Domain 4: Network Security
Network security protects data as it moves between systems, and the infrastructure that carries it.
OSI model
| Layer | Name | Examples |
|---|---|---|
| 7 | Application | HTTP, DNS, SMTP |
| 6 | Presentation | encoding, encryption, compression |
| 5 | Session | session setup and teardown |
| 4 | Transport | TCP, UDP |
| 3 | Network | IP, ICMP, routers |
| 2 | Data link | Ethernet, MAC addresses, switches |
| 1 | Physical | cables, radio, hubs |
The TCP/IP model groups these into four layers: application, transport, internet, and network access.
Addressing
- IPv4: 32-bit addresses written as four decimal numbers, e.g. 192.168.1.10.
- IPv6: 128-bit addresses written in hexadecimal, e.g. 2001:db8::1.
- Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, not routed on the internet.
- MAC address: a 48-bit hardware address of a network interface, used at layer 2.
Common ports
| Port | Protocol | Secure alternative |
|---|---|---|
| 21 | FTP | SFTP (22) or FTPS (990) |
| 23 | Telnet | SSH (22) |
| 25 | SMTP | SMTP with TLS (587) |
| 53 | DNS | DNS over TLS or HTTPS |
| 80 | HTTP | HTTPS (443) |
| 143 | IMAP | IMAPS (993) |
| 389 | LDAP | LDAPS (636) |
| 3389 | RDP | RDP through a VPN or gateway |
TCP and UDP
- TCP: connection-oriented and reliable; sets up a connection with a three-way handshake (SYN, SYN-ACK, ACK) and retransmits lost data.
- UDP: connectionless and faster, with no delivery guarantee; used for DNS queries, streaming and VoIP.
Threats to networks
- Denial of service (DoS): overwhelming a system so legitimate users cannot reach it; DDoS uses many machines at once.
- On-path (man-in-the-middle) attack: an attacker secretly relays or alters traffic between two parties.
- Malware: viruses, worms, trojans and ransomware.
- Side-channel attack: learning secrets from physical effects such as timing, power use or emissions.
- Advanced persistent threat (APT): a skilled, well-funded attacker who stays hidden in a network for a long time.
Network defences
- Firewall: filters traffic between networks according to rules.
- Intrusion detection system (IDS): monitors and alerts on suspicious activity.
- Intrusion prevention system (IPS): like an IDS, but sits inline and can block traffic.
- Network segmentation: dividing a network into zones so a compromise is contained.
- DMZ: a screened subnet that hosts public-facing services, separated from the internal network.
- VLAN: a logical network segment created on switches.
- VPN: an encrypted tunnel across an untrusted network.
- Network access control (NAC): checks devices against policy before letting them join the network.
- Zero trust: never trust by network location; verify every request and grant least privilege.
- Microsegmentation: very fine-grained segmentation, down to individual workloads.
Wireless security
Use WPA3, or at least WPA2 with AES; avoid WEP and WPA, which are broken. Change default administrator credentials, use strong passphrases, and keep guest networks separate from internal ones.
Cloud and data centre basics
- SaaS, PaaS, IaaS: the provider manages more of the stack as you move from IaaS to PaaS to SaaS.
- Shared responsibility model: the provider secures the cloud itself; the customer secures what they put in it.
- Redundancy: duplicate power, cooling and network links keep data centre services available.
- Service-level agreement (SLA): a contract setting measurable service expectations, such as uptime, with a provider.
- Memorandum of understanding (MOU): a less formal agreement describing how two parties will work together.