I.

The Open Systems Interconnection (OSI) Reference Model

The OSI model is a theoretical framework of seven interchangeable layers

used as a template for building and using networks.

 Layer 7: Application: The user interface layer, responsible for

interacting with end users through application software (e.g., web
browsers, email clients).

 Layer 6: Presentation: Responsible for data formatting and

translation, including encryption and coding data into a format for
transmission.

 Layer 5: Session: Manages communication sessions between

computers, including creating, maintaining, and disconnecting
connections.

 Layer 4: Transport: Responsible for breaking data into packets and

ensuring they are transmitted properly with flow control and error
checking.

 Layer 3: Network: Handles logical addressing and routing of data for

delivery across a Wide Area Network (WAN).

 Layer 2: Data Link: Manages physical addressing (MAC addresses)

and data delivery across a Local Area Network (LAN).

 Layer 1: Physical: Responsible for the physical operation of the

network, translating bits into electrical pulses, light bursts, or radio
signals.

II. Main Types of Networks

 Wide Area Networks (WANs): Connect systems over large

geographic areas; the Internet is the largest example.

o Security Concerns: Because it is an open network, data

security is not guaranteed unless encryption is used.

o Connectivity Options: Include cable modems, DSL, fiber optics,

satellite, dialup, and cellular networks (3G/4G/5G).

 Local Area Networks (LANs): Provide connectivity for systems in the

same geographic area, typically using devices like hubs and switches.
 o Ethernet: The most common LAN technology, defining how
computers use Media Access Control (MAC) addresses to
communicate.

 Virtual LANs (VLANs): Logical network segments that allow

administrators to separate groups of devices without physical cabling
changes, reducing traffic and increasing security.

III. Critical Network Devices and Concepts

 Hubs: "Dumb" devices that echo all incoming packets to every port
without inspecting them.

 Switches: Intelligent devices that know the MAC address of every

connected system and perform intelligent filtering to send packets only
to the intended destination.

 Routers: Devices that interconnect two or more networks and

selectively interchange data packets based on network addresses.

o Border Routers: Sit between a private network and the

Internet; they are subject to direct external attacks.

o Internal Routers: Keep subnet traffic separate and provide dual

protection by preventing unwanted traffic from crossing between
internal departments.

 Network Address Translation (NAT): Originally created to conserve

IPv4 addresses, it is now primarily used to hide a system's real IP
address from the public Internet.

IV. TCP/IP Protocol Suite

TCP/IP is a reliable, fault-tolerant suite of protocols that governs activity

across the Internet and most corporate networks.

 IP Addressing:

o IPv4: Uses 32-bit (four-byte) addresses; although common, its

address space is exhausted.

o IPv6: Uses 128-bit addresses, providing significantly more

unique addresses and enhanced security features.

 Dynamic Host Configuration Protocol (DHCP): Dynamically

provides computers with configuration information, such as IP
addresses and subnet masks, instead of manual entry.
  Common Ports (to know by heart):

o 20/21: FTP (Data/Control)

o 22: SSH

o 25: SMTP

o 53: DNS

o 80: HTTP

o 110: POP3

o 443: HTTPS

 Internet Control Message Protocol (ICMP): A management

protocol used to deliver messages about network health.

o Ping: Sends an echo request to see if a computer is reachable.

o Traceroute: Identifies the path packets take through the

network.

V. Network Security Risks

 Reconnaissance: Gathering information (IPs, OS versions, firewall

types) for use in a future attack.

 Eavesdropping: Sniffing or tapping data cables to violate data

confidentiality.

 Denial of Service (DoS): Flooding a network with traffic to shut down

a single point of failure.

 Distributed DoS (DDoS): Using many compromised systems to flood

a network from multiple directions simultaneously.

 Telephony DoS (TDoS): Specifically targeting telephone systems to

prevent calls from being initiated or received.

VI. Network Security Defense Tools

 Firewalls: Control the flow of traffic to prevent unauthorized access.

o Types: Basic packet filtering, stateful inspection

(remembers communication status), and application proxies
(prevents direct packet travel between systems).
 o Deployment: Can be border firewalls or screened subnet
(DMZ) firewalls, which host public-facing services while
protecting the internal LAN.

 Unified Threat Management (UTM): Multipurpose devices providing

URL filtering, content inspection, and malware inspection.

 Virtual Private Networks (VPNs): Create authenticated and

encrypted tunnels across public networks. Major technologies include
IPSec, SSL/TLS, and OpenVPN.

 Network Access Control (NAC): Performs authentication and

posture checking (verifying updated AV, OS patches, etc.) before
allowing a device to connect.

VII. Wireless Network Security

Wireless Access Points (WAPs) send network info over the air, making them
susceptible to anyone within radio range.

 Encryption Standards:

o WEP: Obsolete and highly insecure; should never be used.

o WPA/WPA2/WPA3: Modern standards, with WPA3 being the

most secure.

 Security Controls:

o SSID Broadcast: Disabling it can hide the network name from

casual users but is not foolproof against skilled attackers.

o MAC Address Filtering: Restricts access to specific devices,

but addresses are easily spoofed.

o Hardware Management: Careful antenna placement and

power-level controls can limit the visibility of the WAP to those
outside the building.
  OSI Model Function: The Presentation Layer is responsible for coding and translating
data into a format that is more secure and efficient for transmission; from a security
perspective, this is where encryption generally takes place.
 Application in the WAN Domain: While technically a Layer 6 function, encryption is a
critical strategy used in the Wide Area Network (WAN) domain. Because the Internet
is an open network where security cannot be guaranteed, encryption is used to hide
sensitive data while it is in transit.
 Wireless Security: Encryption is also the most important security control for wireless
networks to prevent eavesdropping by unauthorized users within radio range of a
Wireless Access Point (WAP). Modern standards like WPA2 and WPA3 are used for
this purpose, replacing the obsolete and insecure WEP standard.
 Remote and Voice Security: For remote access and Voice over IP (VoIP), strategies
include enforcing the use of encrypted VPNs and requiring end-to-end encryption for
calls using protocols like TLS or SRTP.

A border router is the specific type of device that sits between a Wide Area Network (WAN),
typically the Internet, and an internal network.

Key characteristics of a border router include:

 External Exposure: Because it is directly exposed to a WAN, a border router is subject

to direct attacks from outside sources.
 Security Configuration: When configuring these routers, administrators must decide
whether they will be the only point of defense or part of a multilayered security approach.
 Comparison to Internal Routers: While a border router manages the connection to the
outside world, internal routers (or interior routers) are used within the organization to
keep subnet traffic separate and provide additional protection for sensitive departments,
such as research or finance.
Firewalls are critical security elements that control the flow of traffic by preventing unauthorized
access to or from specific portions of a network. Firewalls are catagorized based on their
functionality and how they are deployed within a network topology.

Functional Types of Firewalls

There are three main functional types of firewalls, ranging from basic filtering to advanced
inspection:

 Packet Filtering: This is the most basic type. It receives packets and compares them
against a set of rules (such as IP address, port number, or protocol) to decide whether to
permit or deny them. It has no memory of past packets and evaluates each one
individually.
 Stateful Inspection: Unlike basic filtering, a stateful inspection firewall remembers the
status of network communications. It keeps track of established sessions and only needs
to check rules when a new communication session starts.
 Application Proxy: This type provides the highest degree of protection by acting as a
broker between two systems. It does not allow packets to travel directly between systems
on opposite sides of the firewall; instead, it terminates the connection on one side and
opens a separate one on the other, analyzing the application-level data in the process.

Firewall Deployment Techniques

Firewalls are also defined by their placement and role within the network architecture:

 Border Firewalls: These are the most common and are placed at the edge of a network
to separate the protected internal network from the public Internet.
 Screened Subnet (DMZ) Firewalls: This topology is used to host public-facing services
(like web or email servers) while still protecting the internal LAN. A Demilitarized
Zone (DMZ) is a semiprivate network that allows limited access from the Internet but
blocks direct access to the private network. This can be achieved with a single firewall
that has three network interfaces or by placing the DMZ between two separate firewalls.
 Multilayered Firewalls: Organizations often use multiple firewalls to segment their
internal network into pieces. This allows for different security levels; for example,
general users might be separated from a sensitive research project or executive network
segment.

Unified Threat Management (UTM)

Modern firewalls have matured into multipurpose devices known as Unified Threat
Management (UTM) devices. These go beyond simple packet inspection to provide several
integrated security services:

 URL Filter: Examines web traffic by the URL rather than just the IP address.
  Content Inspection: Analyzes the actual content of packets to identify and block
malicious data from trusted sources.
 Malware Inspection: A specialized form of content inspection that looks specifically for
signs of viruses or other malicious software.

application-proxy firewall (also known as an application proxy).

This firewall provides a high degree of protection by functioning in the following way:

 Acts as a Broker: It does not allow packets to travel directly between systems on
opposite sides of the firewall. Instead, it opens separate connections with each of the
two communicating systems and acts as a broker, or proxy, between them.
 Analyzes Application Data: Because it sits between the two systems, it can analyze
information about the specific application in use to determine whether to allow or
deny the traffic.
 Enhanced Security: This method is considered more advanced than stateful inspection
because it prevents direct communication between the external and internal systems.

For these reasons, an application-proxy firewall is often recommended for protecting

highly secure environments, such as a sensitive data center.

Firewalls provide several key security features and capabilities designed to protect network
segments from unauthorized traffic. Based on the sources, these features include:
Core Security Mechanisms
 Access Control Lists (ACLs): Rules that define how to handle traffic from specific hosts
or ports using various protocols.
 Implicit Deny: A highly secure configuration where the firewall is set to deny all
messages except for those explicitly allowed by the administrator.
 Flood Guard: Rules that limit the traffic bandwidth allowed from specific hosts, which
helps reduce the ability of any single host to flood and overwhelm the network.
 Loop Protection: The ability to analyze message addresses to determine if a message is
being sent in an unending loop, which can be a form of network flooding.
 Network Segmentation: Filtering rules that enforce physical or logical divisions
between networks, preventing traffic from moving unauthorized between different
network segments.
Advanced and Integrated Features
Modern firewalls, often referred to as Unified Threat Management (UTM) devices, include
additional specialized features:
  URL Filtering: Examines the Uniform Resource Locator (URL) of web traffic rather
than just the IP address to make filtering decisions.
 Content Inspection: Analyzes some or all of the actual content within a network packet
to determine if it should be allowed to pass.
 Malware Inspection: A specialized version of content inspection that scans packet data
specifically for signs of viruses or other malicious software.
 Load Balancing: Some firewalls can be configured to dynamically route traffic to
different network segments to avoid congestion and ensure high availability.
Monitoring and Detection
 Logging and Analysis: Firewalls operate as detective controls, recording as much
information as possible in log files. This data can be analyzed to identify reconnaissance
activity or attacks that have already occurred.
A Virtual LAN (VLAN) is a collection of logically related network devices that are viewed as a
partitioned network segment,. It is created through router and switch configuration rather than
physical hardware changes.

Key characteristics and benefits of using VLANs include:

 Logical Separation: They give administrators the ability to separate network segments
without the need to physically separate the network cabling,.
 Increased Security: By isolating logical groups of devices, sensitive information can be
hidden from unauthorized users,. For example, a VLAN created specifically for a Human
Resources (HR) department can hide HR-related traffic from all non-HR computers.
 Traffic Management: They are used to reduce network traffic by isolating specific
types of data,.
 VoIP Best Practices: A common security best practice is to use VLANs to separate
voice and video traffic from other network uses, such as workstations and printers.

The method that uses alternate public addresses for an organization is Network Address
Translation (NAT),.

NAT functions in the following ways:

 Hiding Real IP Addresses: While its original purpose was to compensate for a shortage
of IP addresses, its primary use today is to hide a system's real, private IP address from
the public Internet by using an alternate public IP address,.
 Enhancing Security: By using an alternate address, NAT makes it more difficult for an
attacker to identify the layout of a network behind a firewall. However, the sources warn
that relying solely on NAT for security is a mistake and it should be used in conjunction
with other tools like packet filtering.
 Conserving Addresses: NAT allows an organization to use common internal addressing
schemes (such as 192.168.1.x) that are used by many other organizations. It makes these
internal addresses unique to the outside world by combining them with an externally-
facing public IP address and a specific port number.

Virtual Private Networks (VPNs) creates an authenticated and encrypted tunnel across a public
network (like the Internet) to protect data in transit.

The following are the major VPN technologies in use today, along with their typical
applications:

1. Point-to-Point Tunneling Protocol (PPTP)

 Description: Formerly the most common VPN protocol.

 Where to Use: Primarily used for remote access for individuals.
  Context: It is easy to set up on client computers because most modern operating systems
include built-in PPTP support.

2. Secure Sockets Layer (SSL) / Transport Layer Security (TLS)

 Description: This method encrypts web communications and is rapidly growing in

popularity because it requires no advance configuration of the user's system. Users
simply log on to a protected webpage, and the browser downloads the necessary
software.
 Where to Use: Ideal for organizations that need to provide remote access to employees
who may be using a variety of different devices or computers they do not own or manage.

3. Secure Socket Tunneling Protocol (SSTP)

 Description: A Microsoft-specific protocol that is a more modern approach to VPNs. It

routes traffic over SSL, which allows the connection to easily pass through firewalls and
proxy servers.
 Where to Use: Best for organizations that primarily use the Windows operating
system for their remote workforce.

4. Internet Protocol Security (IPSec)

 Description: A suite of protocols designed to securely connect different sites. While it

can be used for end users, it often requires the installation of third-party software, making
it less popular for individual client use.
 Where to Use: Typically used by organizations to create site-to-site connections.
Because IPSec functionality is built into many routers and firewalls, it is the standard for
connecting a branch office to a main headquarters.

5. OpenVPN

 Description: A versatile technology available for almost all current operating systems. It
uses SSL/TLS for its key exchange and can support both TCP and UDP transport
protocols.
 Where to Use: Suitable for both home and organization use due to its high
compatibility across different platforms.

Summary of Use Cases

 Organization-Specific (Infrastructure): IPSec is the primary choice for connecting two

physical locations (like two offices) together.
 Organization-to-Employee (Remote Access): SSL/TLS and SSTP (for Windows) are
preferred for allowing employees to connect securely from home or the road to the
corporate network.
 General/Home Use: PPTP and OpenVPN are common choices for individuals needing
basic encrypted tunnels or cross-platform compatibility.