◇ OpenCyber Academy
Bachelor's · Chapter 7 · English

Chapter 7 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Networks and protocols

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 DNS"]
  N2["7.2 HTTP and HTTPS"]
  N3["7.3 SMTP and headers"]
  N4["7.4 Ports and services"]
  N5["7.5 Time and addresses"]
  N6["7.6 Authentication results in practice"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 DNS"]
  N2["7.2 HTTP and HTTPS"]
  N3["7.3 SMTP and headers"]
  N4["7.4 Ports and services"]
  N5["7.5 Time and addresses"]
  N6["7.6 Authentication results in practice"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 DNS]
    |
    v
[7.2 HTTP and HTTPS]
    |
    v
[7.3 SMTP and headers]
    |
    v
[7.4 Ports and services]
    |
    v
[7.5 Time and addresses]
    |
    v
[7.6 Authentication results in practice]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain DNS, HTTP(S) and SMTP at the level CTI needs; (2) read email headers for sender clues; (3) understand why encrypted traffic limits visibility; (4) relate protocols to ATT&CK techniques.

7.1 DNS

The Domain Name System maps names to addresses. Resolver logs record which device asked for which name and when. Because almost every connection starts with a lookup, DNS is the most widely useful source for checking domain indicators.

Amara checks how long HCHT keeps resolver logs and whether they record the internal address of the device or only the address of a forwarding server, which would hide which workstation asked. Both facts decide whether a retrospective search for an HSSC domain can find the device that contacted it, and both are written into her notes on each source.

7.2 HTTP and HTTPS

Web traffic carries most user activity and much malicious command traffic. ATT&CK's Application Layer Protocol technique (T1071) describes adversaries blending into normal web, mail or DNS traffic. With HTTPS, a proxy may see only the server name, not the full path, unless traffic is inspected — a decision that has privacy and legal implications in a hospital.

HCHT's legal and privacy staff decided which categories of traffic may be inspected, and health-related sites used by staff for personal care are excluded. Amara works with what the proxy records under that decision, usually the server name and the time, and notes when an indicator cannot be checked because only the full path would reveal it.

7.3 SMTP and headers

Email headers record the path a message took: Received lines, the envelope sender and authentication results (SPF, DKIM, DMARC). A display name saying "HCHT Payroll" means nothing if authentication fails and the sending domain is a lookalike.

Amara learns to read the authentication results first, then the sending domain, and only then the display name, which is the easiest part for an attacker to fake. She compares lookalike domains in HSSC reports with HCHT's own domains to see which tricks are aimed at the trust.

7.4 Ports and services

Unusual ports or protocols can hint at tunnelling, but many legitimate medical systems use unusual ports too. Context from asset owners beats rules of thumb.

Amara asks the clinical engineering team which ports their devices use before treating any unusual port as suspicious. A list of known clinical ports, kept with the asset inventory, stops alerts from firing on normal imaging traffic and lets real anomalies stand out. Each entry records the device model and the owner who confirmed it.

7.5 Time and addresses

Network logs record times in different zones and addresses that may be translated by firewalls. Normalise times to UTC and note address translation before correlating with shared indicators.

Amara found that HCHT's proxy recorded local time while HSSC reports use UTC, which made a contact appear an hour before the domain was first seen. After normalising, the order made sense. She now records the time zone and any address translation for every log source in a short table, so other analysts can correlate events without rediscovering the same problems.

7.6 Authentication results in practice

SPF checks whether the sending server may send for the envelope domain; DKIM checks a signature over the message; DMARC ties them to the visible From domain and states the owner's policy. A message can pass SPF for a lookalike domain the attacker controls, so passing checks alone proves only who sent it, not that the sender is benign.

Amara adds this to her checklist for phishing reports. For every reported phishing message she records the three results and whether the visible domain is HCHT's own, a known partner's or a lookalike. That makes the pattern of spoofing visible over time.

Worked example

A ward manager forwards a suspicious "salary update" email. Amara reads the headers: the From domain is hcht-payrolI.example (capital I for l), SPF passes for that lookalike domain, and DMARC alignment fails against the real domain. She records the lookalike as a phishing indicator (T1566) and shares it with HSSC at TLP:GREEN after removing the staff recipient's address.

Synthetic case. The email and domains are invented.

Errors and limits

Headers before your own gateway can be forged. Inspection of encrypted traffic requires policy approval and staff notice.

Exercises

Synthesis

DNS, web and mail logs are the CTI analyst's main checkpoints; read headers critically and respect the limits of encrypted visibility.

Continue studying — chapter 07 of 40

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →