Chapter 7 — Networks and protocols
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Office network"]
N2["7.2 Home working"]
N3["7.3 Protocols"]
N4["7.4 Firewalls"]
N5["7.5 Segmentation"]
N6["VPN and updates"]
N7["Applying it"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Office network"]
N2["7.2 Home working"]
N3["7.3 Protocols"]
N4["7.4 Firewalls"]
N5["7.5 Segmentation"]
N6["VPN and updates"]
N7["Applying it"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 Office network]
|
v
[7.2 Home working]
|
v
[7.3 Protocols]
|
v
[7.4 Firewalls]
|
v
[7.5 Segmentation]
|
v
[VPN and updates]
|
v
[Applying it]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) describe office and home networks used by staff laptops; (2) explain VPNs and protocols; (3) identify network-related endpoint risks.
7.1 Office network
Bramley's office has a router, switch and Wi-Fi. Laptops, printers and servers share one network.
Because everything shares one flat network, a laptop infected at the office could reach the finance server as easily as the printer. Aisha draws the network on one page: the router to the internet, one switch, the Wi-Fi access point and the four servers in the cupboard. She marks where laptops connect and notes that guests and volunteers use the same Wi-Fi as staff. The contractor reaches the servers from outside through the same router, which Aisha marks on the drawing as a separate entry point with its own account.
7.2 Home working
Many staff work from home, connecting through a VPN to reach the file server. Laptops at home may be off the office network for weeks, which affects updates and management.
Gareth's console shows the effect clearly: 11 laptops have not been on the office network for more than 30 days. Those laptops receive settings and updates only while the VPN is connected, which some staff do only when they need a shared file. Aisha records home working as a design condition for every later control, not as an exception to it.
7.3 Protocols
Laptops use HTTPS for web, SMB for file shares and DNS for names. Old SMB version 1 should be disabled, as CIS Benchmarks and Microsoft baselines advise.
Aisha checks the file server and finds that SMB version 1 is still enabled, left over from an old network scanner that has since been replaced. Disabling it is added to the server hardening list, with a note to confirm that no remaining device still depends on it. HTTPS and DNS need no change, but she records which laptops use the office DNS server.
7.4 Firewalls
The laptop firewall blocks unexpected incoming connections, protecting it on public Wi-Fi.
Aisha's baseline check later finds the firewall turned off on only one of the 45 laptops, the smallest gap in the fleet. She still treats the setting as essential, because home and café networks are outside Bramley's control. The firewall is set centrally from the management server, so staff cannot switch it off without administrator rights. Aisha checks that the public profile is the default for any network the laptop does not recognise, so a café or hotel network is never treated as trusted by mistake.
7.5 Segmentation
Servers could sit on their own segment, with access only from laptops that need them.
Aisha notes segmentation as a later step rather than an immediate change, because Bramley's router and switch would need reconfiguring by the contractor. A first segment would separate the four servers from staff laptops, allowing only file sharing, sign-in and management traffic through. The idea returns in chapter 31, when the old application server is isolated on its own segment. Until then, Aisha relies on the controls already on each laptop: standard accounts, the firewall and encryption, which work whichever segment a laptop sits on.
VPN and updates
Updates and settings reach home laptops only when the VPN connects, unless the management service works over the internet. Aisha investigates both options with Gareth. Bramley's management tool supports internet-based management, which removes the dependency on the VPN for updates. Gareth enables it for a test group of five home workers, and their update latency improves the next month.
Aisha records this as an early, small change with a measured effect.
Applying it
Gareth tries the idea on a test laptop first, recording each setting changed and its effect on staff tasks. Only after a week without problems does it go into the shared baseline, with a note explaining why.
Worked example
Aisha checks which laptops last connected to the office network more than 30 days ago: 11. These are mostly home workers whose updates come only when the VPN is on. This becomes an input for patching design.
Synthetic case. Synthetic.
Errors and limits
Assuming all laptops are on the office network misses home workers.
Exercises
- EX019 — Home effect. How does home working affect management? Rubric: 3 = off network for weeks, updates delayed; 2 = partial; 1 = vague; 0 = none.
- EX020 — SMB1. What do baselines say about SMB1? Rubric: 3 = disable; 2 = partial; 1 = vague; 0 = none.
- EX021 — Count. How many laptops had not connected for 30 days? Rubric: 3 = 11; 2 = partial; 1 = vague; 0 = none.
Synthesis
Endpoint management must work wherever laptops are.
Continue studying — chapter 07 of 40
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →