Chapter 2 — Computing systems | Bachelor's Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Computing systems

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 From application to wire"]
  N2["2.2 Addresses and names"]
  N3["2.3 Shared media and switching"]
  N4["2.4 Where controls sit"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 From application to wire"]
  N2["2.2 Addresses and names"]
  N3["2.3 Shared media and switching"]
  N4["2.4 Where controls sit"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 From application to wire]
    |
    v
[2.2 Addresses and names]
    |
    v
[2.3 Shared media and switching]
    |
    v
[2.4 Where controls sit]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) describe how hosts send data; (2) explain addresses at each layer; (3) identify where controls can act.

2.1 From application to wire

When a clinic receptionist opens the booking system, several layers cooperate. The application forms a request, the transport layer splits it into segments and adds port numbers, the network layer adds source and destination IP addresses, and the link layer frames it for the local network with hardware addresses. At the destination, each layer removes its header and passes the data up. Priya draws this as a stack because each layer is a place where a control can act: an application can check users, the network layer can filter addresses, and the link layer can separate local segments.

2.2 Addresses and names

Devices are identified in several ways at once. A hardware address identifies a network card on the local segment; an IP address identifies a host across networks; a port identifies a service on that host; a name such as booking.clinic.example is translated to an address by DNS. Each identifier has different strength. Hardware addresses can be changed by software, IP addresses can be reassigned, and names depend on DNS answers being correct. Knowing which identifier a control relies on tells Priya how easily it might be confused or misled.

2.3 Shared media and switching

Older networks used shared media where every device heard every frame. Modern switches send frames only to the port of the destination, but wireless networks are shared again: every device on a channel can receive the radio signal. Encryption on the wireless link protects frames from outsiders, but devices that share the same network and key can still talk to one another. This explains part of the clinics' problem. With one passphrase for everyone, visitor phones are on the same local network as clinical carts, separated by nothing except good luck.

2.4 Where controls sit

Priya maps possible controls onto the clinic network: separate wireless networks and virtual LANs at the link layer, a firewall between them at the network layer, encryption with TLS at the transport layer, and user authentication in applications. No single layer is enough. A firewall cannot tell which person is using a laptop, and an application login does nothing to stop an infected visitor phone scanning other devices nearby. Thinking in layers helps her see gaps where one control is assumed to cover something it cannot see.

Worked example

Priya traces a booking request and marks the four identifiers involved: hardware address, IP address, port 443 and the booking system's name.

Synthetic case. Systems and names are synthetic.

Errors and limits

Assuming one layer's control protects another layer leaves gaps, such as relying on logins to stop local network attacks.

Exercises

EX004 — Shared passphrase effect. What does one shared wireless passphrase mean for visitor phones and clinical carts? Rubric: 3 = same local network, able to reach each other, encryption protects only from outsiders;; 2 = same network;; 1 = mentions passwords only;; 0 = none.
EX005 — Identifier strength. Why is a hardware address a weak basis for trust? Rubric: 3 = software can change it, only meaningful locally;; 2 = can be changed;; 1 = says it is unique;; 0 = none.
EX006 — Layer gaps. Give one threat an application login does not address. Rubric: 3 = infected device scanning neighbours at network level;; 2 = network attacks;; 1 = vague;; 0 = none.

Synthesis

Layers explain how data moves and where each kind of control can act.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →