Network Security Threats คืออะไร?
Network Security Threats = การกระทำหรือเหตุการณ์ที่มีศักยภาพจะทำลาย ความลับ (Confidentiality) ความสมบูรณ์ (Integrity) หรือความพร้อมใช้งาน (Availability) ของเครือข่ายและข้อมูลที่ส่งผ่าน อาจมาจากภายนอก (External) หรือภายใน (Internal) และอาจเป็น意ร้าย (Malicious) หรือไม่ได้ตั้งใจ (Accidental)
การจัดประเภทภัยคุกคามเครือข่าย (Threat Taxonomy)
1. ตามแรงจูงใจ (Motivation)
- Cybercrime: กำไรทางการเงิน (Ransomware, Fraud, Data Theft, Cryptojacking)
- Hacktivism: แสดงความคิดเห็นทางการเมือง/สังคม (Defacement, DDoS, Leaks)
- Espionage (APT): ขโมยข้อมูลลับองค์กร/รัฐบาล (Nation-state, Corporate Espionage)
- Sabotage/Destruction: ทำลายระบบ/ข้อมูล (Wiper Malware, OT/ICS Attacks)
- Insider Threat: พนักงาน/ผู้รับเหมา (Malicious, Negligent, Compromised)
2. ตามเวกเตอร์การโจมตี (Attack Vector)
| Category | Threats | ตัวอย่าง/เทคนิค |
|---|---|---|
| Malware | Virus, Worm, Trojan, Ransomware, Spyware, Rootkit, Bootkit, Fileless, Botnet, RAT, Keylogger, Crypto-miner | Emotet, TrickBot, Cobalt Strike, Mirai, LockBit, BlackCat |
| Network Attacks | DDoS (Volumetric, Protocol, App Layer), MitM, ARP/DNS Spoofing, BGP Hijack, VLAN Hopping, DHCP Starvation, Rogue AP/ DHCP | Mirai DDoS, DNS Cache Poisoning, SSL Strip |
| Web Application Attacks | SQLi, XSS, CSRF, SSRF, RCE, LFI/RFI, IDOR, Broken Auth, XXE, Deserialization | OWASP Top 10, Log4Shell, Spring4Shell |
| Credential-Based | Phishing, Credential Stuffing, Password Spraying, Brute Force, Kerberoasting, AS-REP Roasting, Golden/Silver Ticket, Pass-the-Hash | MFA Bypass (MFA Fatigue, SIM Swap, Token Theft) |
| Social Engineering | Phishing (Email/SMS/Voice), Spear Phishing, Whaling, BEC, Pretexting, Baiting, Tailgating, Vishing, Smishing, Quishing (QR) | CEO Fraud, Payroll Diversion, Gift Card Scam |
| Supply Chain | Software Supply Chain (Dependency Confusion, Typosquatting, Compromised Build), Hardware Implants, Vendor Compromise | SolarWinds, Kaseya, 3CX, Log4j, xz Utils |
| Cloud/Infrastructure | Misconfiguration (Public S3, Open SG, Excessive IAM), Container Escape, Metadata Service Abuse, Serverless Exploits | Capital One (SSRF), Tesla (K8s Console) |
| Wireless/Physical | Evil Twin, Deauth, WPS Crack, Wardriving, Physical Access, USB Drop, BadUSB, DMA Attack | Pineapple, Flipper Zero, Rubber Ducky |
3. ตามระยะของ Cyber Kill Chain (MITRE ATT&CK)
- Reconnaissance: OSINT, Network Scanning, Phishing for Info
- Resource Development: Malware Dev, C2 Setup, Compromise Infrastructure
- Initial Access: Phishing, Exploit Public-Facing App, Valid Accounts, Drive-by, Supply Chain, Removable Media
- Execution: Command/Script, Native API, Scheduled Task, WMI, User Execution
- Persistence: Registry, Startup, Services, Scheduled Tasks, Bootkit, Cloud Accounts
- Privilege Escalation: Exploit, Token Manipulation, Bypass UAC, Sudo, Kernel Exploit
- Defense Evasion: Obfuscation, Process Injection, Rootkit, Disable Tools, Masquerading
- Credential Access: Dumping (LSASS), Keylogging, Brute Force, Kerberoasting, Credential Stores
- Discovery: Network Scan, AD Recon, Cloud Recon, File/Dir Discovery
- Lateral Movement: Pass-the-Hash, RDP, SMB, SSH, WinRM, DCOM, WMI, Cloud APIs
- Collection: Data Staging, Email/Clipboard/Keylog, Screen Capture, Audio/Video
- Command & Control: C2 Protocols (DNS, HTTP, HTTPS, TLS, Custom), Domain Fronting, Fast Flux
- Exfiltration: C2 Channel, Web Service, Cloud Storage, Physical Media, Size Limits
- Impact: Ransomware, Data Destruction, Defacement, DoS, Disk Wipe, Firmware Corruption
Top 10 Network Security Threats 2024 (Real-world Prevalence)
- Ransomware (RaaS): LockBit, BlackCat/ALPHV, Cl0p, Play, Akira - Double/Triple Extortion
- Business Email Compromise (BEC): CEO Fraud, Invoice Fraud, Payroll Diversion - No Malware, Pure Social Eng
- Exploitation of Public-Facing Applications: VPN (Citrix, Pulse, FortiGate), Exchange (ProxyNotShell), Firewall (PAN-OS), MoveIT, CitrixBleed
- Identity-based Attacks: MFA Bypass, Token Theft (Pass-the-Cookie), Golden SAML, Cloud Identity Abuse
- Supply Chain / Third-Party: Software Vendors, MSPs, Law Firms, Payroll Providers
- Cloud Misconfiguration & Credential Theft: Public Buckets, Excessive Permissions, Long-lived Keys
- Insider Threat (Data Exfiltration): Departing Employees, Negligent Cloud Sharing, Shadow IT
- DDoS (Ransom DDoS / RDDoS): Volumetric + Extortion, Application Layer (HTTP/2 Rapid Reset)
- Living off the Land (LotL): Built-in Tools (PowerShell, WMI, Certutil, Bitsadmin, Schtasks, LOLBAS/GTFOBins)
- AI-Enhanced Attacks: Deepfake Voice/Video, Automated Phishing, Code Generation, Polymorphic Malware
กรณีศึกษา: โจมตีเครือข่ายที่มีชื่อเสียง
| Incident | Year | Initial Vector | Threat Type | Impact |
|---|---|---|---|---|
| WannaCry | 2017 | EternalBlue (SMBv1) | Ransomware Worm | 200K+ คอมพิวเตอร์ 150+ ประเทศ $4B+ |
| NotPetya | 2017 | MeDoc Supply Chain | Wiper (Masquerade as Ransomware) | $10B+ Global, Maersk, Merck, FedEx |
| SolarWinds (SUNBURST) | 2020 | Software Supply Chain | APT29 (Cozy Bear) | 18K+ Organizations, US Gov, Microsoft, FireEye |
| Colonial Pipeline | 2021 | VPN Credential (No MFA) | Ransomware (DarkSide) | Fuel Shortage US East Coast, $4.4M Ransom |
| Log4Shell (CVE-2021-44228) | 2021 | RCE in Log4j | Vuln Exploitation (Mass) | Ubiquitous, Nation-state + Criminal Exploitation |
| MOVEit Transfer | 2023 | SQLi (CVE-2023-34362) | Data Theft (Cl0p) | 2000+ Orgs, 60M+ Individuals |
| Volt Typhoon | 2023-24 | Living off the Land | APT (China) - Critical Infrastructure | US Guam, Critical Infrastructure Pre-positioning |
กลยุทธ์ป้องกันแบบ Defense-in-Depth (Layered Defense)
Layer 1: Perimeter & Network
- Next-Gen Firewall (App-ID, User-ID, SSL Decrypt, IPS, URL Filtering, DNS Security)
- Network Segmentation: VLAN, VRF, Micro-segmentation (Zero Trust)
- DDoS Protection: Cloud-based (Cloudflare, AWS Shield, Akamai)
- Secure Remote Access: ZTNA (Zero Trust Network Access) แทน VPN แบบเดิม
- Wireless Security: WPA3-Enterprise, NAC, WIPS
Layer 2: Endpoint & Identity
- EDR/XDR (CrowdStrike, SentinelOne, Defender for Endpoint, Cortex XDR)
- Application Control: WDAC, AppLocker, SELinux, Gatekeeper
- Identity: MFA (FIDO2/WebAuthn), PAM, Conditional Access, Passwordless
- Patch Management: Automated, Prioritized (KEV Catalog), Virtual Patching
- Hardware Security: TPM 2.0, Secure Boot, Measured Boot, DRTM
Layer 3: Application & Data
- DevSecOps: SAST/DAST/SCA/Container Scan ใน CI/CD
- WAF/API Security: Rate Limiting, Bot Management, Schema Validation
- Data Protection: DLP, Encryption (At Rest/In Transit), Tokenization, Classification
- Secrets Management: Vault, Key Vault, Sealed Secrets, External Secrets Operator
Layer 4: Monitoring & Response
- SIEM + SOAR: Detection Engineering (MITRE ATT&CK Coverage), Alert Tuning
- NTA/NDR: Encrypted Traffic Analysis, Anomaly Detection (Vectra, Corelight, Darktrace)
- Threat Intelligence: TIP, MITRE ATT&CK Mapping, Threat Hunting Program
- Deception: Canary Tokens, Honeypots, Honeyfiles, Decoy Accounts
- Incident Response: Playbooks, Tabletop Exercises, Forensics Readiness
Layer 5: Governance & People
- Security Awareness: Continuous, Role-based, Phishing Simulation, Culture
- Risk Management: Risk Register, Quantification (FAIR), Board Reporting
- Compliance: PDPA, ISO 27001, PCI-DSS, NIST CSF, CIS Controls
- Vendor Risk: Third-Party Risk Management (TPRM), Contractual Security Clauses
- Policy/Standards: Living Documents, Annual Review, Exception Management
Threat Modeling สำหรับองค์กร (Practical Approach)
- Scope: ระบบ/แอป/เครือข่ายที่ต้องการวิเคราะห์
- Decompose: Data Flow Diagram (DFD) - Trust Boundaries, Data Flows, Entry Points
- Identify Threats: STRIDE (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege)
- Analyze Risk: Likelihood × Impact (CVSS, FAIR, DREAD)
- Mitigate: Controls per Threat (Eliminate, Reduce, Transfer, Accept)
- Validate: Pen Test, Code Review, Red Team, Purple Team
- Monitor & Iterate: Continuous Threat Modeling
Emerging Threats 2024-2025
- AI/ML Attacks: Adversarial ML, Data Poisoning, Model Extraction, Model Inversion, Prompt Injection (LLM)
- Quantum Threat (Y2Q): Harvest Now, Decrypt Later - เริ่มวางแผน PQC Migration
- Deepfake/GenAI Social Engineering: Real-time Voice/Video Cloning, Automated Spear Phishing
- OT/ICS/IIoT Targeting: Critical Infrastructure, Manufacturing, Energy, Water, Transport
- Space/Ground Segment Cyber: Satellite Comms, GPS/GNSS Spoofing/Jamming
- Biometric Data Theft: Irreversible Compromise
