◇ OpenCyber Academy
Technical · Chapter 11 · English

Chapter 11 — Network basics for technicians

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Network basics for technicians

Lesson map

Lesson 11 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 The router"]
  N2["11.2 Wi-Fi"]
  N3["11.3 Host firewalls"]
  N4["11.4 Printers"]
  N5["Router firmware routine"]
  N6["DNS filtering and router defaults"]
  N7["Network inventory"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 The router"]
  N2["11.2 Wi-Fi"]
  N3["11.3 Host firewalls"]
  N4["11.4 Printers"]
  N5["Router firmware routine"]
  N6["DNS filtering and router defaults"]
  N7["Network inventory"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes]
    |
    v
[11.1 The router]
    |
    v
[11.2 Wi-Fi]
    |
    v
[11.3 Host firewalls]
    |
    v
[11.4 Printers]
    |
    v
[Router firmware routine]
    |
    v
[DNS filtering and router defaults]
    |
    v
[Network inventory]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) check router and Wi-Fi settings; (2) separate guest access; (3) use host firewalls.

11.1 The router

The router connects the office to the internet. Its firmware needs updates and its admin password must be known and strong. With the old supplier's help, the admin password is reset, firmware updated and remote management from the internet turned off. Nobody at the firm had the router's admin password, which meant nobody could update it or check its settings. Turning off remote management stops anyone on the internet trying to log in to it. Nadia stores the new password in the password manager and records the firmware version.

11.2 Wi-Fi

Staff Wi-Fi uses WPA2 or WPA3 with a strong password. Clients visiting the office use a separate guest network that cannot reach the file server. WPA2 or WPA3 encrypts traffic on the staff network, so visitors cannot read it. The guest network lets clients use the internet without reaching the file server, which holds client files. After the change, Nadia confirms with a guest device that the file server does not appear in its network list. The staff Wi-Fi password is changed when someone leaves.

11.3 Host firewalls

Windows Defender Firewall stays on for all profiles, so PCs are protected on hotel or client networks. Accountants work at client offices and hotels, where other devices on the same network could try to connect to their laptops. Keeping the firewall on for every profile means the laptop is protected wherever it is. Nadia checks the setting on a sample of laptops, and it is part of the baseline, so the management tool reports any PC where it is turned off.

11.4 Printers

Network printers also have admin pages and firmware; their default passwords are changed. A printer with a default password could be changed by anyone on the network, for example to send copies of scanned documents elsewhere. Nadia checks both printers' admin pages, changes the passwords and stores them in the manager. She also checks for firmware updates and asks the supplier to apply them, and records the printers in the inventory with their firmware versions. Each printer now has a system page listing its model, firmware version and where its admin password is stored.

Router firmware routine

Router firmware is easy to forget. Nadia adds a quarterly check to the supplier's routine: confirm the router's firmware version against the maker's site and update if needed, during an evening.

She also checks the router's port forwarding list and finds an old rule forwarding a port to a PC that no longer exists. The rule is removed, since an open forward is an unnecessary entry point.

Each check is noted on the router's system page with the version found and any update applied, so the next technician can see the history at a glance.

DNS filtering and router defaults

The supplier points the office's DNS to a filtering service that blocks known malicious sites. This adds a cheap layer of protection for every device, including printers and phones that cannot run antivirus. On the router, convenience features are turned off unless needed. UPnP, which lets devices open ports through the router automatically, is disabled, because any program on any device could otherwise expose services to the internet without anyone noticing. Wi-Fi Protected Setup is also off. Each disabled feature is noted on the router's system page, so a future technician knows it was a deliberate choice.

Network inventory

A network can only be checked if its devices are known. Nadia lists every device in the router's client table and matches each to the inventory. Two unknown entries turn out to be staff phones that had joined the office Wi-Fi instead of the guest network; the staff are shown how to switch, and the office Wi-Fi password is changed. She also finds a smart TV in the meeting room on the office network, which is moved to the guest network because it does not need to reach the file server. The comparison becomes a quarterly routine, since unknown devices tend to accumulate quietly.

Worked example

After the changes, a guest device on the guest network cannot see the file server, which Nadia confirms by checking that the server does not appear in its network list.

Synthetic case. Settings are synthetic.

Errors and limits

Leaving router remote management open to the internet exposes the office's front door.

Exercises

Synthesis

Simple network settings keep guests and outsiders away from office systems.

Continue studying — chapter 11 of 18

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →