Network Security Threat (ภัยคุกคามเครือข่าย) คืออะไร?
Network Security Threat คือเหตุการณ์หรือการกระทำที่อาจก่อให้เกิดความเสียหายต่อ Confidentiality (ความลับ), Integrity (ความสมบูรณ์), หรือ Availability (ความพร้อมใช้งาน) ของข้อมูลและระบบในเครือข่าย
Top 10 Network Security Threats (2024)
| # | Threat | คำอธิบาย | Impact |
|---|---|---|---|
| 1 | Ransomware | เข้ารหัสข้อมูล ร้องค่าไถ่ (Double/Triple Extortion) | Data Loss, Downtime, Financial, Reputation |
| 2 | Phishing / Social Engineering | หลอกล่อ Credentials, Malware Delivery (Email, SMS, Voice, QR) | Initial Access, Credential Theft, BEC |
| 3 | DDoS (Distributed Denial of Service) | โจมตีทำให้ Service ล่ม (Volumetric, Protocol, Application Layer) | Availability Loss, Revenue Loss |
| 4 | Supply Chain / Third-Party Attack | โจมตีผ่าน Vendor/Software (SolarWinds, MoveIT, 3CX, Kaseya) | Widespread Compromise, Trust Abuse |
| 5 | Insider Threat | Malicious/Negligent/Compromised Insider (Data Theft, Sabotage) | Data Exfil, IP Theft, Fraud |
| 6 | Vulnerability Exploitation (Zero-day / 1-day) | ใช้ช่องโหว่ Unpatched (Log4Shell, ProxyNotShell, CitrixBleed) | RCE, Privilege Escalation, Lateral Movement |
| 7 | Man-in-the-Middle (MitM) | Intercept/Modify Traffic (ARP Spoof, DNS Hijack, TLS Strip, Evil Twin) | Credential Theft, Session Hijack, Data Tampering |
| 8 | Malware / Botnet / APT | Persistent Access, C2, Lateral Movement, Data Exfil | Long-term Compromise, Espionage |
| 9 | Misconfiguration / Shadow IT | Cloud Storage Public, Open Ports, Default Creds, Unmanaged Devices | Data Exposure, Unauthorized Access |
| 10 | Credential Theft / Stuffing / Spraying | ใช้ Credentials ที่ลักลอบมา (Reuse, Breach Data) | Account Takeover, Lateral Movement |
3 ประเภทหลักของ Security Threats (Classic Classification)
- Malware (Malicious Software): Virus, Worm, Trojan, Ransomware, Spyware, Rootkit, Keylogger, Cryptominer
- Network Attacks: DDoS, MitM, Sniffing, Spoofing, Hijacking, Replay, Amplification
- Social Engineering: Phishing, Spear Phishing, Whaling, Vishing, Smishing, Pretexting, Baiting, Tailgating
Threat vs Attack vs Vulnerability vs Risk
| Term | Definition | Example |
|---|---|---|
| Asset | สิ่งที่มีค่าต้องการปกป้อง | Database, Web Server, Customer Data |
| Vulnerability | ช่องโหว่/จุดอ่อน | CVE-2021-44228 (Log4Shell), Weak Password |
| Threat | ศักยภาพที่จะ exploit vulnerability | Hacker Group, Malware, Disgruntled Employee |
| Attack | การกระทำจริงที่ exploit vulnerability | SQL Injection, Phishing Email Sent, DDoS Launch |
| Risk | ความน่าจะเป็น × ผลกระทบ (Likelihood × Impact) | High Risk: Internet-facing Unpatched Server |
Common Attack Vectors (Initial Access)
- Phishing Email (Attachment/Link) - #1 Vector
- Valid Accounts (Stolen Credentials, Default Creds)
- Exploit Public-Facing Application (VPN, Web App, RDP, SSH)
- Drive-by Compromise / Malvertising
- Supply Chain Compromise
- Removable Media (USB Drop)
- Trusted Relationship (Partner/Vendor Access)
Major Security Threat Categories (MITRE ATT&CK Tactics)
- Initial Access (Phishing, Exploit, Valid Accounts)
- Execution (Script, Binary, Command)
- Persistence (Registry, Scheduled Task, Service, Boot)
- Privilege Escalation (Exploit, Token Manipulation, Bypass UAC)
- Defense Evasion (Obfuscation, Masquerading, Disable Tools)
- Credential Access (Dump LSASS, Keylog, Brute Force)
- Discovery (Network Scan, AD Enum, Process Discovery)
- Lateral Movement (Pass-the-Hash, RDP, SMB, SSH, WMI)
- Collection (Data Staging, Email/Clipboard/Database)
- Command & Control (DNS, HTTP, TLS, P2P, WebSocket)
- Exfiltration (C2 Channel, Cloud Storage, Physical)
- Impact (Ransomware, Data Destruction, Defacement, Disk Wipe)
Defense Strategies (Layered / Defense in Depth)
| Layer | Controls | Tools |
|---|---|---|
| Perimeter | NGFW, DDoS Protection, WAF, Email Gateway, DNS Security | Palo Alto, FortiGate, Cloudflare, Proofpoint, Quad9 |
| Network | Segmentation (VLAN, Zero Trust), NAC, NIDS/NIPS, NDR | Cisco ISE, Zeek/Suricata, Corelight, Illumio |
| Endpoint | EDR/XDR, AV, App Control, Disk Encryption, Patch Mgmt | CrowdStrike, SentinelOne, Defender, Tanium, Automox |
| Application | WAF, API Gateway, SAST/DAST/SCA, Secure SDLC | OWASP ZAP, Burp, Snyk, Checkmarx, Veracode |
| Data | DLP, Encryption (At Rest/In Transit), Classification, Backup | Purview, Forcepoint, Veeam, Rubrik, HashiCorp Vault |
| Identity | MFA, SSO, PAM, IAM, Zero Trust (ZTNA), Conditional Access | Entra ID, Okta, Ping, CyberArk, BeyondTrust |
| Operations | SIEM, SOAR, Threat Intel, Vuln Mgmt, IR Plan, Hunt | Splunk, Sentinel, XSOAR, Tenable, Qualys, MISP |
| Governance | Policies, Standards, Risk Mgmt, Compliance, Audit, Training | NIST CSF, ISO 27001, CIS Controls, KnowBe4 |
สรุป
Network Security Threats หลากหลายและขยับเร็ว (Ransomware, Phishing, DDoS, Supply Chain, Insider, Zero-day) ต้องใช้ Defense in Depth หลายชั้น รวม People, Process, Technology พร้อม Continuous Monitoring, Threat Intelligence, Incident Response, และ Security Awareness เพื่อลด Risk ให้อยู่ในระดับที่ยอมรับได้
