## Chapter 16 — Network and communications security: methods II ### Lesson map Lesson 16 published. Map, example, EX046. ```mermaid flowchart TD N0["Learning outcomes"] N1["16.1 Wireless done properly"] N2["16.2 Remote access for staff"] N3["16.3 Encrypted management"] N4["16.4 TLS on school services"] N5["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 --> N5 N5 --> EX["Worked example"] EX --> Q["Exercise EX046"] ``` ### Logical drawing ```mermaid flowchart LR N0["Learning outcomes"] N1["16.1 Wireless done properly"] N2["16.2 Remote access for staff"] N3["16.3 Encrypted management"] N4["16.4 TLS on school services"] N5["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"] ``` ```text [Learning outcomes] | v [16.1 Wireless done properly] | v [16.2 Remote access for staff] | v [16.3 Encrypted management] | v [16.4 TLS on school services] | v [Synthesis] | v [Worked example] --> [Exercise EX046] ``` ### Learning outcomes You will (1) secure wireless networks; (2) protect remote access; (3) apply encryption to management and services. ### 16.1 Wireless done properly Tomás redesigns the school's wireless: a staff network with individual accounts checked against the school's directory, a student network with student accounts, a guest network with a passphrase changed termly and internet-only access, and each network linked to its own zone. Access point management sits in the management zone. Client isolation on the guest and student networks stops devices talking to each other directly. These steps follow NIST SP 800-153 guidance and turn the existing wireless names into real separation. ### 16.2 Remote access for staff Some staff need school systems from home. The current approach exposes the file server directly to the internet with a password, which is risky. Tomás proposes a VPN with individual accounts and a second factor, placing remote users in a restricted zone that reaches only teaching files and the learning platform. NIST SP 800-77r1 describes IPsec VPN design, and SP 800-52r2 covers TLS configuration if a TLS-based VPN is chosen. Remote finance access is limited to office staff and logged. ### 16.3 Encrypted management All device management uses encrypted protocols: SSH for command line and HTTPS for web interfaces. Telnet and plain HTTP management are disabled. Tomás also checks that the HTTPS certificates on management pages are valid and that management accounts are individual rather than a shared "admin" login. Encrypted management protects credentials from anyone listening on the network, and individual accounts make logs meaningful because they show who made each change rather than just that "admin" did. Old shared logins are disabled once individual ones work. ### 16.4 TLS on school services The school's web services should use current TLS. SP 800-52r2 recommends TLS 1.2 or later. Tomás checks the school's web server, learning platform connection and email settings with Gareth and finds the web server still accepts TLS 1.0. Gareth updates the configuration, and they confirm modern browsers still connect. TLS 1.3, described in RFC 8446, is enabled where supported. Keeping TLS current protects passwords and personal data in transit between users and school services. The check is repeated each term with the same steps. ### Worked example Four wireless networks map to four zones; remote access moves to a VPN; Telnet is disabled; the web server drops TLS 1.0. > **Synthetic case.** Configurations are synthetic. ### Errors and limits A VPN that gives remote users full network access recreates a flat network from home. ### Exercises - **EX046 — Client isolation purpose.** Why enable client isolation on student wireless? *Rubric:* 3 = stops student devices attacking each other;; 2 = isolation;; 1 = speed;; 0 = none. - **EX047 — Remote access change.** Why replace direct internet exposure of the file server? *Rubric:* 3 = risky; VPN with MFA and restricted zone instead;; 2 = risk;; 1 = speed;; 0 = none. - **EX048 — Individual management accounts.** Why use individual management accounts rather than one admin login? *Rubric:* 3 = logs show who made changes;; 2 = accountability;; 1 = easier;; 0 = none. ### Synthesis Proper wireless separation, controlled remote access and encryption close common gaps. ### Continue studying — chapter 16 of 30 [← Chapter 15 (draft)](#ch-15) · [Course chapter index](../SUBJECTS.md) · [Chapter 17 (draft) →](#ch-17) ## Worked answers **EX046.** It stops student devices connecting directly to each other. **EX047.** Direct exposure is risky; a VPN with a second factor and restricted access is safer. **EX048.** Logs then show which person made each change.