastructure for Singapore's Changi Airport must implement robust DDoS mitigation strategies to ensure continuous operation of flight information systems and passenger services.
• IT professionals in companies like NCS Pte Ltd deploy and manage firewalls and IDS to safeguard corporate networks against ransomware and other malware threats that could disrupt business operations.

Assessment Ideas

Discussion Prompt

Present students with a simulated phishing email. Ask: 'What specific elements in this email suggest it might be malicious? What steps should a user take if they receive such an email?' Facilitate a class discussion on common phishing indicators and safe user practices.

Quick Check

Provide students with a scenario describing a sudden, widespread disruption of an online service. Ask: 'Based on the symptoms, what type of network attack is most likely occurring? Describe two immediate technical actions a network administrator could take to try and mitigate the impact.'

Exit Ticket

On an index card, have students define one key vocabulary term (e.g., Malware, Firewall) in their own words and then list one specific defense strategy related to that term. Collect and review for understanding.

Frequently Asked Questions

How does a DDoS attack impact network availability?

A DDoS attack overwhelms servers with fake traffic from botnets, exhausting bandwidth and resources so legitimate users cannot access services. This causes downtime for websites or apps, as seen in attacks on Singapore banks. Students analyze packet floods in simulations to quantify slowdowns and evaluate defenses like traffic scrubbing services for quick recovery.

What are best practices to protect against phishing?

Key practices include verifying sender identities, avoiding clicks on unsolicited links, enabling multi-factor authentication, and using email filters. Train users to check URLs and report suspicions. In class, role-plays reinforce these by letting students practice spotting fakes, improving recognition rates through repeated exposure and group critiques.

How can active learning help teach network attacks?

Active methods like phishing role-plays and DDoS simulations make abstract threats concrete and engaging. Students experience impacts firsthand, such as delayed server responses, which deepens understanding over lectures. Collaborative defenses encourage critical evaluation of tools like firewalls, fostering retention and real-world application in group discussions.

How effective are firewalls and IDS in defense?

Firewalls excel at perimeter control by blocking unauthorized traffic but need rules tuned for specific threats. IDS complements by detecting anomalies inside networks, alerting on malware behaviors. Case studies let students evaluate both in scenarios, revealing that combined use reduces breach risks by monitoring and filtering effectively.