Chapter 2 — Networks and internet services | Technologist Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Local networks and addressing"]
  N2["2.2 Routing and gateways"]
  N3["2.3 Internet services the school depends on"]
  N4["2.4 Wireless networks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Local networks and addressing"]
  N2["2.2 Routing and gateways"]
  N3["2.3 Internet services the school depends on"]
  N4["2.4 Wireless networks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Local networks and addressing]
    |
    v
[2.2 Routing and gateways]
    |
    v
[2.3 Internet services the school depends on]
    |
    v
[2.4 Wireless networks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) explain addressing, routing and common services; (2) describe how the school reaches the internet; (3) identify key dependencies.

2.1 Local networks and addressing

Devices on a network have IP addresses, and groups of addresses form subnets. Tomás examines the school's addressing and finds that almost everything, from student laptops to the finance office, sits in one large subnet. A router connects this subnet to the internet through the school's provider. Within one subnet, devices can usually talk to each other directly without passing any filtering device. This explains why a student laptop can currently see the finance office's shared printer, a small example of a much wider problem the course will address.

2.2 Routing and gateways

When a device sends traffic to an address outside its own subnet, it sends it to a default gateway, usually a router or firewall, which forwards it onward. Gateways are natural places for controls because traffic must pass through them. Tomás notes that the school's gateway filters traffic to and from the internet but nothing inside, because internal traffic never reaches it. Creating separate subnets for different groups would route internal traffic through the gateway, where rules could then decide what is allowed between groups.

2.3 Internet services the school depends on

The school uses several internet services: DNS to translate names into addresses, DHCP to give devices addresses automatically, email hosted by a provider, an online learning platform and a cloud backup service. Tomás lists each with its provider and what happens if it fails. DNS and DHCP are especially important because nearly everything depends on them; if DHCP stops, new devices cannot join, and if DNS fails, most applications stop working even though the network itself is fine. Dependencies like these must be protected and monitored.

2.4 Wireless networks

Most student devices connect over wireless. The school has one wireless network for students, one for staff and one for guests, but all three lead into the same subnet, so the separation is only in name. Tomás explains to classmates that separate wireless network names are useful only if each leads to its own subnet with rules between them. NIST SP 800-153 describes how wireless networks should be separated and secured, and Tomás uses it as a reference when he later helps design changes for the school.

Worked example

Tomás's diagram shows one large subnet behind one gateway, with three wireless networks all bridged into it.

Synthetic case. The network is synthetic.

Errors and limits

Separate wireless names that lead to the same subnet give an illusion of separation.

Exercises

EX004 — Internal traffic gap. Why does the school gateway not filter internal traffic? Rubric: 3 = internal traffic stays in one subnet, never reaches it;; 2 = same subnet;; 1 = misconfigured;; 0 = none.
EX005 — DNS failure effect. What happens to most applications if DNS fails? Rubric: 3 = stop working although network is up;; 2 = stop;; 1 = vague;; 0 = none.
EX006 — Wireless illusion. Why are the school's three wireless networks not truly separate? Rubric: 3 = all lead to same subnet;; 2 = same subnet;; 1 = same password;; 0 = none.

Synthesis

Subnets, gateways and dependencies determine where controls can act and what must be protected.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →