Chapter 2 — Networks and internet services | Technologist Security architecture and engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Tracing a scan"]
  N2["2.2 Addresses, ports and names"]
  N3["2.3 Exposure points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Tracing a scan"]
  N2["2.2 Addresses, ports and names"]
  N3["2.3 Exposure points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Tracing a scan]
    |
    v
[2.2 Addresses, ports and names]
    |
    v
[2.3 Exposure points]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) trace how depot devices reach cloud services; (2) explain addresses, ports and name resolution; (3) identify network exposure points.

2.1 Tracing a scan

Tomás follows one parcel scan from the handheld to the cloud. The scanner joins the depot wireless network, receives an address from the router, looks up the tracking service's name through DNS and opens an encrypted HTTPS connection on port 443. The depot firewall allows outbound web traffic, and the cloud service replies. Tracing one path end to end teaches him more than memorising protocol tables, because he sees where each component could fail or be attacked and which team owns each step.

2.2 Addresses, ports and names

Ruth explains three ideas. An IP address identifies a device on a network; a port identifies a service on that device; DNS turns names into addresses. Tomás uses these to read the depot firewall rules. One rule allows inbound connections on port 3389, used for remote desktop, to an office PC. Sam explains it was opened years ago so a former manager could work from home. Inbound remote desktop from the internet is a frequent route for ransomware, so the rule needs urgent attention.

2.3 Exposure points

Tomás lists every place the depot network meets the outside world: the internet connection, the remote desktop rule, the vendor's remote support link to the conveyor controller and the guest wireless network used by drivers. For each, he notes what is reachable and who uses it. Sam closes the remote desktop rule the same day and offers the manager the company's VPN instead. The guest network turns out to be separated correctly. Knowing exposure points lets a small team focus effort where attackers would start.

Worked example

Tomás traces a scan to the cloud, reads firewall rules with addresses, ports and names, and lists four exposure points, closing an old remote desktop rule.

Synthetic case. Network details are synthetic.

Errors and limits

Firewall rules may not reflect cloud-side settings. Vendor links can be undocumented.

Exercises

EX004 — Port 443. Which port did the scanner use and why? Rubric: 3 = 443 for encrypted HTTPS;; 2 = 443;; 1 = 80;; 0 = none.
EX005 — Remote desktop risk. Why was the inbound port 3389 rule urgent? Rubric: 3 = internet remote desktop is a frequent ransomware route;; 2 = ransomware;; 1 = vague;; 0 = none.
EX006 — Exposure list. Name two exposure points Tomás listed. Rubric: 3 = internet connection, remote desktop rule, conveyor vendor link, guest wireless;; 2 = one;; 1 = vague;; 0 = none.

Synthesis

Tracing real traffic and listing exposure points turns networking knowledge into security action.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →