Chapter 26 — Network and communications security: methods II | Bachelor's Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 26 — Network and communications security: methods II

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Planning wireless networks"]
  N2["26.2 Guest isolation"]
  N3["26.3 Remote staff access"]
  N4["26.4 Linking the clinics"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Planning wireless networks"]
  N2["26.2 Guest isolation"]
  N3["26.3 Remote staff access"]
  N4["26.4 Linking the clinics"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Planning wireless networks]
    |
    v
[26.2 Guest isolation]
    |
    v
[26.3 Remote staff access]
    |
    v
[26.4 Linking the clinics]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) plan secure wireless; (2) design remote access; (3) choose protocols for inter-site links.

26.1 Planning wireless networks

Wireless needs special care because its signal crosses walls into car parks and neighbouring buildings. Following NIST SP 800-153, Priya plans separate wireless networks for staff, clinical devices and guests, each linked to its own group and subnet. Staff wireless uses individual accounts; clinical wireless uses device certificates where supported; guest wireless uses a simple passphrase changed monthly and gives internet access only. Access point management interfaces sit in the management zone and are never reachable from the wireless networks they serve.

26.2 Guest isolation

On the guest network, devices should not be able to reach each other, because one infected phone could otherwise attack others in the waiting room. Most access points offer client isolation, which forwards guest traffic only to the internet gateway. Priya adds this to the design and to the test list. She also limits guest bandwidth so heavy use cannot slow clinical traffic sharing the same internet link, which protects availability as well as confidentiality. The isolation test sends traffic between two guest test devices and expects it to fail, while confirming both still reach the internet.

26.3 Remote staff access

Some staff work from home and need the booking system and clinic files. Priya compares options: exposing services directly to the internet, which increases attack surface; or a VPN that authenticates staff and encrypts traffic before it reaches clinic systems. She chooses a VPN with individual accounts and a second factor. NIST SP 800-77r1 describes IPsec VPN design, and SP 800-52r2 covers TLS where a TLS-based VPN is used. VPN users land in a restricted group that reaches only the services they need.

26.4 Linking the clinics

The four clinics connect over the internet. Traffic between them, such as clinical carts at a branch reaching the lab results server at the main clinic, must be protected in transit. Priya proposes site-to-site IPsec tunnels between clinic firewalls, using IKEv2 as specified in RFC 7296, with certificates rather than shared keys so a stolen device's credentials can be revoked individually. Only needed flows are allowed through the tunnels, so a problem at one clinic does not automatically spread to the others.

Worked example

Priya's design adds three wireless networks per clinic, client isolation for guests, a VPN for remote staff and IKEv2 tunnels between clinics.

Synthetic case. The design is synthetic.

Errors and limits

VPN users given full network access recreate a flat network from outside.

Exercises

EX076 — Client isolation purpose. What does client isolation protect against on guest wireless? Rubric: 3 = infected guest attacking other guests;; 2 = guest-to-guest;; 1 = outsiders;; 0 = none.
EX077 — VPN landing zone. Why place VPN users in a restricted group? Rubric: 3 = avoid full access, limit reach to needed services;; 2 = limit;; 1 = convenience;; 0 = none.
EX078 — Tunnel authentication. Why use certificates instead of shared keys for clinic tunnels? Rubric: 3 = revoke individually if a device is stolen;; 2 = revocation;; 1 = stronger;; 0 = none.

Synthesis

Separate wireless networks, guest isolation, restricted VPN access and protected inter-site links extend segmentation beyond one building.

Continue studying — chapter 26 of 40

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →