Chapter 4 — Networks in practice | Technologist Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Networks in practice

Lesson map

Lesson 04 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Mapping"]
  N2["4.2 Addresses and services"]
  N3["4.3 Separation"]
  N4["4.4 Documentation"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Mapping"]
  N2["4.2 Addresses and services"]
  N3["4.3 Separation"]
  N4["4.4 Documentation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX010"]

[Learning outcomes]
    |
    v
[4.1 Mapping]
    |
    v
[4.2 Addresses and services]
    |
    v
[4.3 Separation]
    |
    v
[4.4 Documentation]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes

You will (1) map a small organisation's network; (2) identify devices and services; (3) separate networks by purpose.

4.1 Mapping

Jamal maps the network of one Riverbend centre with the IT manager's permission. It has a router connecting to the internet, a switch, reception computers, office computers, card tills, camera recorders, a guest wireless network and a staff wireless network. He draws each device and connection. Ms. Grant asks him to label which devices handle payment data, because those need the strongest protection and separation. He checks the drawing against the switch's list of connected devices and finds two devices he had missed: a printer in the manager's office and a small wireless access point installed by the café supplier.

4.2 Addresses and services

Jamal records each device's network address and the services it offers. He uses an authorised scan in the laboratory network first to learn the tools, then runs a limited scan at the centre during closed hours with written permission. He finds a camera recorder offering a web interface with a default password. He reports it, and the IT manager changes the password and restricts access. He also confirms that the guest wireless network cannot reach staff computers, by trying to connect from a laptop on the guest network in the laboratory copy of the setup. The test fails as intended, and he records the result.

4.3 Separation

At the centre, card tills, staff computers and camera recorders share one network. If a staff computer were infected, malware could reach the tills. Jamal proposes separate network segments: one for tills, one for staff, one for cameras and one for guests, with firewall rules allowing only necessary traffic. Ms. Grant explains that payment card industry standards treat separating card systems from other networks as a way to limit which systems must meet their strictest requirements. The IT manager agrees to start with the tills, because payment data carry the highest risk, and to separate cameras next. Jamal drafts the firewall rules needed for the tills to reach the payment provider and nothing else.

4.4 Documentation

Jamal produces a network diagram and device list for the centre, stored in Riverbend's IT documentation. He notes the date and who checked it. Ms. Grant points out that network documentation becomes outdated quickly and should be reviewed whenever devices are added. The IT manager asks Jamal to repeat the mapping for two more centres during his placement. He sets a reminder to review the diagram every six months and whenever a new device is installed. The IT manager says the diagram is the first accurate record of the centre's network he has had, and asks Jamal to use the same format for the other centres.

Worked example

Jamal maps a centre's network, finds a camera recorder with a default password through an authorised scan, proposes four segments and documents the network.

Synthetic case. Networks are synthetic.

Errors and limits

Scanning without written permission is unacceptable, even on a friendly network.

Exercises

EX010 — Payment label. Which devices must be labelled specially? Rubric: 3 = those handling payment data;; 2 = partly correct;; 1 = vague;; 0 = none.
EX011 — Camera finding. What did the scan find on the camera recorder? Rubric: 3 = a default password;; 2 = partly correct;; 1 = vague;; 0 = none.
EX012 — Proposed segments. Name the four proposed segments. Rubric: 3 = tills, staff, cameras, guests;; 2 = all;; 1 = some;; 0 = none.

Continue studying — lesson 04 (chapter 04 of 30)

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.