◇ OpenCyber Academy
Technical · Chapter 2 · English

Chapter 2 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and protocols

Lesson map

Lesson 02 published. Map, example, EX005.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 HTTPS and TLS"]
  N2["2.2 DNS"]
  N3["2.3 Private endpoints"]
  N4["2.4 Exposure"]
  N5["2.5 Ports and firewalls"]
  N6["Checking exposure"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX005"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 HTTPS and TLS"]
  N2["2.2 DNS"]
  N3["2.3 Private endpoints"]
  N4["2.4 Exposure"]
  N5["2.5 Ports and firewalls"]
  N6["Checking exposure"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX005"]

[Learning outcomes]
    |
    v
[2.1 HTTPS and TLS]
    |
    v
[2.2 DNS]
    |
    v
[2.3 Private endpoints]
    |
    v
[2.4 Exposure]
    |
    v
[2.5 Ports and firewalls]
    |
    v
[Checking exposure]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX005]

Learning outcomes

You will (1) explain HTTPS, DNS and private endpoints; (2) describe how storage is reached over the internet; (3) recognise public exposure.

2.1 HTTPS and TLS

Browsers and partners reach Fairway's services over HTTPS, which uses TLS to encrypt traffic and authenticate the server. Encryption protects data on the way, but it does not decide who is allowed to read it. In March the partner's two downloads, and any other reader's, would have travelled over HTTPS just as safely as a legitimate request. TLS protected the manifest on the way while the bucket policy handed it to anyone who asked. Tomás notes this because colleagues sometimes treat the padlock in the browser as proof that data is protected from unauthorised readers.

2.2 DNS

DNS maps names such as tracking.fairway.example to addresses. Storage buckets also have names reachable over the internet, which is why a public setting exposes them to anyone who knows or guesses the name. For Fairway, this means the manifests bucket's name was effectively its address on the internet. A name that seems obscure still appears in links, browser histories and partner emails, so it cannot be treated as secret. dev-sam later says he thought the link was hard to guess, and the review records that hiding the name is not a control.

2.3 Private endpoints

Cloud providers allow services to be reached through private network endpoints, so traffic stays inside a private network. Fairway's database uses one; its buckets do not yet. For the buckets, moving to private endpoints would mean the tracking site reaches storage without crossing the internet. That change would not have stopped the March exposure on its own, because a public policy still applies to requests through the public storage endpoint. Tomás records private endpoints for storage as a later improvement, behind the access policy fixes.

2.4 Exposure

A service is exposed when it can be reached from the internet without authentication. The manifests bucket was exposed for nearly three days because its policy allowed public reads. Using the habit Tomás adopts, the manifests bucket during those days answered the two key questions badly: anyone could reach it and nothing checked them. The assets bucket gives the same answer by design, which is acceptable because its contents are public anyway. The difference lies in the data, so the exposure check always records what each service holds.

2.5 Ports and firewalls

Firewalls limit which addresses can reach which ports, but storage services are reached through the provider's shared endpoints, so access policy, not firewalls, is the main control. Fairway's firewall protects its office network and the cluster's internal traffic, and it does useful work there. It never saw the anonymous reads of the manifests bucket, because those requests went straight from the internet to the provider. Tomás updates the network notes so that each managed service lists access policy, not a firewall rule, as its main control.

Checking exposure

Tomás learns a simple habit: for every service, ask who can reach it from the internet and what proves they are allowed. For the tracking site, users reach it and the application checks their login. For the database, nobody outside the private network can reach it. For the manifests bucket during the incident, anyone could reach it and nothing checked them. Writing the answer for each service makes exposure visible before it becomes an incident.

Worked example

Tomás asks why the firewall did not stop the downloads. Grace explains that the bucket was reached through the provider's public storage endpoint over HTTPS, which Fairway's firewall does not control. Access policy is the only gate.

Synthetic case. Names are synthetic.

Errors and limits

Assuming firewalls protect managed services leads to false confidence.

Exercises

Synthesis

For managed services, access policy is the main network control.

Continue studying — chapter 02 of 18

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →