Table of Contents – Cybersecurity & Networking

1. Networking Basics
1.1 What is Networking
1.2 Internetworking
1.3 Devices used in Internetworking (Routers, Switches, Bridges, Gateways)
2. Networking Models
2.1 OSI Reference Model (7 Layers)
2.2 TCP/IP Model (4 Layers)
3. Network Layers – Detailed
3.1 Physical Layer
3.2 Data Link Layer
3.3 Network Layer
- IP, ICMP, IGMP, ARP, RARP
3.4 Transport Layer
- TCP, UDP
3.5 Session Layer
3.6 Presentation Layer
3.7 Application Layer
- SMTP, FTP, DNS, SNMP, NFS, RPC, TFTP
4. Risk in Networking
4.1 Definition of Risk (Risk = Threat × Exposure × Vulnerability × Consequence)
4.2 Threats
4.3 Exposure
4.4 Vulnerabilities
4.5 Consequences
5. Types of Attacks
5.1 Automated Attacks (Worms, Viruses)
5.2 Targeted Attacks
5.3 Fallout (Side-effects)
6. Types of Attackers
o Curious, Ideological, For-profit, Corporate, Terrorists, Nation States, Insiders
7. Purposes of Attacks
7.1 Steal or Manipulate Information
7.2 Use System Resources
7.3 Take Control of Systems
7.4 Disrupt Services
8. Network Security
8.1 Importance of Security Awareness
 8.2 Prevent Security Problems
- Policies, Secure Design, Secure Protocols
8.3 Mitigate Security Problems
- Detect & Analyze Intrusions
8.4 Recover from Security Problems
9. Designing for Security
9.1 Prerequisites: Risk Awareness, Security Policy
9.2 Network Design Principles
- Multi-layered Defense, Least Privilege
9.3 System Design Principles
- Strong Access Control, Software Security, Accounting & Auditing
[Link] Secure Networks
10.1 Network Segmentation (Zones, Least Privilege)
10.2 Perimeter Defense (Firewalls, IDS)
10.3 Network Containment
[Link] Mechanisms
11.1 Airgaps (Physical Separation)
11.2 Firewalls
- Firewall Rules
- Firewall Concerns
- NAT (Network Address Translation)
[Link]
o Summary of Risk, Security, and Best Practices

Networking Overview

1. Networking Basics

 Definition of Networking: Connecting computers and devices so they can share

information and resources.
 Connecting two computers = a link
 Connecting several computers = a network
 Connecting multiple networks = internetworking
 An internetwork (internet): A network of networks
 The Internet: The largest internetwork in the world
2. What is Internetworking?

 Definition: The art and science of connecting LANs and WANs to form larger
networks.
 Can be complex because different networks may use different protocols.
 Devices used in internetworking:
o Routers: Forward data between networks
o Switches: Connect devices within a network
o Bridges: Connect similar networks
o Gateways: Connect different types of networks or protocols

3. OSI Reference Model

 Definition: A 7-layer model that describes how networks communicate.

 Each layer has a specific role in sending data from one device to another.
 Helps standardize network communication across different devices and systems.

4. TCP/IP Model

 Definition: A simpler, practical model used in real-world networking.

 Focuses on how data moves over the Internet.
 Combines some OSI layers into 4 layers:
1. Application Layer – User services (email, web)
2. Transport Layer – Reliable delivery (TCP/UDP)
3. Internet Layer – Routing & addressing (IP)
4. Network Access/Link Layer – Physical & data link layer combined

5. Basics of Network Security

 Definition: Protecting a network from unauthorized access, attacks, or misuse.

 Key points:
o Security awareness is important for all users
o Protecting data, devices, and communications
o Using tools like firewalls, NAT, encryption, and secure protocols
o Ensures network availability, confidentiality, and integrity
✅ Quick Exam Tip:

 Remember the hierarchy: Link → Network → Internetwork → Internet

 OSI model = 7 layers, TCP/IP = 4 layers
 Internetworking devices: Routers, Switches, Bridges, Gateways

OSI & TCP/IP Layered Model – Detailed Definitions (Simple English)

1. Physical Layer

 Definition: The lowest layer, deals with the physical connection between devices.
 Converts digital data (0s and 1s) into electrical signals, light signals, or radio waves
to send over cables or wireless networks.
 Determines how devices physically connect: voltage, data speed, cable type (Ethernet,
fiber), and connectors.
 Protocols: Mostly hardware standards, so no standard protocol names.
 Key Idea: Without the physical layer, no data can move, because there is no way to
send signals.

2. Data Link Layer

 Definition: Provides reliable communication inside a single network (local network).

 Converts data into frames and uses MAC addresses to identify devices.
 Ensures data reaches the correct device in the same network.
 Provides error detection to identify corrupted data.
 Protocols: Depends on network type, like Ethernet, WiFi (IEEE 802.11), PPP.
 Key Idea: Makes sure local delivery works correctly before data goes to another
network.

3. Network Layer

 Definition: Handles communication between different networks (like from one city to
another).
  Uses IP addresses to identify devices and determines the best path for data.
 Splits data into packets for easy routing across multiple networks.

Important Protocols:

1. IP (Internet Protocol): Assigns source and destination IP, sends packets, unreliable
(doesn’t guarantee delivery).
2. ICMP (Internet Control Message Protocol): Sends error messages and network status
(used by ping).
3. IGMP (Internet Group Management Protocol): Manages multicast groups (e.g.,
streaming video to many devices).
4. ARP (Address Resolution Protocol): Finds MAC address from IP address for local
delivery.
5. RARP (Reverse ARP): Finds IP address from MAC, mostly replaced now by DHCP.

 Key Idea: This layer is all about routing data correctly across networks.

4. Transport Layer

 Definition: Ensures end-to-end delivery between sender and receiver.

 Divides data into segments and manages flow control and error control.
 Key Idea: Makes sure data is delivered completely and in order.

Important Protocols:

1. TCP (Transmission Control Protocol): Reliable, connection-oriented, retransmits lost

packets, ensures correct order.
2. UDP (User Datagram Protocol): Fast, connectionless, no retransmission, used in live
streaming, games.

5. Session Layer

 Definition: Manages sessions (connections) between devices.

 Can start, maintain, and close sessions, and recover if the connection fails.
 In TCP/IP model, session management is usually part of the Application Layer.
 Key Idea: Controls who talks to whom and when.
6. Presentation Layer

 Definition: Handles data formatting, translation, encryption, and compression.

 Ensures that the receiver can understand the data even if sender uses a different
format.
 Example: Converting text encoding from ASCII to Unicode, encrypting emails,
compressing files.
 Key Idea: Makes data usable and secure for the application layer.

7. Application Layer

 Definition: Top layer, closest to the user, provides network services like email, file
transfer, and device management.
 Key Protocols:

1. SMTP (Simple Mail Transfer Protocol): Sends emails from client to server and
between servers.
2. FTP (File Transfer Protocol): Uploads and downloads files between client and server.
3. DNS (Domain Name System): Converts domain names into IP addresses.
4. SNMP (Simple Network Management Protocol): Monitors and manages network
devices (routers, switches).
5. NFS (Network File System): Accesses remote files as if local.
6. RPC (Remote Procedure Call): Calls a function on a remote computer over the
network.
7. TFTP (Trivial File Transfer Protocol): Lightweight file transfer using UDP, no
authentication.

 Key Idea: Provides services directly used by people and applications.

Summary

 Layers work together to send data from one device to another.

 Lower layers (Physical, Data Link, Network, Transport): Handle hardware,
addressing, routing, and reliable delivery.
 Upper layers (Session, Presentation, Application): Handle communication control,
formatting, security, and user services.
  Each layer has specific responsibilities and protocols, making the network organized
and efficient.

What is Risk? (Cyber Security)

Definition

Risk means the chance that a cyber attack can happen and cause loss or damage to a
system.

In cybersecurity, risk tells us how dangerous a possible attack is for a system or network.

Risk Formula

Risk is calculated using this formula:

Risk = Threat × Exposure × Vulnerability × Consequence

Key Points:

1. Evaluate all components:

o Threats → probability of an attack
o Exposure → how accessible the system is to attackers
o Vulnerabilities → weaknesses in the system
o Consequences → cost or damage of a successful attack
2. Challenges in evaluating risk:
o Low-probability events are hard to predict
o Lack of information can make analysis difficult
3. Reducing risk:
o Risk analysis helps determine what needs protection
o Can guide decisions to reduce risk effectively
o Sometimes risk is measured in monetary value to see if reducing it is worth the
effort
o Placing a value on human life or critical assets is difficult and often controversial

Purpose: Risk analysis provides an abstract guide for protecting systems, even if exact values
are hard to determine.
Another Simple Definition of Risk

Risk can also be defined as:

Risk = Probability of failure × Cost of consequence

Here:

 Failure means a successful cyber attack

 Cost means the damage caused by the attack

Network Security and Risk

Network security is mainly about reducing risk.

Networked systems usually have:

 More exposure
 More threats

Because they are connected to the internet and other systems.

Goal of Network Security

The goal is to reduce risk by:

 reducing threats
 removing vulnerabilities
 limiting exposure
 minimizing consequences

Threats (Cyber Security)

Definition
Threats are the possible attacks or dangers that can harm a computer system, network, or
data.

A threat represents the probability that an attacker will try to perform an attack on a
system.

In networking environments, threats increase because:

 There are more networked systems, which means more profitable targets for
attackers.
 Attackers become less visible when attacking through networks.
 The risk of being caught becomes lower.
 The number of potential attackers increases because many people can access systems
through the internet.

Because of these reasons, network security tries to reduce threats by increasing the risk for
attackers (making attacks harder and increasing the chance of being caught).

Exposure (Cyber Security)

Definition

Exposure means the degree to which a system, network, or device is accessible to attackers.

Exposure shows the probability that a vulnerability can be reached and attacked by
outsiders.

Networking increases exposure because:

 Non-networked systems are becoming networked, so more systems are connected to

the internet.
 Systems become accessible to more attackers around the world.
 Wireless, mobile, and multi-access technologies make devices easier to connect and
access.
 Attackers can sometimes access networks without physical access, using antennas or
wireless signals.
 IP technology is widely used, so attackers understand these systems better.
 Devices may automatically connect to networks, which attackers can trick or control.

Because of these reasons, network security mainly focuses on reducing exposure so attackers
cannot easily reach the system.
Vulnerabilities (Cyber Security)

Definition

Vulnerabilities are weaknesses or flaws in software, hardware, or organizational processes

that can be exploited by a threat to perform an attack.

Vulnerabilities occur because:

 Systems are becoming more complex, and complexity creates more weaknesses.
 Non-networked systems are becoming networked, but many of these systems were not
designed with security in mind.
 Some systems become connected to networks without proper security protection.

However, there are also some improvements:

 Security awareness is increasing among users and organizations.

 Modern software is often more secure than older software.
 Developers are using better security practices and standard components.

Network security itself does not directly remove vulnerabilities.

To reduce vulnerabilities, we need:

 Secure programming techniques

 Good system administration
 Proper network management practices.

Consequences (Cyber Security)

Definition

Consequences are the damage or impact caused by a successful attack on a system or

network.

Key points about consequences:

 Networked systems are increasingly critical for businesses and daily operations.
 Even the properties of networked systems (like websites or servers) can have critical
impact.
 Networked systems can be used to launch attacks on other systems. Attackers often
control one system to attack others.
  Consequences affect business continuity, survivability, and high availability of
services.

Networking itself does not directly change the consequences, but as more important systems
become networked, the potential damage from attacks becomes larger.

Examples:

 A website being offline years ago was minor; now it can seriously harm business
reputation or search engine ranking.
 Fake content or hacked systems can lead to legal issues, embarrassment, and financial
loss.

Network security mainly helps prevent attacks, but minimizing consequences requires
planning for continuity, survivability, and high availability.

Some Attacks (Cyber Security)

Definition

Attacks are actions by attackers to exploit vulnerabilities and cause harm to systems or
networks.

Types of attacks:

1. Automated attacks
o Performed by programs like worms and viruses
o Extremely common
o Usually not targeted; spread automatically
2. Targeted attacks
o Aimed at specific targets (like a company or individual)
o Performed with a specific goal
o Uncommon, but more dangerous
3. Fallout
o Side-effects of other attacks
o Damage or problems caused unintentionally during an attack

These attacks show how threats exploit vulnerabilities to create consequences.

Types of Attackers (Cyber Security)

Definition

Attackers are people or groups who try to exploit vulnerabilities in systems to achieve
their goals.

Types of attackers:

1. Curious attackers
o Motivated by curiosity
o Want to see how systems work or explore vulnerabilities
2. Ideological attackers
o Attack to promote a cause or belief
o Example: defacing websites of businesses or governments they disagree with
3. For-profit attackers
o Attack to make money
o Target systems that have financial or valuable information
4. Corporate attackers
o Well-funded organizations or groups
o Attack specific targets for strategic or business purposes
5. Terrorists
o Use cyber attacks to cause fear, disruption, or political impact
6. Nation states
o Government-backed attackers
o Target other countries for espionage, sabotage, or strategic advantage
7. Insiders
o People inside the organization
o Can exploit their access for personal gain or revenge

Purposes of Attacks (Cyber Security)

Definition

Purposes of attacks are the reasons why attackers target systems, networks, or
information.

Main purposes:

1. Break into systems

o Steal information (e.g., personal data, financial info)
o Manipulate information (e.g., change records or data)
 oUse system resources (e.g., send spam, host illegal websites, commit fraud)
2. Take control of systems
o Perform new attacks (use the system to attack others)
o Manipulate systems (change system behavior or settings)
3. Disrupt service
o Extort target (demand money or compliance)
o Discredit target (harm reputation or credibility)
o Facilitate other attacks (e.g., make spoofing or fraud easier)

Most serious attacks are motivated by money or strategic advantage, directly or indirectly.

Network Security (Cyber Security)

Definition

Network security is the practice of protecting computer networks from attacks,

unauthorized access, and other security problems.

Key Points:

1. Security awareness is very important

o Everyone involved must understand risks and security importance
o Need to know current security situations and changes in threats
2. Prevent security problems
o Policies and organization to support security
o Secure network design (architecture that reduces risks)
o Secure protocols (methods for safe communication)
3. Mitigate security problems
o Detect intrusions (find attacks early)
o Analyze intrusions (understand attacks and how they happened)
4. Recover from security problems
o Ensure systems and networks continue working after an attack

Additional Notes:

 Network security works with system security:

o Accounting, auditing, monitoring, and access control on systems are also necessary
  Security awareness is the foundation for effective network protection

Designing for Security (Cyber Security)

Definition

Designing for security means building systems and networks from the start with strong
protection against attacks, rather than trying to fix problems later.

Prerequisites for Secure Design:

1. Risk and security awareness

o Understand risks, threats, vulnerabilities, and consequences
o Know why security is important
2. Accepted security policy
o Policy defines security goals and rules
o Must be accepted by everyone to prevent being ignored or bypassed

Network Design Principles:

1. Multi-layered defense strategy

o Use multiple layers of security so if one fails, others still protect
2. Principle of least privilege
o Give users and systems only the access they need, nothing more

System Design Principles:

1. Strong access control

o Limit who can access what information or systems
2. Strong software security
o Ensure software is secure from vulnerabilities
3. Accounting and auditing
o Track and log system activity to detect problems

Additional Notes:
  Designing for security prevents future problems
 Legacy systems often lack proper security, making patching difficult
 Security must be applied to both network and individual systems
 Without proper design, attackers can find and exploit remaining weaknesses

Designing Secure Networks (Cyber Security)

Definition

Designing secure networks means planning and building networks so they are protected
from attacks, limit access, and reduce exposure.

Key Principles:

1. Network Segmentation
o Divide the network into different zones for different functions
o Contains threats by limiting access to specific resources
o Reduces exposure by making sure systems and users can only access what they
need
o Often creates a shell-like structure: innermost networks are most protected, outer
layers more accessible
2. Perimeter Defense
o Protects the borders between network zones
o Usually includes firewalls and intrusion detection systems (IDS)
o Prevents attacks from reaching critical internal networks
3. Network Containment
o Limits the network to a known and controlled extent
o Ensures networks do not unintentionally extend beyond their intended boundaries
o Especially important for wireless networks, which can easily extend beyond
control

Proper secure network design ensures that even if one part is attacked, the rest of the
network remains protected.

Network Segmentation (Cyber Security)

Definition
Network segmentation is the practice of dividing a network into separate zones or layers to
improve security and control access.

Example of a Segmented Network:

1. Outer DMZ (Demilitarized Zone)

o Accessible from the Internet
o Provides public services like websites or email servers
2. Office LAN
o Main business network
o Not accessible from the Internet
o Employees use this for daily work
3. Inner DMZ
o Accessible from the Office LAN and the SCADA LAN
o Acts as a secure intermediary for controlled data flow
4. SCADA LAN (or control system LAN)
o Not accessible from other networks
o Used for critical systems like power grids or process control systems

Key Security Principles Applied:

 Multi-layer security: Each network layer has its own perimeter defense
 Principle of least privilege:
o Only systems that need Internet access can use it
o Office LAN can access SCADA data only via inner DMZ services
 Limits exposure and reduces risk if one layer is attacked

Separation Mechanisms (Cyber Security)

Definition

Separation mechanisms are methods used to divide network segments to control access
and improve security.

Types of Separation Mechanisms:

 1. Airgaps
o Physically disconnect network segments
o No integration between networks
o Strongest form of network separation
2. Firewalls
o Devices that block disallowed traffic between networks
o Allow controlled communication through rules
o Most commonly used for secure separation
3. Routers
o Forward traffic between networks
o Not designed for security segmentation
4. Bridges
o Can connect networks
o Not useful for security purposes

Notes:

 Airgap = most secure because networks are completely disconnected

 Firewall = practical method to separate networks and enforce rules
 Routers and switches = designed to connect networks, cannot reliably enforce security
separation

Airgaps (Cyber Security)

Definition

Airgaps are network separation methods where a network is physically disconnected from
all other networks to prevent any traffic or attacks.

Key Points:

1. Ideal airgap:
o No physical connection → complete security in theory
o No traffic can flow between networks
2. Why airgaps fail in reality:
o Temporary connections for updates or maintenance
o Wireless devices can connect unintentionally
 o Insider threats – users may bypass rules
o Laptop computers – can bring malware into the network
o Physical access – unauthorized people accessing the network
3. Airgap often doesn’t exist in practice:
o Misconfigurations or dual-homed systems can connect networks unintentionally
o Temporary or emergency connections often remain open too long
o Business needs may require some network integration
4. Laptop example:
o An infected laptop connects to a “protected” network
o Malware spreads despite the supposed airgap
5. Good network management can defeat airgaps:
o Management LANs and virtual LANs may connect multiple networks logically
o Network managers often want centralized control → can unintentionally bridge
airgapped networks
6. Conclusion:
o Airgaps offer excellent theoretical separation
o But they are impractical for most real networks
o Assume airgaps cannot be fully relied upon
o Design network security with that assumption in mind

Takeaway: Airgaps are strong in theory but fail in practice; plan network security assuming
networks may still be reachable.

Firewalls (Cyber Security)

Definition

A firewall is a device or computer that acts as a router and filters network traffic based on
a set of rules to enforce security.

Key Points:

1. Purpose of Firewalls:
o Restrict traffic from inside to outside and outside to inside
o Enforce network security policies
o Enforce network partitioning between segments
o Do not replace proper internal security – sometimes misused as an excuse to
ignore internal security
 2. How Firewalls Work:
o Firewalls are essentially routers with rules
o Rules determine who can communicate, using which protocols and applications
o They protect the network perimeter and maintain segmentation
3. Firewall Rules:
o Traffic criteria:
 Source/destination IP addresses
 Source/destination ports
 Protocol type (TCP, UDP, etc.)
 Physical interface or traffic rate
 Usually not application-level info (except advanced firewalls)
o Actions:
 Allow traffic
 Drop traffic silently
 Reject traffic with notification to source
o Policy:
 Determines action for traffic not matching any rule

Notes:

 Firewalls are essential for controlling access and protecting networks, but they cannot
guarantee internal security
 Advanced firewalls can inspect application-layer traffic, but this slows performance

Takeaway: Firewalls enforce network rules and segmentation, but internal security must
still be strong.

Network Address Translation (NAT)

Definition

Network Address Translation (NAT) is a technique where a router or firewall rewrites IP

addresses in packets so that devices with private addresses can communicate with external
networks like the Internet.

Key Points:
 1. How NAT works
o Internal private addresses are rewritten to a public address when packets go
outside
o Allows many internal devices to share one public IP address
o Prevents direct connections from the Internet to internal systems
2. Main purposes
o Allow hosts with private IP addresses to access external networks
o Hide internal network addresses from outside systems
3. Misuse as a security mechanism
o NAT is sometimes treated as security protection, but it was not designed for
security
o It does not protect against attacks initiated from inside, such as malware
connecting to malicious websites

Important Limitations:

1. Outgoing connections are still risky

o If an internal device connects to a malicious service, it can still be attacked
o A compromised system can then attack other systems inside the network
2. NAT penetration
o Sometimes attackers can bypass NAT using special techniques
o For example, DNS queries can be used to send or receive hidden data
3. Costs of NAT
o May reduce performance
o Adds complexity
o Can reduce flexibility of network communication

✅ Conclusion:
NAT provides some protection by hiding internal addresses, but it should not be relied on
as a main security mechanism. Proper network security controls are still required.

Firewall Concerns (Cyber Security)

Definition

Firewalls are security devices that filter traffic between networks, but their effectiveness
depends on proper configuration and management.
Key Concerns:

1. Configuration-dependent
o Firewalls are only as good as their configuration
o Studies show many firewalls are misconfigured
o IT testing is often not thorough enough
2. Weaknesses
o Little protection from insiders – internal attacks can bypass firewalls
o Firewall failure can disrupt the entire network
o Firewalls themselves may have vulnerabilities that attackers can exploit
3. Management and Monitoring
o Requires careful design, configuration, and monitoring
o Must align with security policies and network requirements

Conclusion:

 Firewalls are a very useful security tool

o Provide perimeter security
o Enforce security policies
 They are one link in the security chain
o Do not excuse weak security elsewhere

You should have firewalls, but rely on overall network security practices as well.

1. Networking Basics

 Networking: Connecting computers to share data and resources.

 Internetworking: Connecting LANs to form WANs, then WANs to make bigger
networks.
 Devices: Routers (route traffic), Switches (connect devices in LAN), Bridges (connect
segments), Gateways (connect different protocols).
 Links vs Networks vs Internet:
o Link: Connects 2 computers.
o Network: Multiple connected computers.
o Internetwork (Internet): Network of networks.
2. Networking Models

 OSI Model (7 layers): Physical, Data Link, Network, Transport, Session, Presentation,
Application. Helps standardize communication.
 TCP/IP Model (4 layers): Network Access, Internet, Transport, Application. Practical
model used on the Internet.

3. Network Layers & Protocols

1. Physical Layer: Hardware, cables, signals, voltage, connectors. Converts 0/1 into
electrical/light/radio signals.
2. Data Link Layer: Frames data, uses MAC addresses, error detection for local network
delivery.
3. Network Layer: Handles routing between networks, uses IP addresses.
o IP: Packet addressing and routing (unreliable).
o ICMP: Error reporting and network status (ping).
o IGMP: Manage multicast groups (e.g., multiple users watching same video).
o ARP: Converts IP → MAC.
o RARP: Converts MAC → IP (old, replaced by DHCP).
4. Transport Layer: End-to-end communication, ensures proper delivery, handles
flow/error control.
o TCP: Reliable, connection-oriented, retransmits lost packets.
o UDP: Fast, connectionless, no error checking, used in streaming/games.
5. Session Layer: Start, manage, close sessions between devices.
6. Presentation Layer: Formats, encrypts, compresses data. Makes data compatible
between sender & receiver.
7. Application Layer: Services for users.
o SMTP: Email transfer.
o FTP: File upload/download.
o DNS: Domain → IP resolution.
o SNMP: Network device monitoring.
o NFS: Remote file access.
o RPC: Execute functions on remote systems.
o TFTP: Lightweight file transfer (UDP, no authentication).

4. Risk in Networking

 Risk Formula: Risk = Threat × Exposure × Vulnerability × Consequence.

 Threats: Motivation, profitable targets, large attacker pool.
 Exposure: Accessibility increases with networking, wireless, IP convergence.
  Vulnerabilities: Weaknesses in software/hardware/process; complexity increases risk.
 Consequences: Critical systems can be disrupted, used for attacks, or cause business
losses.

5. Types of Attacks

 Automated Attacks: Worms, viruses, very common.

 Targeted Attacks: Focused on specific systems for a goal, less common.
 Fallout: Side-effects from other attacks.

6. Types of Attackers

 Curious: Just exploring systems.

 Ideological: For a cause (e.g., deface websites).
 For-profit: Steal data or resources for money.
 Corporate: Well-funded, professional attacks.
 Terrorists: Cause fear/disruption.
 Nation states: Political/strategic attacks.
 Insiders: Employees or people with internal access.

7. Purposes of Attacks

 Break systems: Steal/manipulate data, use resources.

 Take control: Launch new attacks, manipulate systems.
 Disrupt service: Denial of service, extortion, discredit targets.

8. Network Security

 Awareness: Know risks and threats.

 Prevention: Policies, secure network design, secure protocols.
 Mitigation: Detect and analyze intrusions.
 Recovery: Restore system/network after attack.
 Integration: Network security + system security (access control, auditing, monitoring).

9. Designing for Security

 Prerequisites: Risk awareness, accepted security policy.

 Network Design: Multi-layered defense, least privilege principle.
 System Design: Strong access control, software security, accounting & auditing.
10. Designing Secure Networks

 Network Segmentation: Divide network into zones (DMZ, office LAN, SCADA LAN).
Limits access.
 Perimeter Defense: Firewalls, IDS to protect network borders.
 Network Containment: Limit network reach.
 Separation Mechanisms: Airgaps, firewalls, NAT.

11. Airgaps

 Definition: Physically separate networks, no traffic flow.

 Limitations: Temporary connections, wireless, laptops, insiders, virtual LANs.
 Conclusion: Full airgaps are impractical; design networks assuming no perfect airgap.

12. Firewalls

 Definition: Router with rules to filter traffic.

 Functions: Restrict traffic, enforce policy, network partitioning.
 Rules: Criteria (source/destination/port), action (allow/drop/reject), default policy.
 NAT: Maps private → public addresses, limits incoming connections.
 Concerns: Misconfiguration, insider attacks, firewall vulnerabilities.
 Conclusion: Firewalls are essential but not a total solution.

13. Summary

 Risk = Threat × Exposure × Vulnerability × Consequence.

 Identify threats, exposure, vulnerabilities, consequences.
 Security focuses on prevention, mitigation, and recovery.