Chapter 12 — Operating systems | Engineering Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Host networking"]
  N2["12.2 Host firewalls"]
  N3["12.3 Listening services"]
  N4["12.4 Management interfaces"]
  N5["Patching network-facing services"]
  N6["Logging on hosts"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Host networking"]
  N2["12.2 Host firewalls"]
  N3["12.3 Listening services"]
  N4["12.4 Management interfaces"]
  N5["Patching network-facing services"]
  N6["Logging on hosts"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Host networking]
    |
    v
[12.2 Host firewalls]
    |
    v
[12.3 Listening services]
    |
    v
[12.4 Management interfaces]
    |
    v
[Patching network-facing services]
    |
    v
[Logging on hosts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) understand host networking; (2) configure host firewalls; (3) secure network services on servers.

12.1 Host networking

Operating systems hold routing tables, interface settings and local firewall rules. Even within a segmented network, hosts should restrict inbound connections.

Every host has its own network configuration: addresses, routes, DNS servers and active interfaces. A laptop with both wired and wireless connections may bridge networks unexpectedly. Reviewing host configuration alongside network design ensures that hosts behave as the design assumes, and that a device placed in one zone does not quietly reach another through a second interface.

Engineers sample a few hosts per type to confirm this.

12.2 Host firewalls

Windows Defender Firewall and Linux nftables let hosts allow only needed services. Defence in depth means a misconfigured network rule is not the only barrier.

Host firewalls filter traffic on the device itself, adding protection even inside a zone. They are valuable because network firewalls usually do not see traffic between hosts in the same subnet. Engineers set a default that denies inbound connections except those the host's role needs, and manage the rules centrally so they stay consistent across many machines.

12.3 Listening services

Kofi reviews which services servers listen on, using exported reports from the council team, and compares with the protocol list.

A listening service is a program waiting for incoming connections. Every one is a potential entry point, so engineers inventory listening services on each host type, remove those not needed, and restrict the rest to the zones that must reach them. Comparing the inventory against the role of the host often reveals forgotten test services left running.

Repeating the inventory regularly catches new services.

12.4 Management interfaces

Management services such as SSH or remote desktop should listen only on management interfaces or accept connections only from the management zone.

Management interfaces of switches, firewalls and servers give full control of the device, so they deserve the strongest protection. Good practice puts them on a separate management network, reachable only from designated administration hosts, with strong authentication and logging of every session. Exposing them to ordinary staff or guest networks gives any compromised device a route to taking over infrastructure.

Patching network-facing services

Services that accept network connections are the most exposed part of a host. Kofi asks the council team for the update status of servers in the future server zone and finds two running an outdated file-sharing component. Segmentation reduces who can reach them, but does not remove the need to patch. He records them for the council's patching process and notes in his design that segmentation is a second line, not a substitute for keeping exposed services up to date, as NIST SP 800-40 Rev. 4 stresses.

Logging on hosts

Hosts record their own connection attempts and authentication events. These logs complement network logs: a firewall shows a connection was allowed, while the host shows whether a sign-in then succeeded. Kofi recommends forwarding key host logs from servers to the same central store as firewall logs, using syslog (RFC 5424) for Linux servers and the Windows event forwarding feature for Windows servers. Consistent time on hosts and network devices is essential so the two views line up during an investigation.

Worked example

A file server listening on remote desktop to all addresses is changed by the council team to accept it only from the management zone.

Synthetic case. Data are synthetic.

Errors and limits

Host firewalls disabled for troubleshooting are often never re-enabled; track such changes.

Exercises

EX034 — Defence in depth. Why keep host firewalls in a segmented network?
Show marking criteria
Rubric: 3 = backup if network rule fails;; 2 = layers;; 1 = vague;; 0 = none.
EX035 — Management restriction. Where should SSH be reachable from?
Show marking criteria
Rubric: 3 = management zone only;; 2 = restricted;; 1 = anywhere;; 0 = none.
EX036 — Troubleshooting risk. What risk does troubleshooting create for host firewalls?
Show marking criteria
Rubric: 3 = left disabled;; 2 = changes;; 1 = vague;; 0 = none.

Synthesis

Host controls complement network segmentation.

Continue studying — chapter 12 of 50

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →