We assume here that the attacker is moderately skilled and motivated to break into your network. He has targeted you due to a specific motive -- perhaps you sacked him or didn't provide adequate customer support. Hopefully this will help you figure out where your network might be attacked, and what an attacker might do once he is on the inside.
Database servers -- Many database servers have the default systems admin account password blank and other common misconfigurations. These are very high-profile targets because the criminal might be looking to steal anything from your customer list to credit card numbers. As a rule, a database server should never be Internet-facing.
The more naive of the lot (or the ones who know that security logs are never looked at) may run a commercial vulnerability scanner such as Nessus or Retina over the network. This will ease their work.
Exploitation phase
After determining which are valid targets and figuring out what OS and version of software you are using (example which version of Apache or IIS is the web server running), the attacker can look for an exploit targeting your particular version. For example, if he finds you are running an out of date version of Sendmail, he will look for an exploit targeting that version or below.
Attackers will first look in their collection of exploits because they have tested these. If they cannot find one, they will look to public repositories such as http://www.packetstormsecurity.nl. They will probably try to choose common exploits, as these are more likely to work and they can probably test them in their own labs. They will run these exploits on the target (say the Web server) and if they work, they will have some kind of access to the network.
From here the attacker has already won half the game -- he is behind your firewall and can probably see a lot more of the internal network than you ever intended for him to. Many networks tend to be very hard to penetrate from the outside, but are woefully unprotected internally. This hard exterior with a mushy interior is a recipe for trouble -- an attacker who penetrates the first line of defense will have the full run of your network.
After getting in, he will also probably install backdoors on this first compromised system to provide him with many access points, in case his original hole gets shut down. This is why when you identify a machine that has been broken into, it should be built up again from scratch. There is no way of knowing what kind of backdoors might be installed. It could be tricky to find a program that runs itself from 2:00 am to 4:00 am every night and tries to connect to the attacker's machine. Once the attacker has successfully guaranteed his access, the hard part of the intrusion is usually over.
Privilege escalation phase
Now the attacker will attempt to increase his security clearance on the network. he will usually target the administrator accounts or perhaps a CEO's account. If he is focused on a specific target (say your database server) he will look for the credentials of anyone with access to that resource. He will most likely set up a network sniffer to capture all the packets as they go through the network.
He will also start manually hunting around for documents that will give him some interesting information or leverage. Thus, any sensitive documents should be encrypted or stored on systems with no connection to the network.
Attackers will also look for Windows machines with file sharing enabled and see what they can get out of these. Chances are if they didn't come in with a particular objective in mind (for example stealing a database), they will take whatever information they deem to be useful in some way.
Clean up phase
Now the attacker has either found what he was looking for or is satisfied with the level of access he's gained. He's made sure that he has multiple paths into the network in case you close the first hole. He will now try to cover up any trace of an intrusion. He will manually edit log files to remove entries about his actions and will make sure to hide any programs he has installed in hard to find places.
Remember, we are dealing with an intruder who is moderately skilled and is not just interested in defacing your Web site. He knows that the only way to keep access will be if you never know something is amiss. In the event that there is a log he is unable to clean up, he may risk leaving it there, or flood the log with bogus attacks, making it difficult for you to single out the real attack.
Where can I find more information?
One of the best place for answers to questions relating to this article is in the Firewall.cx forums. The Security/Firewalls Forum is the best place to do this -- you can ask anything from the most basic to the most advanced questions concerning network security there. A lot of common questions have already been answered in the forums, so you will quite likely find answers to questions like "Which firewall should I use?"
Network security is a very vast field and there is seemingly limitless information on the subject. You will never find information at so-called hacker sites full of programs. The best way to learn about network security is to deal with the first word first -- you should be able to talk networking in and out, from packet header to checksum, Layer 1 to Layer 7.
Once you've got that down, you should start on the security aspect. Start by reading articles on the Internet. Take in the basics first, and make sure you keep reading. Wherever possible, try to experiment with what you have read. If you don't have a home lab, you can build one virtually. See the posts in the Firewall.cx Cool Software forum about VMware.
Also, start reading the security mailing lists such as bugtraq and security-basics. Initially, you may find yourself unable to understand a lot of what happens there, but the newest vulnerabilities are always announced on these lists. If you follow a vulnerability from the time its discovered to when someone posts an exploit for it, you'll get a very good idea of how the security community works, and you'll also learn a lot in the process.
If you're serious about security, it is imperative that you learn a programming language, or at least are able to understand code if not write your own. The best choices are C and Assembly language. However, knowing PERL and Python are also valuable skills as you can write programs in these languages very quickly.
For now, here are a few links that you can follow for more information:
Click over to 
