Chapter 15 — Network and communications security: guided lab
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Approved services"]
N2["15.2 Observed services"]
N3["Lab — Service comparison"]
N4["15.3 Reading the comparison"]
N5["15.4 Recording decisions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Approved services"]
N2["15.2 Observed services"]
N3["Lab — Service comparison"]
N4["15.3 Reading the comparison"]
N5["15.4 Recording decisions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Approved services]
|
v
[15.2 Observed services]
|
v
[Lab — Service comparison]
|
v
[15.3 Reading the comparison]
|
v
[15.4 Recording decisions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) compare approved and observed services; (2) investigate differences; (3) record decisions.
15.1 Approved services
A server should offer only the services it needs. Tomás and Gareth write an approved service list for key servers and devices: the web server offers HTTP and HTTPS, the file server offers file sharing, the print server offers the printing protocol, the DNS server offers DNS and switches offer SSH for management. Anything else is unapproved until someone justifies it. The approved list is part of the configuration baseline and is reviewed whenever services change. Gareth signs off the list as its owner.
15.2 Observed services
To compare reality with the list, Gareth exports a service inventory from the servers' own management tools and the switches' configurations, which Tomás receives as a synthetic, sanitised file for the lab. He does not scan the school network; observed services come from the systems themselves with Gareth's authorisation. The lab compares the two sets and reports differences in both directions: services observed but not approved, and approved services not observed. The comparison is repeated each term, so new services that appear between reviews are noticed and either approved or removed.
Lab — Service comparison
"""Compare an approved service list with a synthetic observed service inventory (stdlib only; no scanning)."""
approved = {("web01", 443), ("web01", 80), ("files01", 445), ("print01", 631), ("dns01", 53), ("mgmt-sw1", 22)}
observed = {("web01", 443), ("web01", 80), ("web01", 8080), ("files01", 445), ("files01", 3389), ("print01", 631),
("print01", 9100), ("dns01", 53), ("mgmt-sw1", 22), ("mgmt-sw1", 23)}
extra, missing = sorted(observed - approved), sorted(approved - observed)
for h, p in extra: print(f"UNAPPROVED {h}:{p}")
for h, p in missing: print(f"MISSING {h}:{p}")
print(f"approved {len(approved)}, observed {len(observed)}, unapproved {len(extra)}, missing {len(missing)}")
Run with python3 lab_services.py. Verified output:
UNAPPROVED files01:3389
UNAPPROVED mgmt-sw1:23
UNAPPROVED print01:9100
UNAPPROVED web01:8080
approved 6, observed 10, unapproved 4, missing 0
15.3 Reading the comparison
The comparison finds four unapproved services and none missing. The file server offers remote desktop, which the old supplier used. A switch still has Telnet enabled, matching the earlier finding. The print server offers a raw printing port in addition to the approved protocol, which some old printers need. The web server offers a second web port used by a forgotten test site. Each finding is discussed: remote desktop and Telnet are disabled, the test site is removed, and the raw printing port is kept for now but restricted to the shared devices zone.
15.4 Recording decisions
Each finding becomes a decision record: what was found, what was decided, who decided and when to review. The raw printing port, kept for compatibility, gets a review date for when the old printers are replaced. Recording decisions prevents the same finding from being raised and argued again at every review, and shows auditors that exceptions were considered deliberately. The approved service list is updated to include the restricted printing port with its reason. Records are stored with the inventory.
Worked example
Four unapproved services are found; three are removed and one is kept with restrictions and a review date.
Synthetic case. Service data are synthetic.
Errors and limits
Removing services without checking their users can break needed functions.
Exercises
- EX043 — Comparison result. What does the comparison report? Rubric: 3 = 4 unapproved, 0 missing, naming them;; 2 = 4 unapproved;; 1 = some;; 0 = none.
- EX044 — Kept exception. Which unapproved service is kept, and how? Rubric: 3 = raw printing port restricted to shared devices zone with review date;; 2 = printing port;; 1 = vague;; 0 = none.
- EX045 — Data source. Where do observed services come from in this lab? Rubric: 3 = systems' own management data, authorised, not scanning;; 2 = exports;; 1 = scanning;; 0 = none.
Synthesis
Comparing approved and observed services finds unnecessary exposure and leads to recorded decisions.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →