Chapter 3 — Network and communications security: systems, data and dependencies
Lesson map
Lesson 03 published. Map, example, EX027.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Knowing your devices"]
N2["3.2 What the router knows"]
N3["Lab — Unknown devices"]
N4["3.3 Reading the result"]
N5["3.4 Dependencies"]
N6["3.5 Where data goes"]
N7["3.6 Keeping the list current"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX027"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Knowing your devices"]
N2["3.2 What the router knows"]
N3["Lab — Unknown devices"]
N4["3.3 Reading the result"]
N5["3.4 Dependencies"]
N6["3.5 Where data goes"]
N7["3.6 Keeping the list current"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX027"]
[Learning outcomes]
|
v
[3.1 Knowing your devices]
|
v
[3.2 What the router knows]
|
v
[Lab — Unknown devices]
|
v
[3.3 Reading the result]
|
v
[3.4 Dependencies]
|
v
[3.5 Where data goes]
|
v
[3.6 Keeping the list current]
|
v
[Worked example] --> [Exercise EX027]
Learning outcomes
You will (1) list devices and dependencies; (2) find unknown devices; (3) understand which services the business relies on.
3.1 Knowing your devices
You cannot protect devices you do not know about. Leo's first technical task is a device list for the bakery: each device's name, purpose, owner, how it connects and its hardware address. He starts with what Ellen knows: two tills, the card reader, the office computer and her phone. Then he compares this with what the router sees. The CIS Controls put inventory of devices first for this reason; every later step, such as deciding what may connect where, depends on it.
3.2 What the router knows
The router keeps a list of devices it has given addresses to, called DHCP leases. Each lease shows a hardware address and the address given. With Ellen's permission, Leo exports this list after closing, when customer phones have left. Comparing the leases with the known list shows any devices nobody accounted for. Leo uses synthetic data in the lab exercise below to practise the comparison before doing it with the real export, so mistakes in his method do not affect the real check.
Lab — Unknown devices
"""Compare a synthetic device list with synthetic router DHCP leases to find unknown devices (stdlib only)."""
known = {"aa:01": "till-1", "aa:02": "till-2", "aa:03": "office-pc", "aa:04": "card-reader", "aa:05": "owner-phone"}
leases = [("aa:01", "192.168.1.10"), ("aa:02", "192.168.1.11"), ("aa:03", "192.168.1.20"), ("aa:05", "192.168.1.30"),
("bb:77", "192.168.1.41"), ("aa:04", "192.168.1.12"), ("cc:19", "192.168.1.42")]
seen = {m for m, _ in leases}
for m, ip in leases: print(f"{m} {ip:14}{known.get(m, 'UNKNOWN')}")
print("unknown:", sorted(seen - set(known)), " known but not seen:", sorted(set(known) - seen))
Run with python3 lab_leases.py. Verified output:
aa:01 192.168.1.10 till-1
aa:02 192.168.1.11 till-2
aa:03 192.168.1.20 office-pc
aa:05 192.168.1.30 owner-phone
bb:77 192.168.1.41 UNKNOWN
aa:04 192.168.1.12 card-reader
cc:19 192.168.1.42 UNKNOWN
unknown: ['bb:77', 'cc:19'] known but not seen: []
3.3 Reading the result
In the synthetic data, all five known devices appear, and two unknown devices hold addresses even after closing. Leo writes them down and asks Ellen, following his stop-and-ask rule. One turns out to be a smart speaker a staff member connected to play music; the other is a delivery company's handheld scanner left on charge. Neither is harmful in itself, but both share the network with the tills. Leo recommends moving them to a separate network for non-business devices, such as the guest network once it is isolated.
3.4 Dependencies
Leo lists what the bakery depends on to trade: the internet connection for card payments and online orders, the router for Wi-Fi and addresses, the payment provider's service, the website and order platform hosted by a supplier, and email for supplier orders. For each, he notes what happens if it fails. If the internet fails, the card reader may still take some payments offline, depending on the provider, but online orders stop. Knowing dependencies helps Ellen plan, such as keeping a mobile data backup for the card reader.
3.5 Where data goes
Leo also notes where important data travels. Card payment data goes from the reader straight to the payment provider, encrypted, and never touches the office computer. Online orders arrive by email and through the order platform's website, which uses HTTPS. Accounts stay on the office computer and a cloud backup. Understanding data flows shows what needs most protection: the office computer, the email account and the order platform login, because they hold or control business and customer information. Leo marks these three on his drawing in a different colour.
3.6 Keeping the list current
A device list goes stale quickly as phones are replaced and staff change. Leo suggests Ellen checks the router's device list once a month after closing, comparing it with the known list, and asks about anything new. He leaves a simple printed table for this. The check takes five minutes. Keeping the list current is the cheapest way to notice unexpected devices, and it keeps the foundation for every other control accurate over time. Ellen adds the date and her initials each time she completes the check.
Worked example
The synthetic lease check finds two unknown devices, later identified as a smart speaker and a delivery scanner, both recommended for a separate network.
Synthetic case. Devices and leases are synthetic.
Errors and limits
Assuming every connected device is known misses equipment added by staff or visitors.
Exercises
- EX027 — Unknown count. How many unknown devices does the lab find? Rubric: 3 = two, bb:77 and cc:19;; 2 = two;; 1 = vague;; 0 = none.
- EX028 — Lease meaning. What does a DHCP lease show? Rubric: 3 = hardware address and address given;; 2 = device and address;; 1 = password;; 0 = none.
- EX029 — Export timing. Why export leases after closing? Rubric: 3 = customer phones gone, fewer unknowns to sort;; 2 = clarity;; 1 = speed;; 0 = none.
- EX030 — Unknown device outcome. What were the two unknown devices? Rubric: 3 = smart speaker and delivery scanner;; 2 = identified;; 1 = malware;; 0 = none.
- EX031 — Separate network reason. Why move the speaker and scanner off the business network? Rubric: 3 = share network with tills, non-business;; 2 = separation;; 1 = speed;; 0 = none.
- EX032 — Internet failure effect. What stops if the internet fails? Rubric: 3 = online orders, possibly some card payments;; 2 = orders;; 1 = vague;; 0 = none.
- EX033 — Card data path. Where does card payment data go? Rubric: 3 = reader straight to payment provider, encrypted;; 2 = provider;; 1 = office PC;; 0 = none.
- EX034 — Most protected items. Which three items need most protection? Rubric: 3 = office computer, email account, order platform login;; 2 = two;; 1 = one;; 0 = none.
- EX035 — Monthly check. How often should Ellen check the device list? Rubric: 3 = monthly after closing;; 2 = monthly;; 1 = yearly;; 0 = none.
- EX036 — Lab practice reason. Why practise the comparison on synthetic data first? Rubric: 3 = avoid mistakes affecting real check;; 2 = safety;; 1 = required;; 0 = none.
- EX037 — Mobile backup. What backup does Leo suggest for card payments? Rubric: 3 = mobile data backup for card reader;; 2 = mobile;; 1 = vague;; 0 = none.
- EX038 — Inventory dependency. Why does every later step depend on the device list? Rubric: 3 = decisions about where devices connect need it;; 2 = foundation;; 1 = vague;; 0 = none.
Synthesis
A current device list, known dependencies and understood data flows show what to protect and what to separate.
Continue studying — chapter 03 of 04
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →