◇ OpenCyber Academy
Engineering · Chapter 31 · English

Chapter 31 — Network and communications security: implementation II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 31 — Network and communications security: implementation II

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 VPN rollout"]
  N2["31.2 Remaining offices"]
  N3["31.3 Supplier access"]
  N4["31.4 Communication"]
  N5["Certificate management in practice"]
  N6["Migration timeline"]
  N7["Supplier transition"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 VPN rollout"]
  N2["31.2 Remaining offices"]
  N3["31.3 Supplier access"]
  N4["31.4 Communication"]
  N5["Certificate management in practice"]
  N6["Migration timeline"]
  N7["Supplier transition"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 VPN rollout]
    |
    v
[31.2 Remaining offices]
    |
    v
[31.3 Supplier access]
    |
    v
[31.4 Communication]
    |
    v
[Certificate management in practice]
    |
    v
[Migration timeline]
    |
    v
[Supplier transition]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) implement inter-office VPNs; (2) migrate remaining offices; (3) control supplier access.

31.1 VPN rollout

Site-to-site IPsec tunnels with IKEv2 and certificates are configured between each branch and the main office, following SP 800-77 Rev. 1.

Site-to-site VPN links replace unprotected links between offices one by one. Each is configured from the template, tested in the lab, then deployed in a maintenance window with rollback ready, and traffic is checked afterwards.

Before each link goes live, Kofi confirms both ends use matching settings, certificates are valid, and monitoring shows the tunnel status. Afterwards, he checks that traffic between offices flows through the tunnel rather than the old path, and records the result as evidence.

31.2 Remaining offices

Remaining offices migrate using the pilot method.

Once the pilot succeeds, the remaining offices follow in planned order, usually starting with smaller sites where problems affect fewer people. Each office gets the same checklist: confirm local flows, deploy rules in monitor mode, review findings, enforce, and verify. Keeping the process identical across sites makes problems easier to spot, because any difference in outcome points to something particular to that office rather than to the method.

Progress is tracked on a simple shared schedule.

31.3 Supplier access

The CCTV supplier's appliance is removed; the supplier connects via the jump host with named, time-limited accounts.

Suppliers who maintain council systems need remote access, but only to their own systems. Engineers give each supplier an individual account, restrict access to specific hosts and services, require multi-factor authentication, log sessions, and enable access only when needed. Access is reviewed regularly and removed when a contract ends.

Supplier sessions are recorded where contracts permit, so actions can be reviewed after an incident. Contracts should also state security expectations, such as reporting breaches promptly and protecting credentials.

31.4 Communication

Office managers receive notices before each migration.

Staff need to know what is changing, when, and what to do if something stops working. Kofi helps the council send short notices before each office's change, naming the date, the expected effect, and a contact for problems. After the change, a brief follow-up confirms completion. Clear communication reduces the number of support calls, helps staff report genuine problems quickly, and builds trust in the security programme rather than resentment of it.

Feedback channels stay open afterwards.

Certificate management in practice

Each firewall's certificate is issued by the council's internal certificate authority with a two-year lifetime and stored on the device. Kofi documents the issuance and renewal steps and adds every certificate to the expiry monitoring. He also tests revocation in the lab: when a branch firewall's certificate is revoked, the main office refuses its tunnel, as intended. This confirms that a stolen branch device could be cut off quickly, which was one of the threats identified in chapter 23. Renewal steps are rehearsed in the lab once a year so engineers remember them.

Migration timeline

The remaining seven offices are migrated at a pace of roughly one every three weeks, allowing two weeks of observation after each. Larger offices take two migration windows, splitting staff and voice from cameras and guest. The timeline is published to office managers with dates, so they can plan around the short disruptions. Two migrations are moved for local events, which the schedule absorbs without affecting the overall finish. After each migration, a short note records issues found and lessons for the next office.

Supplier transition

Before removing the supplier's appliance, Kofi and the council agree a transition plan with the CCTV supplier: their engineers receive named accounts, test access through the jump host during a maintenance window and confirm they can perform routine tasks. Only then is the appliance removed. The supplier's contract is updated to reflect the new access method and the requirement to request access windows, which turns a security change into an agreed working practice. Supplier access through the jump host is logged and reviewed monthly by the council engineers.

Worked example

All eight offices migrate within five months.

Synthetic case. Events are synthetic.

Errors and limits

Removing supplier access abruptly can break maintenance contracts; agree changes first.

Exercises

Synthesis

Implementation completes segmentation and secures links and supplier access.

Continue studying — chapter 31 of 50

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →