Chapter 1 — Network and communications security: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Why this course"]
N2["1.2 What network security protects"]
N3["1.3 How a small network works"]
N4["1.4 Threats to a small business"]
N5["1.5 Making decisions with limited time"]
N6["1.6 Guidance worth knowing"]
N7["1.7 The plan for the month"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Why this course"]
N2["1.2 What network security protects"]
N3["1.3 How a small network works"]
N4["1.4 Threats to a small business"]
N5["1.5 Making decisions with limited time"]
N6["1.6 Guidance worth knowing"]
N7["1.7 The plan for the month"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Why this course]
|
v
[1.2 What network security protects]
|
v
[1.3 How a small network works]
|
v
[1.4 Threats to a small business]
|
v
[1.5 Making decisions with limited time]
|
v
[1.6 Guidance worth knowing]
|
v
[1.7 The plan for the month]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what network security protects; (2) describe a small business network; (3) make first decisions with limited time.
1.1 Why this course
Leo Hart works in the office of a small business and joins a one-month rapid course at the fictional Quayside Skills Centre to learn the basics of network security. His coach is Nadia Petrov. The course uses one running example: the fictional Bramble Street Bakery, a single shop with a café, card payments, an office computer, two tills, online orders and free Wi-Fi for customers. The owner, Ellen, asked Leo to help because nobody at the bakery knows much about networks. Every lab uses synthetic data, and any change to the bakery's equipment is made only with Ellen's agreement.
1.2 What network security protects
Network security protects the information that travels between devices and the devices that send and receive it. At the bakery, that includes card payments between the reader and the bank, orders arriving from the website, the owner's email and accounts on the office computer, and the café Wi-Fi that customers use. The three goals are confidentiality, so customer and payment details stay private; integrity, so orders and accounts are not changed; and availability, so tills and card payments work during opening hours. Leo learns to judge every decision against these three goals.
1.3 How a small network works
The bakery has one router supplied by its internet provider. The router connects to the internet, gives out addresses to devices using DHCP, provides Wi-Fi and protects the shop from unrequested traffic from outside. All devices share one local network: tills, card reader, office computer, the owner's phone and every customer phone on the café Wi-Fi. Leo draws this on one page. The drawing shows the main weakness straight away: customers' phones share a network with the tills and the office computer, so nothing stops them reaching each other.
1.4 Threats to a small business
Small businesses face common threats. A customer's infected phone might try to reach other devices on the same network. Someone might guess the router's administrator password if it is still the factory default. A phishing email might trick the owner into entering a password on a fake page. Old router firmware might have known weaknesses. Leo notes that small businesses are rarely targeted individually; most harm comes from automated attacks and opportunistic misuse, which simple controls stop. This shapes his priorities towards basic, cheap, effective steps.
1.5 Making decisions with limited time
Ellen has little time and a small budget, so Leo learns to make decisions in order of value. He asks three questions for each possible step: how much harm does it prevent, how much does it cost in money and time, and could it disrupt the shop? Separating customer Wi-Fi from business devices prevents a lot of harm, costs nothing on most routers and can be done after closing. Buying a new firewall costs more and takes longer. Starting with high-value, low-cost steps delivers most of the benefit quickly.
1.6 Guidance worth knowing
Leo learns that good guidance exists even for small organisations. The CIS Controls list prioritised safeguards, starting with knowing which devices you have. NIST SP 800-153 explains how to secure wireless networks, including keeping guest networks separate. NIST SP 800-41r1 explains firewall policy, including the idea of denying traffic by default. Leo does not need to read them in full during the course, but he learns to cite them when explaining to Ellen why a step matters, which makes his advice more convincing than personal opinion.
1.7 The plan for the month
Nadia and Leo agree a plan: in week one, understand the network and decide priorities; in week two, agree scope and permission with Ellen; in week three, list devices and dependencies; in week four, check the router against a checklist, make agreed changes and write a short report. Each week ends with a short review. Writing the plan down keeps the work focused and gives Ellen a clear idea of what will happen and when she needs to be involved.
Worked example
Leo's one-page drawing shows tills, card reader, office computer and customer phones on one network, and his first priority is separating customer Wi-Fi.
Synthetic case. The bakery and all data are synthetic.
Errors and limits
Spending the first week researching expensive products delays cheap steps that would remove most risk.
Exercises
- EX001 — Bakery assets. Name three things network security protects at the bakery. Rubric: 3 = card payments, orders, accounts or Wi-Fi;; 2 = two;; 1 = one;; 0 = none.
- EX002 — Main weakness. What weakness does the one-page drawing reveal? Rubric: 3 = customer phones share network with tills and office PC;; 2 = shared network;; 1 = vague;; 0 = none.
- EX003 — Goal for tills. Which security goal matters most for tills during opening hours? Rubric: 3 = availability, so sales and payments keep working;; 2 = availability, without explanation;; 1 = confidentiality;; 0 = none.
- EX004 — Opportunistic threats. Why are basic controls effective for small businesses? Rubric: 3 = most harm from automated, opportunistic attacks;; 2 = automated;; 1 = not targeted;; 0 = none.
- EX005 — Decision questions. List Leo's three questions for each step. Rubric: 3 = harm prevented, cost, disruption;; 2 = two;; 1 = one;; 0 = none.
- EX006 — First step choice. Why separate customer Wi-Fi first? Rubric: 3 = high value, low cost, low disruption;; 2 = cheap and effective;; 1 = required;; 0 = none.
- EX007 — Default password threat. Why is a factory-default router password dangerous? Rubric: 3 = easily guessed, gives control of router;; 2 = guessable;; 1 = vague;; 0 = none.
- EX008 — Firewall guidance. Which publication explains default-deny firewall policy? Rubric: 3 = NIST SP 800-41r1;; 2 = 800-41r1;; 1 = other;; 0 = none.
- EX009 — Wireless guidance. Which publication covers securing wireless networks? Rubric: 3 = NIST SP 800-153;; 2 = 800-153;; 1 = other;; 0 = none.
- EX010 — Inventory first. What do the CIS Controls start with? Rubric: 3 = knowing which devices you have;; 2 = inventory;; 1 = passwords;; 0 = none.
- EX011 — Week two task. What happens in week two of the plan? Rubric: 3 = agree scope and permission with Ellen;; 2 = permission;; 1 = changes;; 0 = none.
- EX012 — Router roles. Name three jobs the bakery router performs. Rubric: 3 = internet connection, DHCP, Wi-Fi or blocking outside traffic;; 2 = two;; 1 = one;; 0 = none.
- EX013 — Integrity example. Give an integrity concern at the bakery. Rubric: 3 = orders or accounts changed;; 2 = changed data;; 1 = generic;; 0 = none.
Synthesis
Understanding what the network protects and choosing high-value, low-cost steps first is the foundation of practical security.