Common Network Security Threats and Threat Prevention · Topic 1 of 1
Enterprise Security Threats and Threat Prevention
Learn enterprise network threats and defenses for the communication network, zone border, computing environment and management center for HCIA-Security.
- 5 min
- The four areas are the communication network, the zone border, the computing environment and the security management center.
- Communication network: architecture, redundancy and VPN encryption for data in transit.
- Zone border: firewall, IPS, antivirus, URL filtering, anti-DDoS, WAF and sandbox.
What it is
An enterprise network faces threats from outside attackers, malicious or careless insiders, and plain faults. Attacks have become organized and profit driven: ransomware, data theft and DDoS for hire are common.
No single device stops everything, so defenses are arranged in areas. Following the "one center with triple protection" model of MLPS 2.0, the enterprise protects its communication network, its zone borders and its computing environment, and runs a security management center over all three.
How it works
The enterprise threat landscape
| Threat | What happens |
|---|---|
| DDoS | Floods of traffic exhaust bandwidth or server resources, breaking availability |
| Malware | Viruses, worms, Trojans and ransomware infect hosts; ransomware encrypts data for payment |
| Vulnerability exploits | Attackers use unpatched flaws in systems and applications to gain access |
| Phishing and social engineering | Users are tricked into opening attachments or giving away passwords |
| Eavesdropping and tampering | Data in transit is read or changed |
| Unauthorized access | Weak passwords or missing access control let outsiders or insiders reach resources |
| Insider and misoperation | Staff leak data or misconfigure devices, by intent or by mistake |
Most attacks follow a chain: reconnaissance, intrusion, spreading inside, then the goal. Defenses in several areas give several chances to break it.
Communication network security
The communication network carries traffic between sites, branches, clouds and remote users. Its requirements are a sound architecture with enough bandwidth, redundancy for key links and devices, and protection of data in transit.
| Threat | Solution |
|---|---|
| Eavesdropping or tampering on public links | Encrypted VPN: IPsec VPN between sites, SSL VPN for remote users |
| Single link or device failure | Redundant links and devices, such as firewall hot standby |
| Poor network segmentation | Divide the network into zones and subnets by function and trust |
Zone border security
A zone border is any edge between areas of different trust: the internet egress, the data center edge, the link to partners, or the line between departments. This is where traffic can be checked as it crosses.
| Threat | Solution |
|---|---|
| Unauthorized access across the border | Firewall with security zones and security policies |
| Known intrusions and exploits | IPS with an up-to-date signature database |
| Viruses in web, email or file traffic | Antivirus on the firewall or a gateway |
| DDoS floods | Anti-DDoS devices or a scrubbing service, plus attack defense on the firewall |
| Access to malicious websites | URL filtering |
| Attacks on web applications | WAF |
| Unknown malware | Sandbox analysis of suspicious files |
Computing environment security
The computing environment is where data is processed and stored: servers, virtual machines, terminals and the applications on them. Threats here have often already crossed the border, or started inside.
| Threat | Solution |
|---|---|
| Malware and ransomware on hosts | Endpoint antivirus or EDR (endpoint detection and response) |
| Unpatched systems | Vulnerability scanning and timely patching |
| Weak passwords and excess rights | Strong authentication, least privilege, account management |
| Insecure default settings | Host hardening: close unused ports and services |
| Data loss | Backups, data encryption and access control on sensitive data |
| Unknown devices joining the LAN | Network admission control (NAC) |
Security management center
The management center gives one view and one control point over the other areas. Without it, each device logs alone, attacks that touch several devices go unnoticed, and administrator actions are not audited.
| Requirement | Solution |
|---|---|
| Unified management of devices and policies | Centralized security management platform |
| Collecting and keeping logs | Log audit system; logs kept for the period the regulation sets |
| Seeing attacks across devices | Situational awareness or SIEM, correlating events with big data and AI |
| Controlling administrator access | Bastion host that authenticates, authorizes and records operations |
| Fast response | Linkage, where the analysis platform tells firewalls to block a threat |
Huawei's security portfolio fills these roles with, for example, HiSec Insight for situational awareness and threat analysis.
A worked example
A branch connects to headquarters over the internet, and staff browse the web through the head office egress.
The branch link uses an IPsec VPN (communication network). The egress firewall permits only needed traffic and runs IPS, antivirus and URL filtering (zone border). Servers are patched and run endpoint protection (computing environment). All devices send logs to a central platform that spots a host contacting a known command server and asks the firewall to block it (management center).
How the exam asks about this
- "Which solution protects branch traffic crossing the internet from eavesdropping?" → An IPsec VPN.
- "Which device is placed at the network border to block known intrusions inline?" → An IPS, or a firewall with IPS enabled.
- "Which system records and audits operations performed by administrators?" → A bastion host (operation audit).
What to remember for the exam
- The four areas are the communication network, the zone border, the computing environment and the security management center.
- Communication network: architecture, redundancy and VPN encryption for data in transit.
- Zone border: firewall, IPS, antivirus, URL filtering, anti-DDoS, WAF and sandbox.
- Computing environment: endpoint protection, patching, hardening, least privilege, backup and NAC.
- Management center: unified management, log audit, situational awareness and bastion host, linked to the enforcing devices.
A border firewall does not protect against threats that never cross it, such as an infected laptop attacking a server on the same LAN. That is why the computing environment needs its own controls.
Common mistakes
Putting the VPN under the zone border. A VPN protects data in transit over the communication network. The VPN gateway may sit at the border, but the threat it addresses is eavesdropping and tampering on the link.
Treating the management center as optional. Without central logs and correlation, an attack spread over several devices is seen as unrelated small events, and nobody can prove who changed what.
Relying on signatures alone. IPS and antivirus signatures stop known threats. Unknown malware needs sandboxing and behavior analysis on top.
Check yourself
Which protection area does host patching belong to?
The computing environment, which covers servers, terminals and the applications running on them.
Why is a sandbox added next to antivirus at the border?
Antivirus matches known signatures, while a sandbox runs unknown files in isolation to detect new malware by its behavior.
What does linkage between the management center and the firewall achieve?
When the analysis platform finds a threat, it tells the firewall to block it automatically, which shortens the response time.
Topic 1 of 1 in Common Network Security Threats and Threat Prevention
Test yourself on Common Network Security Threats and Threat Prevention
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.