Chapter 19 — Network and communications security: scope and theory

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Scope of the field"]
  N2["19.2 Trust and boundaries"]
  N3["19.3 Prevention, detection and response"]
  N4["19.4 Theory meets constraints"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Scope of the field"]
  N2["19.2 Trust and boundaries"]
  N3["19.3 Prevention, detection and response"]
  N4["19.4 Theory meets constraints"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Scope of the field]
    |
    v
[19.2 Trust and boundaries]
    |
    v
[19.3 Prevention, detection and response]
    |
    v
[19.4 Theory meets constraints]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) define the field's scope; (2) explain key models; (3) relate theory to clinic problems.

19.1 Scope of the field

Network and communications security protects data as it moves between systems and protects the networks that carry it. It covers segmentation and firewalls, secure protocols such as TLS and IPsec, wireless security, monitoring and detection, and the processes that keep these working. It overlaps with host security and identity, but its focus is on paths: who can reach what, how data are protected in transit, and how unusual traffic is noticed. Priya maps each clinic problem to this scope to see which belong to her project.

19.2 Trust and boundaries

Classic network designs trusted everything inside the perimeter and filtered only at the internet edge. The clinic network follows this model: once on the wireless network, any device can reach any other. Experience showed that attackers who get inside one device can then move freely. Modern thinking, summarised in NIST SP 800-207 on zero trust architecture, reduces implicit trust: access decisions consider identity and device state, and internal traffic is controlled as carefully as external traffic. For the clinics, this means treating the guest network as untrusted even though it sits inside the building.

19.3 Prevention, detection and response

Theory also distinguishes stages. Prevention tries to stop harmful traffic, through firewalls and authentication. Detection notices what prevention missed, through logs and intrusion detection systems, as described in NIST SP 800-94. Response contains and recovers, through procedures and backups. Priya realises the clinics have only weak prevention, almost no detection and an informal response process. Her project cannot fix everything, so she aims for meaningful improvement in prevention and basic detection. She writes a one-page response checklist as a first step, naming who to call and which devices to disconnect in an emergency.

19.4 Theory meets constraints

Theory describes ideal designs, but small organisations have limited staff, budgets and skills. The clinics have one part-time IT lead. Full zero trust is unrealistic, but applying its principles partially, such as separating zones and authenticating staff individually, is achievable. Priya learns that good practitioners adapt theory to constraints honestly, choosing the improvements that most reduce risk for the effort available and documenting what remains undone, rather than proposing designs nobody can run. Each deferred improvement is listed with its risk so managers can revisit it when resources allow.

Worked example

Priya's scope statement covers wireless separation, firewall policy, TLS on clinic services and basic logging, excluding endpoint protection.

Synthetic case. Scope is synthetic.

Errors and limits

Proposing an ideal design without regard to staff capacity produces plans that are never implemented.

Exercises

• EX055 — Perimeter weakness. What weakness of perimeter-only trust does the clinic network show?
  Show marking criteria

  Rubric: 3 = inside devices reach everything;; 2 = internal movement;; 1 = vague;; 0 = none.
• EX056 — Zero trust realism. Why apply zero trust principles only partially at the clinics?
  Show marking criteria

  Rubric: 3 = limited staff and budget;; 2 = resources;; 1 = not useful;; 0 = none.
• EX057 — Detection guidance. Which NIST publication covers intrusion detection and prevention systems?
  Show marking criteria

  Rubric: 3 = SP 800-94;; 2 = 800-94;; 1 = other;; 0 = none.

Synthesis

The field focuses on paths and protection in transit; theory guides, but constraints shape what is achievable.

Continue studying — chapter 19 of 40

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →