Chapter 4 — Network and communications security: core methods | Professional Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Network and communications security: core methods

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Design review"]
  N2["4.2 Needed flows"]
  N3["4.3 Rule review"]
  N4["4.4 Remote access"]
  N5["4.5 Presenting the review"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Design review"]
  N2["4.2 Needed flows"]
  N3["4.3 Rule review"]
  N4["4.4 Remote access"]
  N5["4.5 Presenting the review"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Design review]
    |
    v
[4.2 Needed flows]
    |
    v
[4.3 Rule review]
    |
    v
[4.4 Remote access]
    |
    v
[4.5 Presenting the review]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) review a network design; (2) check rules against needed flows; (3) assess remote access.

4.1 Design review

Grace reviews Oakline's network design. Each office has staff, printers, servers (main office only), guest and management networks, separated by the office firewall. The design is sound in principle, but she checks details: whether guest networks are truly isolated, whether management interfaces are reachable only from IT workstations and whether rules between networks match needs. Reviews compare the design with good practice and with what is actually configured, since the two often differ over time. She also asks the IT team which parts of the design they find hardest to run, since operational difficulty often predicts future drift.

4.2 Needed flows

Grace and Priyanka list the flows Oakline needs between networks: staff to document and practice management systems, staff to printers, remote lawyers to the same systems via VPN, servers to update services and IT workstations to management interfaces. Anything else between internal networks should be denied, following the default-deny approach in NIST SP 800-41r1. The list is short, and each entry has an owner. This list is the yardstick for reviewing the rules. Priyanka confirms each owner, and any flow without a willing owner is questioned before it is allowed to stay.

4.3 Rule review

Comparing rules with the list, Grace finds three issues. A rule allows any staff device to reach the server management network, added once for a project. A rule allows guest wireless at one office to reach printers, explaining the gap seen earlier. A temporary rule for a supplier, added a year ago, has no expiry. She recommends removing the first two and setting an expiry or removing the third after asking its owner. Each issue is tied to evidence from the exported configuration.

4.4 Remote access

Lawyers work from home, client sites and court. Grace reviews the VPN: it uses IKEv2 with certificates for the site-to-site links, but remote access uses passwords only, without a second factor. She recommends multi-factor authentication for remote access, consistent with the insurer's request and widely recommended practice, and restricting remote users to the systems they need. She also checks that the VPN gateway's TLS settings for its web portal follow SP 800-52r2. She also checks that remote sessions time out after inactivity, so unattended laptops at court do not stay connected.

4.5 Presenting the review

Grace presents her review as a short table: finding, evidence, risk, recommendation and owner. She leads with the two highest risks: guest access to printers and remote access without a second factor. She acknowledges strengths, such as the sound zone structure and certificate-based site links. Balanced reviews are easier to accept than lists of faults, and they show the IT team that the reviewer understands what they have done well. She sends the table to Priyanka a day before the meeting, so questions can be prepared and the meeting spent on decisions rather than reading.

Worked example

The review finds three rule issues and one remote access gap, each with evidence and an owner.

Synthetic case. Configurations are synthetic.

Errors and limits

Reviewing only the design document without the actual configuration misses drift.

Exercises

EX016 — Review comparison. What two things does a design review compare? Rubric: 3 = design with good practice and with actual configuration;; 2 = both;; 1 = one;; 0 = none.
EX017 — Rule issues. List the three rule issues found. Rubric: 3 = staff to server management, guest to printers, supplier rule without expiry;; 2 = two;; 1 = one;; 0 = none.
EX018 — Remote access gap. What remote access gap did Grace find? Rubric: 3 = passwords only, no second factor;; 2 = no MFA;; 1 = vague;; 0 = none.
EX019 — Review table columns. List the review table's columns. Rubric: 3 = finding, evidence, risk, recommendation, owner;; 2 = four;; 1 = fewer;; 0 = none.
EX020 — Acknowledging strengths. Why include strengths in the review? Rubric: 3 = easier acceptance, shows understanding;; 2 = balance;; 1 = politeness;; 0 = none.

Synthesis

Comparing design, configuration and needed flows finds real gaps and supports balanced recommendations.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →