Chapter 2 — Networks and internet services | Technologist Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Reaching cloud services"]
  N2["2.2 DNS and sign-in"]
  N3["2.3 Clinic Wi-Fi"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Reaching cloud services"]
  N2["2.2 DNS and sign-in"]
  N3["2.3 Clinic Wi-Fi"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Reaching cloud services]
    |
    v
[2.2 DNS and sign-in]
    |
    v
[2.3 Clinic Wi-Fi]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) explain how staff reach cloud services; (2) describe HTTPS and DNS in sign-in; (3) recognise risks of clinic Wi-Fi.

2.1 Reaching cloud services

Fernhill's clinics connect to the internet through business broadband, and staff reach cloud services such as the office suite and booking system over it. Each sign-in travels over HTTPS, which encrypts the traffic and lets the browser confirm the service's identity through its certificate. Kai checks that every service uses HTTPS and that browsers show no certificate warnings, since staff who get used to clicking through warnings could be fooled by a fake site. All six services pass, which he records with the date.

2.2 DNS and sign-in

Browsers find services through DNS, which turns names into addresses. If DNS answers were tampered with, staff could be sent to a look-alike site. Certificate checking protects against this as long as staff do not ignore warnings, and site-bound authenticators such as passkeys add another layer, because they will only sign for the genuine site. Kai explains this chain simply to the practice manager, so she understands why staff training about warnings and the move to passkeys are connected rather than separate topics.

2.3 Clinic Wi-Fi

Each clinic offers free Wi-Fi to clients in the waiting room. Kai checks that the guest network is separate from the staff network, so a client's phone cannot reach reception workstations. At the east clinic he finds that the guest and staff networks are the same, a leftover from a router replacement. He reports it to the IT person, who separates them. Although networks are not identity systems, a shared network gives others a route to devices where staff are signed in, so the two topics meet.

Worked example

Kai confirms HTTPS on six services and finds that the east clinic's guest and staff Wi-Fi are not separated, which IT corrects.

Synthetic case. Clinics, networks and findings are synthetic.

Errors and limits

Training staff to click through certificate warnings undermines the protection HTTPS provides.

Exercises

EX004 — Warning risk. Why is clicking through certificate warnings dangerous? Rubric: 3 = staff could be fooled by a fake site;; 2 = fake site;; 1 = slow;; 0 = none.
EX005 — East clinic finding. What did Kai find at the east clinic? Rubric: 3 = guest and staff Wi-Fi not separated;; 2 = shared network;; 1 = vague;; 0 = none.
EX006 — Passkey layer. What extra layer do passkeys add against look-alike sites? Rubric: 3 = they only sign for the genuine site;; 2 = site-bound;; 1 = vague;; 0 = none.

Synthesis

HTTPS, DNS and separated Wi-Fi all support safe sign-in to cloud services.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →