◇ OpenCyber Academy
Technologist · Chapter 2 · English

Chapter 2 — Networks and internet services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Club networks"]
  N2["2.2 Internet services"]
  N3["2.3 Encryption in transit"]
  N4["2.4 Guest Wi-Fi"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Club networks"]
  N2["2.2 Internet services"]
  N3["2.3 Encryption in transit"]
  N4["2.4 Guest Wi-Fi"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Club networks]
    |
    v
[2.2 Internet services]
    |
    v
[2.3 Encryption in transit]
    |
    v
[2.4 Guest Wi-Fi]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) trace member data across networks; (2) identify third-party services in apps and websites; (3) protect data in transit.

2.1 Club networks

Each club has a network for staff computers, door access, CCTV and guest Wi-Fi. Aisha finds that CCTV recorders and guest Wi-Fi share one network in two clubs, so a guest could reach the recorders. She recommends separating them. She explains that network separation protects personal data such as footage from people who should not access it, and that it also reduces the chance that a compromised device spreads to other systems. At Quayside the fix is a separate virtual network for cameras, with a rule that only the recorder management server may connect to them.

2.2 Internet services

Quayside's website and app use many internet services: hosting, payments, analytics, maps and social login. Aisha uses browser developer tools on the website with a test account to see which domains receive requests. She lists eleven third-party domains. Some receive only technical data; others receive member identifiers. She learns that each third party may be a processor needing a contract under GDPR Article 28, or a separate controller, and that many services are added without privacy review. Her list shows a map service receiving club searches with member IDs attached.

2.3 Encryption in transit

Aisha checks that the website and app use encrypted connections. All public endpoints do, but the club booking screens send member names to a local server without encryption. She raises it with the IT team, who enable encryption. She explains that encryption in transit is a basic security measure under Article 32 and that internal networks are not automatically safe. On the booking screens, anyone plugged into the club switch could have read names and class times in plain text. After the change she repeats the capture with a test booking and sees only encrypted traffic, which she records as evidence for the IT ticket.

2.4 Guest Wi-Fi

Guest Wi-Fi asks members to log in with their membership number. Aisha finds that login records with device identifiers are kept indefinitely. She recommends keeping them only as long as needed for security and abuse handling, such as thirty days, and telling members in the privacy notice. She notes that networks create personal data as a side effect, which needs the same care as data collected deliberately. Device identifiers can follow a member across visits, so thirty days limits how much movement history builds up.

Worked example

Aisha separates CCTV from guest Wi-Fi, lists eleven third-party domains on the website, gets booking screens encrypted and limits guest Wi-Fi logs to thirty days.

Synthetic case. Networks are synthetic; GDPR Articles 28 and 32 are real.

Errors and limits

Browser tools show web requests only; apps need separate testing.

Exercises

Continue studying — lesson 02 (chapter 02 of 30)

← Chapter 01 · Course chapter index · Chapter 03 →

Continue to the next authored lesson.