Chapter 15 — Security fundamentals | Engineering Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 CIA in networks"]
  N2["15.2 Least privilege"]
  N3["15.3 Defence in depth"]
  N4["15.4 Threat categories"]
  N5["Attack surface"]
  N6["Trust boundaries"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 CIA in networks"]
  N2["15.2 Least privilege"]
  N3["15.3 Defence in depth"]
  N4["15.4 Threat categories"]
  N5["Attack surface"]
  N6["Trust boundaries"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 CIA in networks]
    |
    v
[15.2 Least privilege]
    |
    v
[15.3 Defence in depth]
    |
    v
[15.4 Threat categories]
    |
    v
[Attack surface]
    |
    v
[Trust boundaries]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) apply confidentiality, integrity and availability to networks; (2) use least privilege and defence in depth; (3) classify threats.

15.1 CIA in networks

Confidentiality: encrypt links and restrict access. Integrity: prevent tampering in transit, using protocols like TLS (RFC 8446) and IPsec (RFC 4301). Availability: redundancy and capacity.

Confidentiality, integrity and availability apply directly to networks. Confidentiality means traffic is not readable by those who should not see it, which is why links between offices are encrypted. Integrity means data and configuration are not altered without authority, so changes are controlled and logged. Availability means services can be reached when needed, which requires capacity and redundancy. A good design states which of the three each control supports.

15.2 Least privilege

Each zone gets only the flows it needs. Saltzer and Schroeder's principles apply directly to network policy.

Least privilege means each user, device and zone gets only the access it needs to do its job, and no more. In networks this becomes rules that allow specific flows between specific zones on specific services, rather than broad permissions. It limits the damage when something is compromised, because the attacker inherits only the narrow access of that device. Applying it requires knowing what access is actually needed, which is why flow inventories matter.

15.3 Defence in depth

Segmentation, host firewalls, encryption and monitoring combine so one failure is not fatal.

Defence in depth layers independent controls so that the failure of one does not expose everything. Network segmentation, host firewalls, strong authentication, monitoring and backups each address threats in different ways. If a guest device evades the wireless isolation, zone rules still block it from servers, and monitoring may still detect the attempt. The layers should fail independently; two controls relying on the same configuration file are less independent than they appear.

15.4 Threat categories

Kofi lists threats: malware spreading laterally, eavesdropping on inter-office links, misconfiguration and outages.

Grouping threats into broad categories helps engineers check designs systematically. Common categories include unauthorised access, interception of traffic, tampering with data or configuration, denial of service, and misuse by authorised people. For each category, the design should name the controls that reduce it and the evidence that they work. Categories are prompts for thinking, not a complete list, so engineers also consider threats specific to the organisation.

Attack surface

The attack surface of a network is the set of points where an unauthorised party could try to interact with systems. In a flat network, every device exposes its services to every other device, so the surface is large. Segmentation shrinks it by limiting which zones can reach which services. Kofi measures attack surface simply, as the number of permitted zone-service pairs, so that design options can be compared numerically, and he tracks how this number changes as the design develops.

Trust boundaries

A trust boundary is where data or connections pass between areas with different levels of trust, such as guest Wi-Fi and internal servers, or a council office and the internet. Controls concentrate at these boundaries. Kofi marks every boundary on his diagrams and lists the controls at each one: filtering, encryption, authentication and logging. Boundaries without controls become obvious, which is how he discovers that the CCTV supplier's remote maintenance connection currently enters the network without any filtering. The boundary list later becomes the starting point for the threat analysis and for choosing where firewalls are placed.

Worked example

For the guest incident, segmentation addresses lateral spread, and monitoring would have detected the attempts sooner.

Synthetic case. The incident is synthetic.

Errors and limits

Encryption alone does not stop lateral movement inside a network.

Exercises

EX043 — Integrity protocol. Name a protocol that protects integrity in transit.
Show marking criteria
Rubric: 3 = TLS or IPsec with RFC;; 2 = name;; 1 = vague;; 0 = none.
EX044 — Encryption limit. Why doesn't encryption stop lateral movement?
Show marking criteria
Rubric: 3 = controls content, not reachability;; 2 = different;; 1 = vague;; 0 = none.
EX045 — Threat list. List three network threats for the council.
Show marking criteria
Rubric: 3 = three;; 2 = two;; 1 = one;; 0 = none.

Synthesis

Core principles map directly onto network design choices.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →