3. Fundamentals of Networking & Security

Computer networking refers to the interconnection of devices to share data and resources. In the context of cyber security, understanding networks is crucial because most cyber attacks occur over a network.

Networks can be: ● LAN (Local Area Network) – e.g., office/home network ● WAN (Wide Area Network) – e.g., the internet ● Wireless Networks – e.g., Wi-Fi

Networking involves connecting different devices together so that they can communicate and share information. In terms of cyber security, this is important because many attacks target these connections. There are different types of networks:

• LAN: A Local Area Network is typically found in small areas like homes or offices. This involves all devices within a limited geographical area connecting to share resources like files or printers.
• WAN: A Wide Area Network spans a larger area, like cities or countries, and includes the internet, allowing global connectivity.
• Wireless Networks: These allow devices to connect without physical cables, such as Wi-Fi networks commonly used in homes and businesses. Understanding these networks helps anticipate where vulnerabilities might arise.

Think of networking like a city’s road system. Just as different types of roads connect neighborhoods (LAN), regions (WAN), or operate without physical barriers (wireless), a computer network connects devices to share information. Just as a road needs maintenance and security to prevent accidents, computer networks require security measures to prevent cyber attacks.

📍 IP Address (Internet Protocol Address) ● A unique identifier for a device on a network. ● Example: 192.168.1.1 (IPv4), or 2001:0db8:85a3::8a2e:0370:7334 (IPv6) ● Can be static (fixed) or dynamic (changes every session).

🌐 DNS (Domain Name System) ● Translates human-readable domain names (like www.google.com) into IP addresses. ● Acts like the "phonebook" of the internet.

🚪 Ports ● Logical access points for communication on a system. ● Common ports: ○ 80 – HTTP (web traffic) ○ 443 – HTTPS (secure web traffic) ○ 25 – SMTP (email) ○ 22 – SSH (secure shell)

📡 Protocols ● Rules that govern data communication. ● Common protocols: ○ TCP/IP – Ensures reliable data transfer. ○ HTTP/HTTPS – Web communication (secure with HTTPS). ○ FTP/SFTP – File transfer protocols. ○ SSH – Secure remote access.

Basic networking concepts help understand how devices communicate:

• IP Address: This is a unique number assigned to devices on a network, like a street address for a house. It can either stay the same (static) or change (dynamic).
• DNS: This system translates domain names, which are easy for humans to remember (like google.com), into IP addresses, making it possible for browsers to load websites.
• Ports: Think of ports as doors on a building that allow specific types of traffic. Each door lets in different kinds of communication—some for web traffic (HTTP), secure web traffic (HTTPS), or email (SMTP).
• Protocols: These are the rules that allow devices to communicate effectively. Different protocols serve different purposes, ensuring that the right data gets to the right place securely.

Imagine a postal system where:

• Each house has a unique address (the IP address) that mail is delivered to.
• A phonebook (DNS) translates a person’s name into an address, so someone can send a letter.
• Different doors at a post office (ports) are marked for letters, packages, or urgent inquiries.
• The rules of mailing (protocols) ensure letters get delivered properly and securely.

🧱 Firewalls ● A firewall monitors and controls incoming and outgoing traffic based on predefined security rules. ● Types: ○ Hardware Firewall – Physical device at the network boundary. ○ Software Firewall – Runs on the device it protects. ● Can be stateless (basic filtering) or stateful (tracks connections).

🕵 IDS & IPS ● Intrusion Detection System (IDS): Monitors traffic for suspicious activity. ● Intrusion Prevention System (IPS): Detects and actively blocks threats.

🧰 Other Network Security Tools ● VPNs (Virtual Private Networks) – Encrypt internet traffic and hide IP addresses. ● Proxy Servers – Act as intermediaries between users and the internet. ● Network Access Control (NAC) – Ensures devices meet security standards before connecting.

Network security involves several important tools:

• Firewalls are like guards at a door, monitoring what comes in and goes out of a network. There are two types: hardware firewalls are physical devices placed at the network's edge, while software firewalls reside on individual devices. They may operate in a simple (stateless) or more sophisticated manner (stateful), where they remember ongoing connections.
• IDS and IPS: An Intrusion Detection System watches for unusual activities—or threats—while an Intrusion Prevention System not only detects but also blocks these threats before they cause harm.
• Additional tools include VPNs, which create a secure tunnel for your data, Proxy Servers that mask users' IP addresses, and Network Access Control, ensuring that only secure devices can join the network.

Consider a security system at a building:

• A firewall acts like the security officer screening who enters and exits.
• An IDS monitors the situation for any suspicious behavior, much like a guard who notices unusual activity.
• An IPS is like a security system that actively locks a door when a potential intruder is identified.
• VPNs are like secret tunnels leading into the building, keeping the activity hidden, while proxy servers can serve as a front desk, managing visitors discreetly.

● Open Ports: Can be exploited if unnecessary or unprotected. ● Weak or Default Passwords: Easily guessed or widely known. ● Unpatched Devices: Outdated firmware/software can be entry points. ● Unsecured Wi-Fi: No password or weak encryption (e.g., WEP).

Recognizing common vulnerabilities is key to securing networks:

• Open Ports: If certain ports are left open without proper security, they can be exploited by attackers to gain access.
• Weak or Default Passwords: Many people use easy-to-guess passwords or do not change default settings, making it simple for attackers to break in.
• Unpatched Devices: Devices that haven’t been updated with the latest security patches can be exploited since they’re vulnerable to known threats.
• Unsecured Wi-Fi: Networks without passwords or outdated encryption can be easily accessed by unauthorized users.

Think of network vulnerabilities like security risks in a store:

• Open Ports are like leaving a door unlocked; anyone can simply walk in.
• Using weak passwords is similar to having simple lock combinations that anyone can guess.
• Unpatched Devices are like not repairing broken security systems that can easily be bypassed.
• Unsecured Wi-Fi is like allowing any passerby to enter your personal space, inviting strangers in without checking credentials.

● Use strong passwords and change default credentials. ● Enable firewalls on devices and routers. ● Segment networks (e.g., guest vs internal). ● Keep software updated to patch known vulnerabilities. ● Use WPA3 encryption for Wi-Fi instead of older, weaker protocols like WEP or WPA.

To secure a network, certain practices should be followed:

• Strong Passwords: Always use complex passwords and change any default ones to enhance security.
• Firewalls: Ensure that firewalls are active on all devices, creating a barrier against unwanted traffic.
• Network Segmentation: Dividing the network into different sections can help protect sensitive information; for example, having separate coverage for guests and staff members.
• Software Updates: Regularly updating software helps patch vulnerabilities before attackers can exploit them.
• Wi-Fi Encryption: Implement WPA3, the latest wireless security protocol, which is more secure compared to older standards.

Consider securing a home as an analogy:

• Strong passwords are like having robust locks on doors.
• Firewalls serve as a high fence around the property that keeps unwanted visitors out.
• Network segmentation is akin to having separate rooms for different purposes, so guests don’t access private areas.
• *Keeping software updated is like repairing the house regularly to prevent any break-ins. Using WPA3 encryption is similar to adding an advanced security system, making it harder for thieves to break in.

In 2013, Target Corporation was hacked through their HVAC system’s network connection. Attackers moved laterally through the network to access point-of-sale systems, compromising over 40 million credit card accounts. The lack of proper network segmentation and monitoring made this possible.

This example illustrates the importance of network security:

• In 2013, Target Corporation faced a significant breach when attackers accessed their systems via an unsecure connection meant for the HVAC system. Once inside, the attackers could navigate the network undetected and reach sensitive systems where credit card transactions were processed. Because there wasn't adequate segmentation between different parts of the network, they could move freely and ultimately accessed over 40 million credit card details.
• This incident highlights how critical it is to secure all parts of the network and to monitor movements within it for suspicious activity.

Imagine a thief gaining access to a secure building through a delivery entrance. Once inside, they can wander around without much notice, reaching offices to steal sensitive documents—exactly what happened to Target. This emphasizes the need for strict access controls and vigilant monitoring to prevent such security lapses.

--