Chapter 11 — Networks and protocols | Engineering Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Networks and protocols

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Layers and packets"]
  N2["11.2 Protocol weaknesses"]
  N3["11.3 Name resolution"]
  N4["11.4 Segmentation"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Layers and packets"]
  N2["11.2 Protocol weaknesses"]
  N3["11.3 Name resolution"]
  N4["11.4 Segmentation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Layers and packets]
    |
    v
[11.2 Protocol weaknesses]
    |
    v
[11.3 Name resolution]
    |
    v
[11.4 Segmentation]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) explain how packets move between networks; (2) identify protocol weaknesses; (3) apply segmentation to limit attacks.

11.1 Layers and packets

Lindiwe studies how data cross Saltmarsh's network. Applications hand data to transport protocols, which hand packets to the network layer for routing between depots and head office. Each layer adds headers that devices read to decide where packets go. She captures synthetic traffic in a laboratory and identifies addresses, ports and protocols. Prof. Hale explains that attackers exploit the same layers, so understanding normal traffic is the first step towards recognising unusual traffic in Saltmarsh's monitoring tools. She labels each captured flow by depot and application.

11.2 Protocol weaknesses

Many older protocols were designed for trusted networks and send data unencrypted. Lindiwe finds that some depot printers are still managed over a protocol that sends passwords in clear text. Anyone capturing traffic on the same network segment could read them. She recommends switching to encrypted management or, where printers cannot support it, isolating them. She learns that protocol choice is a security decision, and that legacy devices often force compromises that must be documented and contained rather than ignored. The printer vendor confirms this.

11.3 Name resolution

The domain name system translates names into addresses. If an attacker can alter answers, users may connect to a fake server without noticing. Lindiwe reviews Saltmarsh's resolvers and confirms they forward only to approved upstream services and log queries. The logs help detect malware that contacts unusual domains. Prof. Hale notes that name resolution is a common route for both attack and detection, so its configuration deserves the same attention as firewalls, even though it often receives far less. She shares the resolver review with operations.

11.4 Segmentation

Saltmarsh's depots originally shared one flat network, so a compromised laptop could reach payroll servers directly. Lindiwe helps design segments: office devices, warehouse scanners, printers, servers and management interfaces, each with firewall rules allowing only necessary traffic between them. She estimates that segmentation removes most direct paths from depot laptops to sensitive servers. She learns that segmentation does not stop an attacker entering, but limits how far they move, which buys detection time and reduces damage. The network team schedules the first depot migration for the spring shutdown week.

Worked example

Lindiwe maps traffic by layer, flags clear-text printer management, reviews resolver logging and designs segments that cut direct paths from depot laptops to servers.

Synthetic case. Traffic and designs are synthetic.

Errors and limits

A flat network lets one compromised device reach everything.

Exercises

EX031 — Clear-text risk. What risk do the printers' management protocol pose? Rubric: 3 = passwords sent in clear text;; 2 = partly correct;; 1 = vague;; 0 = none.
EX032 — Resolver logs. What can resolver logs help detect? Rubric: 3 = malware contacting unusual domains;; 2 = partly correct;; 1 = vague;; 0 = none.
EX033 — Segmentation value. What does segmentation mainly limit? Rubric: 3 = how far attackers move;; 2 = partly correct;; 1 = entry;; 0 = none.

Continue studying — lesson 11 (chapter 11 of 50)

← Chapter 10 · Course chapter index · Chapter 12 →

Continue to the next authored lesson.