Chapter 11 — Networks and protocols
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Branch networks"]
N2["11.2 Segmentation"]
N3["11.3 Old protocols"]
N4["11.4 Management traffic"]
N5["11.5 Logging"]
N6["Name resolution and filtering"]
N7["Testing segmentation"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Branch networks"]
N2["11.2 Segmentation"]
N3["11.3 Old protocols"]
N4["11.4 Management traffic"]
N5["11.5 Logging"]
N6["Name resolution and filtering"]
N7["Testing segmentation"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Branch networks]
|
v
[11.2 Segmentation]
|
v
[11.3 Old protocols]
|
v
[11.4 Management traffic]
|
v
[11.5 Logging]
|
v
[Name resolution and filtering]
|
v
[Testing segmentation]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) describe the networks public PCs use; (2) explain segmentation and common protocols; (3) identify network-related endpoint risks.
11.1 Branch networks
Each Fernhill branch has a switch connecting public PCs, staff laptops, printers and a router to the internet. Public PCs use DNS, HTTPS for browsing and a print protocol to reach the print server.
Mateo drew each branch's layout from the supplier's documents and walked the rooms to check them. At Eastgate he found a printer that staff had moved and reconnected to a different port. Knowing which protocols the public PCs actually need is the starting point for the firewall rules, since anything not on the list can be blocked.
11.2 Segmentation
Placing public PCs on their own network segment, with firewall rules allowing only internet, printing and the management server, prevents them from reaching staff devices. This answers the design question from chapter 2.
Mateo writes the allowed flows as a short table: destination, protocol and reason. Anything not in the table is denied. The supplier configures the rules from the table, and the test report checks each line. If a librarian later needs a new flow, such as a ticket printer, it is added to the table with a reason before the rule changes.
11.3 Old protocols
SMB version 1, an old file-sharing protocol, has known weaknesses and should be disabled on all endpoints, as baselines from CIS and Microsoft recommend.
Mateo checked the image and found the old protocol still enabled for a scanner that nobody had used in years. Removing it caused no complaints. He adds a test to the release checklist that confirms the protocol is off, because an update or a hurried fix could switch it back on without anyone noticing. Disabling old protocols reduces what an attacker on the same network could use, even inside a segmented branch.
11.4 Management traffic
The restore and update system needs a management connection from each PC to a central server. This traffic must be authenticated and encrypted.
Mateo's design has each PC connect out to the management server rather than the server reaching into the public segment, which keeps the firewall rules simple. The connection uses certificates, so a PC accepts instructions only from Fernhill's server and the server accepts reports only from enrolled PCs. If the server cannot be reached, the PC keeps its current image and reports the failure the next time it connects.
11.5 Logging
Network devices can log connections, helping detect if a public PC tries to reach unexpected addresses.
Mateo asks the supplier to send firewall logs for the public segment to Fernhill's central log store. Most entries will be ordinary browsing, which he does not examine. What he looks for is denied attempts to reach internal addresses, which would show a PC trying to cross the segment boundary. The logs record addresses and times only, consistent with the project's rule against recording patrons' activity.
Name resolution and filtering
Fernhill uses a DNS filtering service that blocks known malicious domains for public PCs. This reduces risk from downloads but cannot block everything. The design therefore relies on endpoint controls too: application control blocks unapproved programs even if they are downloaded.
Testing segmentation
After Eastgate's change, Mateo confirms with the network supplier's test report that public PCs can reach the internet, print server and management server, and cannot reach staff laptops. The report is stored as evidence for requirement verification later.
Worked example
Mateo proposes a public PC segment at each branch. Marta checks with the network supplier, who confirms the switches support separate segments. At Eastgate, staff laptops are moved to their own segment within a week.
Synthetic case. Synthetic.
Errors and limits
Segmentation reduces exposure but does not protect a PC from threats arriving through allowed traffic, such as web downloads.
Exercises
- EX031 — Allowed traffic. Which traffic should public PCs be allowed? Rubric: 3 = internet, printing, management; 2 = two; 1 = one; 0 = none.
- EX032 — Management link. What must protect management traffic? Rubric: 3 = authentication and encryption; 2 = partial; 1 = vague; 0 = none.
- EX033 — Segmentation limit. What can segmentation not prevent? Rubric: 3 = threats through allowed traffic; 2 = partial; 1 = vague; 0 = none.
Synthesis
Segment public PCs and allow only needed traffic.
Continue studying — chapter 11 of 50
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →