◇ OpenCyber Academy
Technical · Chapter 11 · English

Chapter 11 — Network and communications security: verification

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Network and communications security: verification

Lesson map

Lesson 11 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Verifying against intent"]
  N2["11.2 VPN settings"]
  N3["11.3 TLS on services"]
  N4["11.4 Independent check"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Verifying against intent"]
  N2["11.2 VPN settings"]
  N3["11.3 TLS on services"]
  N4["11.4 Independent check"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]

[Learning outcomes]
    |
    v
[11.1 Verifying against intent]
    |
    v
[11.2 VPN settings]
    |
    v
[11.3 TLS on services]
    |
    v
[11.4 Independent check]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) verify configurations against standards; (2) check TLS and VPN settings; (3) confirm rules match intent.

11.1 Verifying against intent

Verification checks that configurations match what was intended. Amina exports the firewall rules and compares them, rule by rule, with the needed-flows list. Each rule must map to a flow, and each flow to a rule. She finds one rule with no matching flow, allowing staff to reach a decommissioned server, and one flow, scanning from the copier, without a rule because it was added to the list but not yet configured. Both are fixed, and the comparison is repeated.

11.2 VPN settings

The site-to-site VPN and remote access VPN are checked against NIST SP 800-77r1. Amina confirms that the site-to-site tunnel uses IKEv2, defined in RFC 7296, with certificates rather than a shared key, and current encryption settings. The remote access VPN requires multi-factor authentication and places users in the remote zone. She records the negotiated settings shown on the gateway, not just the configured ones, since a gateway can fall back to weaker settings if the other side asks. Any gaps are recorded for the next window.

11.3 TLS on services

Web services and the VPN portal should accept only TLS 1.2 or later, following SP 800-52r2, and TLS 1.3, described in RFC 8446, where supported. Amina checks the configured versions on Castleford's services with Rosa and finds the intranet still accepts TLS 1.0. Rosa updates it after confirming no staff use very old browsers. Amina also checks certificate validity and ownership, adding each certificate to the expiry list used in the next chapter's lab. The check is repeated whenever a service is upgraded or replaced.

11.4 Independent check

Verification by the person who made a change is weaker than verification by someone else, who reads what is written rather than what was meant. Amina asks a classmate to verify her lab rule set against the needed-flows list without help. The classmate finds a rule using the wrong zone name for printers. Independent checks are cheap and catch errors that authors overlook; in small organisations, the support company or a peer organisation can provide this check. The classmate's findings are logged alongside Amina's own.

Worked example

Verification finds one rule without a flow and one flow without a rule; the intranet's TLS 1.0 support is removed.

Synthetic case. Configurations are synthetic.

Errors and limits

Recording configured rather than negotiated VPN settings can hide fallback to weaker options.

Exercises

Synthesis

Rule-by-rule comparison, standards checks and independent review confirm controls match intent.

Continue studying — chapter 11 of 18

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →