The network threats that cause real damage are rarely exotic: stolen or guessed credentials, services exposed to the internet, phishing that leads to a foothold, denial of service, and attackers moving sideways once inside. A short list of controls, applied consistently, limits most of them.
Which threats come up most?
MITRE ATT&CK catalogs adversary behavior in tactics such as initial access, lateral movement and exfiltration, and it is a useful vocabulary for sorting threats. Grouped by how they reach a network, five families cover most cases.
Credential abuse. Valid accounts are the quietest way in. Passwords reused from other breaches, tokens left in repositories, and shared admin accounts all let an attacker log in instead of break in. Logging in looks normal in traffic logs.
Exposed services. A remote desktop port, an unpatched VPN gateway or a forgotten test server is reachable by anyone. CISA's Known Exploited Vulnerabilities catalog is full of edge devices and internet facing software for this reason.
Phishing and social engineering. A message gets one person to run a file or enter a password. From there the attacker is inside the perimeter on a trusted machine.
Denial of service. Floods of traffic or expensive requests exhaust bandwidth or compute. The goal is outage, sometimes as cover or as extortion.
Lateral movement. After the first foothold, attackers look for flat networks where one compromised laptop can reach file servers, databases and domain controllers.
Why does a flat network make everything worse?
Take a constructed example. A 60 person firm runs one internal network. A bookkeeper opens a booby trapped invoice. The attacker finds the machine can talk to the file server, the backup server and the printer subnet, and that a shared admin password works on all three. A single click becomes a company wide incident.
Now change one thing: the bookkeeping workstations sit in their own segment and only reach the finance application on two ports. The same click ends at a single desktop. Segmentation did not stop the phish, but it capped the damage.
What do the controls look like?
NIST SP 800-41 Rev. 1 explains how firewalls and firewall policy limit traffic between zones, and it stresses a default deny posture: allow what is needed, block the rest. That one habit shrinks the exposed services problem.
For credentials, multi factor authentication and unique accounts remove the cheap wins. Storing secrets in a vault, not in code or chat, closes another door.
For visibility, you need logs from firewalls, DNS, identity systems and endpoints in one place, and someone who looks at them. Detection that nobody reads is an archive.
For availability, upstream filtering, rate limiting and capacity planning are the standard answers, along with a documented plan for who calls whom during an attack.
How do software dependencies fit in?
Network threats often start with a flaw in software you run. An unpatched library in an internet facing service is an exposed service in disguise. Keeping an inventory of what you run, and knowing which vulnerable functions your code reaches, tells you which exposures deserve a same day fix. Safeguard's dependency scanning and reachability analysis support that part of the work.
How to check or apply this
- Scan your public address space and list every open port. Close anything without an owner.
- Enable multi factor authentication on VPN, email, admin consoles and cloud accounts.
- Set firewall rules to default deny between segments, then add narrow allows.
- Separate user workstations, servers, backups and management interfaces into distinct zones.
- Remove shared admin passwords. Use named accounts and rotate service credentials.
- Centralize firewall, DNS and identity logs, and alert on new admin accounts and unusual outbound traffic.
- Test restores from backup and rehearse a denial of service call tree twice a year.
Quick check
Is malware the biggest network threat?
Malware matters, but many intrusions start with valid credentials or an exposed service and use few or no malicious files. Controls should cover access as well as files.
What single change limits damage the most?
Segmentation with default deny rules. It does not prevent the first compromise, but it limits how far one machine can reach.
Sources
- MITRE ATT&CK
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- CISA Known Exploited Vulnerabilities Catalog
- CISA Cyber Essentials
Last reviewed: 18 October 2026.
