Why network security matters: attackers, malware and security policy
In short: Poor security practices can lead to lost or altered data, slow systems, breaches or complete failure. Networks are attacked by many kinds of people for many reasons, often using malware. A formal security policy, layered defences and an incident response team (CERT) keep the risk under control.
Why security is part of every network job
Managing systems and networks is a daily task that directly affects security. Weak or careless practices can cause data loss, damaged data, poor performance, security breaches or even total failure of a system. Supporting and securing networks takes up a large share of most IT budgets, and as more business and everyday life moves online, security keeps growing in importance.
In short, information security means protecting information and systems from unauthorised access and preventing data from being changed, disrupted or destroyed without the organisation's approval.
Networks are targets
Any device connected to the internet is scanned and probed by automated tools within minutes. Attackers have different motives and skills:
| Attacker | Typical motive |
|---|---|
| Cyber criminals | Money: ransomware, stolen card data, fraud |
| Hacktivists | Political or social causes; defacing sites, leaking data |
| State-sponsored groups | Espionage, disruption of critical services |
| Insiders | Revenge, money or simple mistakes by staff |
| Inexperienced attackers ("script kiddies") | Curiosity or reputation, using ready-made tools |
Malicious software (malware)
| Type | How it behaves |
|---|---|
| Virus | Attaches to a file or program and spreads when a user runs it. |
| Worm | Copies itself across the network on its own, without user action. |
| Trojan horse | Looks like useful software but hides a malicious function. |
| Ransomware | Encrypts files and demands payment for the key. |
| Spyware and keyloggers | Secretly collect activity, passwords and data. |
| Adware | Shows unwanted advertising, often bundled with free software. |
| Rootkit | Hides deep in the system to keep an attacker's access hidden. |
Preventing malware
- Keep operating systems, applications and firmware patched.
- Run up-to-date anti-malware / endpoint protection on every device.
- Give users only the permissions they need; avoid daily use of admin accounts.
- Filter email and web traffic and block risky file types.
- Train users to recognise phishing and suspicious attachments.
- Keep tested, offline backups so ransomware can't destroy your only copy.
Network security policy
A network security policy is a formal document that sets out the rules, procedures and guidelines for enforcing, managing, monitoring and maintaining security on a network. Its objectives are to protect the network from anything that could breach its security, make responsibilities clear, and give a consistent basis for decisions. It usually covers acceptable use, access control, passwords, remote access, monitoring and incident response.
CERTs: the incident response team
A Computer Emergency Response Team (CERT), also called a CSIRT, is a group of security experts who protect against, detect and respond to an organisation's security incidents, such as data breaches and denial-of-service attacks. CERTs also publish alerts and incident-handling guidance, run awareness campaigns and research better defences. The first CERT was formed in 1988 after the Morris worm spread across the early internet; today many countries and large organisations have their own.
Real-world example: a dental practice without a policy
A three-surgery dental practice had no written security policy. Staff shared one Windows login, antivirus had expired months earlier, and the only backup was a USB drive that stayed plugged into the reception PC. A receptionist opened an attachment that looked like a supplier invoice, and ransomware encrypted the appointment system and the backup drive at the same time. The practice worked from paper for three days while an IT contractor rebuilt the PCs.
Afterwards the practice wrote a short security policy with management backing. Every person got their own account, antivirus and updates were managed centrally, backups were kept offline and tested monthly, and the practice manager became the named contact for reporting incidents to the IT contractor. None of these steps was expensive; the policy simply made sure they happened.
Practice
What is the difference between a virus and a worm?
Why are offline backups important against ransomware?
What does a CERT do?
Key takeaways
- Weak security practices can cause data loss, breaches, poor performance or total failure.
- Attackers include criminals, hacktivists, states, insiders and inexperienced attackers.
- Malware includes viruses, worms, Trojans, ransomware, spyware and rootkits.
- Defence in depth layers policy, perimeter, network, host and data protection.
- A security policy sets the rules; a CERT handles incidents.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.