Chapter 31 — Network and communications security: advanced cases | Bachelor's Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 31 — Network and communications security: advanced cases

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Chains of small failures"]
  N2["31.2 Where layered controls help"]
  N3["31.3 Case: wireless bridge"]
  N4["31.4 Applying cases to the design"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Chains of small failures"]
  N2["31.2 Where layered controls help"]
  N3["31.3 Case: wireless bridge"]
  N4["31.4 Applying cases to the design"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Chains of small failures]
    |
    v
[31.2 Where layered controls help]
    |
    v
[31.3 Case: wireless bridge]
    |
    v
[31.4 Applying cases to the design]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) analyse complex, multi-factor cases; (2) trace chains of small failures; (3) propose layered fixes.

31.1 Chains of small failures

Serious incidents rarely have one cause. Priya studies a synthetic composite case in which a small charity suffered a data loss. A supplier's remote access account had a weak password; the server it reached sat on a flat network; logs were kept for only three days; and nobody reviewed them. Each weakness alone might have been survivable. Together they allowed an intruder to enter, move to a file server and copy data for two weeks before anyone noticed. She practises drawing the chain step by step and marking where any one control would have broken it.

31.2 Where layered controls help

For each link in the chain, Priya identifies a control: strong, individual supplier accounts would have stopped the first step; segmentation would have kept the remote access server away from the file server; central logs kept for ninety days would have preserved evidence; and a weekly review of unusual access would have shortened the time before detection. The lesson is that small organisations do not need perfect controls, but they do need several reasonable ones, because each breaks the chain at a different point.

31.3 Case: wireless bridge

A second composite case concerns a clinic-like practice where a staff member connected a small wireless router to a network port to improve signal in a back room. The router used a default passphrase and bridged its users directly onto the internal network, bypassing the firewall and guest separation entirely. Priya draws lessons for the clinics: monitor for unknown devices, disable unused network ports, provide good official coverage so staff have no reason to improvise, and explain to staff why such devices are dangerous.

31.4 Applying cases to the design

Priya checks her clinic design against both cases. The supplier lesson leads her to specify that any supplier access goes through the VPN with individual accounts and only to the supplier's own systems. The wireless bridge lesson adds a requirement for detecting unknown devices and a recommendation to survey wireless coverage before deployment. Comparing a design against concrete cases is a practical way to find gaps that abstract threat lists miss, because cases show how real people and systems behave.

Worked example

Priya's chain diagram for the charity case has four links; her design adds controls at each.

Synthetic case. Cases are synthetic composites.

Errors and limits

Focusing on the final step of an incident ignores earlier links where cheaper controls would have worked.

Exercises

EX091 — Chain link control. Which control breaks the chain at the movement-to-file-server step? Rubric: 3 = segmentation separating remote access server from file server;; 2 = segmentation;; 1 = logging;; 0 = none.
EX092 — Rogue router lesson. List two controls against staff-installed wireless routers. Rubric: 3 = detect unknown devices, disable unused ports, good coverage;; 2 = two;; 1 = one;; 0 = none.
EX093 — Supplier access design. How does the clinic design handle supplier access after this case? Rubric: 3 = via VPN, individual accounts, only to their systems;; 2 = VPN;; 1 = unchanged;; 0 = none.

Synthesis

Incidents are chains; layered reasonable controls break them at several points.

Continue studying — chapter 31 of 40

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →