Chapter 7 — Networks and protocols
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 How Fernway connects"]
N2["7.2 DNS, HTTP and TLS in a shop"]
N3["7.3 Small-organisation weaknesses"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 How Fernway connects"]
N2["7.2 DNS, HTTP and TLS in a shop"]
N3["7.3 Small-organisation weaknesses"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 How Fernway connects]
|
v
[7.2 DNS, HTTP and TLS in a shop]
|
v
[7.3 Small-organisation weaknesses]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) describe how Fernway's shop, stores and warehouse connect; (2) explain DNS, HTTP and TLS roles in an online shop; (3) identify network design weaknesses in a small organisation.
7.1 How Fernway connects
Lucas maps Fernway's network. Customers reach the shop over the internet; the shop runs on a cloud host. Stores connect to head office through broadband links with a site-to-site VPN. The warehouse has its own wireless network for scanners. Staff use cloud email and a file service. He labels each connection with its protocol and encryption, and notes which traffic crosses the public internet. The map shows that the warehouse wireless network and the office network are bridged, so a scanner and a finance laptop sit on the same segment.
7.2 DNS, HTTP and TLS in a shop
When a customer visits the shop, DNS translates the name into an address, the browser opens a TLS connection specified in RFC 8446 and then sends HTTP requests. Lucas learns that compromise of Fernway's DNS account would let an attacker redirect customers to a fake shop, which could obtain its own certificate for a look-alike name but not for Fernway's name unless it also controlled the DNS used for certificate validation. He therefore recommends strong authentication on the domain registrar account, an asset often forgotten in architecture reviews because it sits outside the technical estate.
7.3 Small-organisation weaknesses
Lucas lists network weaknesses typical of small organisations, all present at Fernway: the bridged warehouse and office networks, a shared Wi-Fi password unchanged for years, remote desktop exposed to the internet for a supplier and no record of firewall rule owners. He proposes simple fixes: separate networks for scanners, guests and staff; replace exposed remote desktop with a managed remote-access service using multi-factor authentication; and annotate firewall rules with owners and review dates. Each fix is cheap compared with the impact of the weakness it removes.
Worked example
Lucas maps Fernway's connections, recommends registrar account protection and proposes three network fixes including separating the bridged warehouse and office segments.
Synthetic case. Fernway's network is synthetic; RFC 8446 is real.
Errors and limits
Separating networks can break undocumented dependencies; test first. Cloud services may bypass the office network entirely.
Exercises
- EX019 — Bridged networks. What risk does the bridged warehouse and office network create? Rubric: 3 = a compromised scanner can reach finance laptops directly;; 2 = reach;; 1 = vague;; 0 = none.
- EX020 — Registrar account. Why protect the domain registrar account strongly? Rubric: 3 = its compromise lets an attacker redirect customers and possibly obtain certificates;; 2 = redirect;; 1 = not important;; 0 = none.
- EX021 — Remote desktop fix. What should replace internet-exposed remote desktop for the supplier? Rubric: 3 = a managed remote-access service with multi-factor authentication;; 2 = managed MFA;; 1 = leave it;; 0 = none.
Synthesis
Network architecture for a small organisation starts with an honest map and simple separations that remove large risks cheaply.
Continue studying — chapter 07 of 40
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →