◇ OpenCyber Academy
Bachelor's · Chapter 7 · English

Chapter 7 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Networks and protocols

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Virtual networks"]
  N2["7.2 Security groups and firewalls"]
  N3["7.3 Private endpoints"]
  N4["7.4 Kubernetes networking"]
  N5["7.5 TLS"]
  N6["7.6 Exposure analysis"]
  N7["7.7 Change risk"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Virtual networks"]
  N2["7.2 Security groups and firewalls"]
  N3["7.3 Private endpoints"]
  N4["7.4 Kubernetes networking"]
  N5["7.5 TLS"]
  N6["7.6 Exposure analysis"]
  N7["7.7 Change risk"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Virtual networks]
    |
    v
[7.2 Security groups and firewalls]
    |
    v
[7.3 Private endpoints]
    |
    v
[7.4 Kubernetes networking]
    |
    v
[7.5 TLS]
    |
    v
[7.6 Exposure analysis]
    |
    v
[7.7 Change risk]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain cloud networking for StudyHub; (2) describe security groups, private endpoints and Kubernetes services; (3) reason about exposure; (4) plan network restrictions.

7.1 Virtual networks

StudyHub's cluster runs in a private network with subnets for nodes and databases. Only the load balancer is public. The test database accepted connections only from the cluster's subnet, which is why the leaked connection string could not be used from outside.

Keeping only the load balancer public means everything else must be reached through it or from inside the network. That design is why the leaked connection string, though readable by anyone who pulled the image, could not be used from outside. The network was the layer that held.

7.2 Security groups and firewalls

Rules list allowed sources, destinations and ports. Default-deny with specific allows is safer than broad allows with exceptions.

StudyHub's database security group allows connections on the database port only from the node subnet. A broader rule allowing the whole campus network, with exceptions for student Wi-Fi, would be harder to review and easier to get wrong. Each allow rule in Samuel's table names the reason it exists. Rules without a reason are flagged in review and either explained by their owner or removed after a short notice period, which keeps the rule set from growing without anyone understanding it.

7.3 Private endpoints

Managed services such as the registry and storage can be reached through private endpoints inside the network, so traffic need not cross the internet and public access can be disabled.

For the registry, a private endpoint would let the cluster pull images without the registry being reachable from the internet at all. That would have prevented the anonymous pulls in the opening case regardless of the repository setting, which is another layer of defence rather than a replacement for the setting.

7.4 Kubernetes networking

Pods can talk to each other freely unless network policies restrict them. Services provide stable names; ingress controllers route external requests.

By default, a compromised pod in StudyHub could connect to any other pod, including records-api. Network policies let the team allow only the connections each service needs, such as the web front end reaching the records service. The flow table described below provides the list of needed connections. Policies are introduced one namespace at a time, starting with records-api, so a missed connection breaks one service rather than all of StudyHub.

7.5 TLS

Traffic is encrypted with TLS. Certificates are managed automatically and monitored for expiry.

StudyHub's ingress uses certificates issued and renewed automatically, and an alert fires if any certificate is within a fortnight of expiry without renewal. Inside the cluster, traffic between some services is also encrypted, which matters because the cluster's network is shared by many workloads. Certificates for internal services are issued by a private authority that the cluster trusts, and their lifetimes are short, so a stolen certificate becomes useless quickly. Samuel's exposure table records which flows are encrypted and which are not yet.

7.6 Exposure analysis

For each component, Samuel lists what can reach it: internet, campus network, cluster or specific services.

The analysis turned up one surprise, described in the worked example below: the registry was internet-reachable for a reason nobody had questioned. For each component, Samuel also notes why its exposure is needed, so that unexplained exposure stands out. The categories, internet, campus, cluster or specific services, follow the layers of the network design, from widest to narrowest. Most StudyHub components should sit in the narrowest category, so anything wider needs a written reason and an owner who agrees to keep it under review.

7.7 Change risk

Network changes can break services, so they are tested in the test environment and rolled out gradually.

Disabling public registry access could break any build that still pushed from outside. The team tested the change with the new internal build runner first, then disabled access in the test account, and only then in production. A rollback step was ready in case an unknown job failed. No job failed. Each stage lasted a few days, long enough for scheduled jobs to run at least once, and the team recorded which jobs had been observed working before moving on.

Documenting flows

Samuel writes a short table of every allowed network flow with its purpose and owner. When a rule is proposed, reviewers check it against the table. Flows without a known purpose are investigated and, if unused, removed. The table also helps new team members understand StudyHub quickly, and it becomes the basis for Kubernetes network policies later in the course.

Worked example

The exposure analysis shows the registry is reachable from the internet, needed only because a build server outside the network pushes images. Moving the build to a runner inside the network lets the team disable public registry access entirely.

Synthetic case. Networks are synthetic.

Errors and limits

Network controls reduce reach but do not replace authentication.

Exercises

Synthesis

Limit what can reach each component.

Continue studying — chapter 07 of 40

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →