Communication and Network Security

1.1 The 7-layer OSI model

ISO's OSI (Open Systems Interconnection) model breaks communication into 7 layers. Top to bottom: 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link, 1 Physical. Each layer provides a specific service to the layer above and relies on the layer below. The layers are often grouped into two families: the host layers (7 to 4), close to the application and the user, and the media layers (3 to 1), which handle delivery and the interface with the physical medium.

Function of each layer. Application (7): interface of network services to the application (HTTP, DNS, SMTP). Presentation (6): data representation, encoding and encryption (formats, TLS). Session (5): opening, maintaining and closing sessions between hosts. Transport (4): end-to-end connections and reliability (TCP, UDP), with ports. Network (3): logical addressing (IP) and path determination (routing). Data Link (2): physical MAC addressing, framing, LLC over a single link. Physical (1): binary transmission, signals, media and connectors.

A classic mnemonic helps memorize the order, for example from layer 7 down to 1: All People Seem To Need Delicious Pizza (Application, Presentation, Session, Transport, Network, Data Link, Physical). Reversed, 1 to 7: Please Do Not Throw Sausage Pizza Away.

Exam trap: do not confuse the order, and place each protocol or device at its correct layer (a router operates at layer 3, a switch at layer 2). The OSI model is conceptual: a real device does not implement every layer in strict isolation.

1.2 The TCP/IP model and the OSI to TCP/IP mapping

The TCP/IP model, defined by the IETF, focuses on the core internetworking functions and leaves business objectives to applications above it. It has 4 layers: Application, Transport (host-to-host), Internet and Network Access (network interface). It is a best-effort, pragmatic model built to connect heterogeneous hosts at scale.

Mapping to OSI. The TCP/IP Application layer groups OSI layers 7, 6 and 5 (Application, Presentation, Session): TCP/IP does not handle the notion of session in a dedicated way. The Transport layer is almost identical to OSI layer 4 (TCP, UDP, ports). The Internet layer corresponds to OSI layer 3 Network (IP, routing). The Network Access layer groups OSI layers 2 and 1 (Data Link and Physical). This is what the side-by-side comparison figure shows: at the bottom the two models look very similar, at the top they diverge.

Why know both? Because security analysis, engineering and assurance activities become simpler with a shared vocabulary, and because products and documentation borrow from both. The textbook also notes regional biases (TCP/IP more on the North American side, OSI often on the European side): be aware of them without being captive to them.

Exam trap: do not mechanically map 7 layers onto 4. The trickiest rule is the top of the stack: TCP/IP Application covers OSI Application + Presentation + Session, and Network Access covers Data Link + Physical.

1.3 Encapsulation, PDU and decapsulation

When a message goes down the stack at the sender, each layer encapsulates the data received from the layer above: it adds its own header, sometimes a trailer, with the addressing and control information relevant to that layer, then passes the whole thing to the layer below. This is encapsulation. On receipt the reverse process happens, layer by layer, going up: each layer strips the header meant for it and passes the rest upward. This is decapsulation.

At each layer the encapsulated data unit has its own name: the PDU (Protocol Data Unit). Top to bottom: at the upper layers we speak of data; at the Transport layer the unit becomes a segment (a datagram for UDP); at the Network layer a packet; at the Data Link layer a frame; at the Physical layer the bits transmitted over the medium. The textbook summarizes this journey from the screen down to the bits.

An important point stressed by the textbook: the very top layers do not encapsulate in the strict sense (they do not receive data from a layer still above to pack up), while in the encapsulated layers the data portion picks up a new name at each step. Understanding this mechanism is essential to read a network capture and to locate where an attack acts.

Exam trap: matching the wrong PDU to a layer. Memorize the order data, segment, packet, frame, bits. The term datagram is used mostly for UDP at the transport level and sometimes for IP. Confusing segment (layer 4) and packet (layer 3) is a classic mistake.

1.4 The stack as a map of the attack surface and the cyber kill chain

Layered models are not only pedagogical: they serve as a grid for analyzing the attack surface. Each layer has its own protocols, devices and threats. The textbook recalls that the threat surface is largest and most complex at the Application layer, and that threat modeling, data-centric vulnerability modeling and user experience concentrate at the top of the stack. Reasoning layer by layer helps locate a weakness, choose the right countermeasure and miss nothing.

The textbook distinguishes two broad classes of problems: hazards (non-deliberate events - wear, power loss, fire, installation errors) and threats (deliberate actions by an actor, carried out through attacks). The key difference is intent. Hazards belong to safety, threats to security. This distinction guides countermeasures.

To structure the analysis of an attack, the textbook presents the cyber kill chain, a model inspired by military doctrine that breaks an intrusion into successive phases (reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives). This phasing helps recognize that seemingly isolated actions (a new phishing attempt, a previously unseen malware) may belong to one campaign, notably advanced persistent threats (APT) that span months.

Exam trap: the kill chain describes the sequence of an attack over time, whereas the OSI/TCP-IP stack describes where, in the architecture, each protocol or countermeasure acts. The two grids are complementary - one temporal, one structural - and the exam expects you to combine them without confusing them.

2.1 Transmission media: copper and fiber

Bound media rest on three families. Coax wraps a thick central conductor in an insulator, then a braided shield and a sheath. That shield makes it rugged against interference and harder to eavesdrop on, at the cost of a larger bend radius and a higher price than twisted pair. Twisted pair bundles pairs of twisted copper wires: the twist reduces electromagnetic interference (EMI) and crosstalk (signal bleed between neighboring pairs). We distinguish UTP (unshielded twisted pair), with no shielding, cheap and ubiquitous but more exposed to eavesdropping and interference, from STP (shielded twisted pair) whose grounded metal shield better protects the signal, at the cost of a stiffer, pricier cable. Categories (Cat5e, Cat6) set the throughput and quality; Ethernet over copper is limited to roughly 100 m.

Optical fiber carries not current but light pulses guided by reflection inside a glass or plastic core surrounded by an optical cladding. Because no electrical signal flows, fiber is fully immune to EMI and emits no exploitable radiation: tapping it is extremely difficult and usually detectable. Single-mode fiber (SMF) has a thin core that limits reflections and allows very long distances (up to 100 km); multimode fiber (MMF), with a wider core, uses cheap LEDs and serves short distances (~2000 m), ideal intrabuilding.

Security stake: choosing the medium is a physical-security decision. For a sensitive link between two buildings or in a high-EMI zone (workshop, electrical room), fiber is the obvious choice: no radiation, no easy tapping, total EMI immunity. On copper, prefer STP over UTP when confidentiality or the electromagnetic environment demand it.

Exam trap: do not conflate EMI immunity with tap resistance - fiber excels at both, but the decisive confidentiality argument is the absence of exploitable electromagnetic emanation. And remember that maximum distance depends on the fiber type (SMF long, MMF short), not merely on it being fiber.

2.2 Electromagnetic spectrum and unbound media

Unbound media transmit without a conductor, using a slice of the electromagnetic spectrum. People often say radio frequency (RF), but wireless also covers microwave, infrared and even visible light (Li-Fi) or acoustic waves. As frequency rises, wavelength shrinks and propagation characteristics change.

Radio waves (kHz to GHz) pass through walls and carry far: this is the band of AM/FM, Wi-Fi and cellular. Microwave (1 to 300 GHz) serves point-to-point links and satellites but requires line of sight. Infrared carries over short distances and does not pass through obstacles (remote controls, IrDA). Visible light enables Li-Fi: transmitting data by light modulation, a signal confined to the room and therefore harder to intercept from outside. Band allocation is regulated by governments to avoid interference between users.

Security stake: on an unbound medium the physical perimeter no longer protects. The longer the range (radio), the easier remote interception - a high-gain directional antenna or a drone captures the signal without entering the premises. The Wi-Fi RF space cannot be locked down; the countermeasure is to encrypt the link and monitor the spectrum (RF surveillance) to detect rogue transmitters.

Exam trap: do not reduce wireless to radio. The manual explicitly notes that wireless can also use light (Li-Fi) or acoustic waves. Conversely, fiber is not an unbound medium: it uses light but remains a bound medium because the light is confined inside the cable.

2.3 Network topologies

Topology describes how nodes are connected, physically and logically. Five shapes recur on the exam. The bus topology connects all nodes to a single backbone; every node receives all traffic and processes only what is addressed to it. Simple but fragile: a cable break takes the whole network down, and sharing the medium requires an access method (CSMA/CD for Ethernet). The ring topology forms a closed loop where data flows in one direction, from upstream to downstream neighbor, governed by a token. It is deterministic (predictable maximum wait time) but a simple ring is a single point of failure; dual-ring variants (FDDI) provide failover.

The star topology connects each node to a central device (hub, switch or router). It is the topology of modern LANs: easy to deploy, with simple node add/remove. Its weak spot is the central device, which is a single point of failure. The mesh topology connects each node to several others; a full mesh links all nodes together for maximum redundancy but is expensive (for N nodes, each needs N-1 links). A partial mesh is often deployed, where only the critical nodes (network core, firewalls, routers and their hot standbys) are fully meshed.

The tree (or hybrid) topology arranges nodes into hierarchical branches: adding a node is easy and a leaf failure does not affect the rest, but the loss of a branching node brings down all dependent nodes, and a cable break can paralyze the network.

Security stake and exam trap: availability depends directly on topology. Know the SPOF of each: the cable for the bus, the single node for a simple ring, the central device for the star, and the branching node for the tree; mesh by contrast is designed to remove the SPOF through redundancy. Watch the physical/logical trap too: Token Ring is wired as a physical star but operates as a logical ring.

2.4 Physical layer devices

Several devices operate purely at Layer 1: they manipulate the signal, never the address or the data. The line driver conditions a computer's internal signals into a voltage able to travel a long cable (internal signals attenuate within half a meter). The amplifier boosts the signal to extend its range, but it boosts the noise too; it is typically used for analog signals. The repeater regenerates the signal on a single link while stripping the noise, which distinguishes it from the amplifier; it is used for digital signals. The multiplexer combines several signals onto one transmission path, useful when bandwidth is limited (from a simple hub to DWDMs that multiplex several wavelengths onto a single fiber). The concentrator groups connections to send a signal on the network: a hub, like a switch, is a form of concentrator. The modem (modulator-demodulator) modulates a digital signal into analog form and demodulates it at the far end.

The hub deserves particular security attention. Being a Layer 1 device, it reads no address: it repeats every received signal out of all its ports. The direct consequence is three combined problems. First broadcast: every frame goes to all hosts, wasting bandwidth. Then collisions: all ports share one collision domain, so throughput collapses as traffic rises. Finally and above all sniffing: since every host receives every other host's traffic, a station in promiscuous mode can capture all the segment's communications.

Security stake: replacing a hub with a switch (Layer 2) solves all three problems. The switch learns MAC addresses and forwards each frame only to the destination port, isolating collision domains and preventing a host from passively eavesdropping on others' traffic. That is why no serious modern infrastructure still uses hubs.

Exam trap: at which layer does a repeater act? Layer 1 - it regenerates the signal without understanding the data. Do not confuse it with a switch (Layer 2, MAC addresses) or a router (Layer 3, IP addresses). And do not forget that the hub is also a Layer 1 device - that is precisely what makes it dangerous.

3.1 MAC/LLC sublayers and the Ethernet frame

The data link layer converts information from upper layers into bits formatted for the networking technology in use (Ethernet, token ring), and transmits frames to physically connected devices using hardware addresses. It splits into two sublayers. The MAC sublayer defines the 48-bit physical address (12 hexadecimal digits) etched into each network interface card (NIC): the first three octets identify the manufacturer (OUI assigned by the IEEE), the last three form the card serial number. The LLC sublayer, above it, interfaces with the logical addressing of the network layer (Layer 3), lets Layer 2 support multiple protocols, and can provide flow control and error correction.

The Ethernet frame (Figure 4.27) is laid out left to right: a preamble (synchronization), the destination MAC address (bytes 1 to 6), the source MAC address (bytes 7 to 12), the Ether Type / Length field (bytes 13-14), the variable-length payload from 46 to 1500 bytes, and finally the FCS (Frame Check Sequence, a 4-byte CRC) for error detection. The first three fields make up the Ethernet header. If the data link layer detects an error in a frame via the CRC, it asks its peer to resend that frame.

Security point: the MAC address is supposed to be unique and permanent, but it is trivially forgeable in software (MAC spoofing / cloning). Never treat a MAC address as a strong authentication factor. MAC filtering slows a casual attacker but does not resist an adversary who captures then replays a legitimate address seen on the segment.

Exam trap: do not confuse the data unit per layer. At Layer 2 we say frame; at Layer 3 packet; at Layer 4 segment. Check 4.1 stresses: segments are created at Layer 4, packets at Layer 3, frames at Layer 2, bits at Layer 1.

3.2 Media access: CSMA/CD vs CSMA/CA

On a shared medium, several stations risk transmitting at the same time and garbling each other's traffic. Networks must therefore arbitrate access. The manual distinguishes two families: polling protocols, where each station is granted an exclusive access slot (a deterministic network: per-station bandwidth degrades predictably as device count rises), and contention-based protocols, where with no polling the devices compete for bandwidth by sensing whether another device is trying to communicate (a probabilistic network).

CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is the wired method, part of the IEEE 802.3 standard. A station listens for the carrier before transmitting; if it detects no transmission, it sends. Two stations may still transmit nearly simultaneously: the collision is then detected by both, which each wait a randomly generated interval (backoff) before retransmitting. Collision detection assumes a medium on which the sender can listen while transmitting, which is the case for wired links.

CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) is the method favored in wireless environments, part of the IEEE 802.11 standard. Rather than detecting collisions after the fact, it tries to avoid them up front: the station checks that the medium is clear, then sends a Request to Send (RTS) control frame to the access point; if the access point accepts, it returns a Clear to Send (CTS) to all stations on the segment, reserving the channel and preventing others from transmitting. On wireless, you cannot reliably listen while transmitting (hidden-node problem), hence the choice of avoidance over detection.

Classic exam trap: pairing the wrong method with the wrong medium. Remember: CD = wired (802.3, collision detected), CA = wireless (802.11, collision avoided via RTS/CTS).

3.3 ARP and address resolution (and ARP poisoning)

The most important protocol at Layer 2 is ARP (Address Resolution Protocol). It is a technology-independent protocol: one side deals with MAC addresses, the other with IP addresses, but it need not know the details of the other Layer 2 protocols. ARP provides direct communication between two devices on the same LAN segment. When a station wants to send an IP packet, it must resolve the recipient's logical address (IP) into a physical address (MAC), because the frame needs physical addresses to travel on the segment.

The exchange (Figure 4.28) happens in two steps. First an ARP request broadcast to the whole segment (destination address FF:FF:FF:FF:FF:FF): "who has IP 10.10.1.15?". Then only the machine owning that IP replies, in unicast, with its MAC address: "10.10.1.15 is at MAC AA-08-00-13". The requester then updates its local ARP cache with this IP to MAC mapping, to avoid asking again for every frame.

The structural design flaw: ARP has no authentication. Any machine can send an unsolicited ARP reply (gratuitous ARP) or answer a request without being the legitimate target. The ARP poisoning (or ARP spoofing) attack injects spurious ARP traffic onto the segment to make one or more machines wrongly update their local ARP cache. Their traffic is then redirected to the attacker's machine. This attack is the cornerstone of many Man-in-the-Middle attacks: once the cache is poisoned, the attacker intercepts (and can alter) all traffic between the two victims.

Countermeasures: Dynamic ARP Inspection (DAI) on switches validates ARP replies against a trusted IP/MAC binding table (typically built by DHCP snooping) and drops inconsistent replies. You also actively monitor ARP and DHCP services, and can pin static ARP entries for critical gateways. DAI and DHCP snooping come from the cheat sheet and transversal CBK rather than the D4 text, which mentions at the principle level "service monitoring (ARP, DHCP)".

Exam trap: if a scenario describes two victims whose traffic suddenly transits through a third party on the same LAN, the keyword is ARP poisoning / MITM, and the expected defense is DAI (not end-to-end encryption, which limits impact but does not prevent the L2 hijack).

3.4 Switching and VLANs

Two device types operate at Layer 2: bridges and switches. A bridge filters traffic between segments based on MAC addresses and amplifies the signal to physically extend the network. A simple (transparent) bridge connects two segments of the same L2 architecture (Ethernet to Ethernet); a translational bridge connects different L2 architectures (Ethernet to token ring). A bridge does not prevent an intruder from intercepting traffic on the local segment, and a wireless bridge makes all traffic crossing it visible to anyone connected to the LAN, which is a major risk. Check 4.1 notes: a bridge typically has only two ports and connects segments, whereas a switch has more ports.

The switch is the core of modern LANs. A Layer 2 switch establishes one collision domain per port, making transmissions far more efficient than on a shared medium. Crucially, it learns which devices are connected to each port by observing the source MAC addresses of frames, and stores these port to MAC associations in a CAM (Content Addressable Memory) table. It then switches each frame only toward the recipient's port instead of flooding it everywhere. Switches offer many security features: port blocking, port authentication, MAC filtering and VLANs. A Layer 3 switch combines switch and router and can decide based on either the MAC or IP address.

VLANs (Virtual LANs, Figure 4.31) let you create software-based distinct LAN segments across one or more switches: devices in the same VLAN communicate as if on the same L2 network, even when physically scattered. A VLAN can be configured by switch port, IP subnet, MAC address or protocol. Because VLANs act as discrete networks, communication between VLANs must go through higher-layer services (Layer 3 / routers). Broadcast traffic is confined to the VLAN, reducing congestion and the effectiveness of L2 attacks. Carrying several VLANs over a single inter-switch link uses an 802.1Q tagged trunk, which adds a VLAN tag to each frame.

Major security point: VLANs do not guarantee network security. There are attacks (VLAN hopping, also called 802.1Q attacks) that let a malicious user see traffic from other VLANs. The VLAN is one tool among others to improve the overall posture, not an absolute security boundary. The manual lists L2 threats: MAC spoofing/cloning, MAC flooding (mass sending of frames with bogus source MAC addresses), VLAN hopping, broadcast storms and reconnaissance via MAC sniffing. Recommended countermeasures: proper NIC configuration, service monitoring (ARP, DHCP), proper VLAN and switch port configuration, and Layer 2 IDS/IPS.

Exam trap: MAC flooding deliberately saturates the switch CAM table. When the table overflows, many switches fail open and flood all frames on all ports (like a hub), enabling sniffing. The native defense is port security (limiting the number of MAC addresses learned per port). For VLAN hopping, the defense is to disable automatic trunk negotiation (DTP) and avoid leaving access ports on the default native VLAN.

4.1 IPv4 addressing: structure and classes

An IPv4 address is 32 bits, written in dotted-decimal notation: four octets separated by dots, each from 0 to 255 (for example 216.12.146.140). Every address splits into two parts: the network number, assigned by an external authority such as ICANN, and the host number, which identifies the interface within that network. The boundary between the two is set by the subnet mask.

Historically that boundary depended on the class, determined by the first octet. Class A (1 to 126) reserves one octet for the network, default mask 255.0.0.0 (/8), up to 16,777,214 hosts. Class B (128 to 191) uses two octets, 255.255.0.0 (/16), 65,534 hosts. Class C (192 to 223) uses three, 255.255.255.0 (/24), 254 hosts. Class D (224 to 239) is reserved for multicast and class E (240 to 255) for development and testing.

Two ranges stand apart. The 127.0.0.0/8 block, inside the class A zone, is reserved for loopback: 127.0.0.1 lets a machine diagnose itself, as if pinging a remote host. APIPA (169.254.x.x) is self-assigned when DHCP fails and provides only limited local connectivity.

Exam trap: classes are now obsolete, replaced by CIDR. On the exam, know how to recognize them (first-octet range, default mask), but remember that real partitioning is done by /n prefix, with no class constraint.

4.2 Private addresses, NAT and PAT

The 32-bit IPv4 space was too small for the number of connected devices. To save public addresses, IPv4 reserved private ranges, freely reusable by any organization because they are never routed on the Internet: 10.0.0.0 to 10.255.255.255 (A), 172.16.0.0 to 172.31.255.255 (B) and 192.168.0.0 to 192.168.255.255 (C). These ranges form RFC1918, a term to know even though the manual mostly describes the concept.

Sharing relies on the router. It reads the destination address: if it falls in the private range, it filters the packet (keeps it inside); if it is public, it forwards it to the WAN. Translation between internal private addressing and a public address is NAT (Network Address Translation). The boundary router exposes a single public IP supplied by the ISP (for example 1.1.1.1) on the Internet side and hides the internal topology.

When several private hosts must share one public address, PAT (Port Address Translation) is used, also called NAT overload: the router tells sessions apart by source port number. This is the mechanism in nearly every home router. Do not confuse it with loopback (127.0.0.1), purely local and never translated, nor with APIPA (169.254.x.x), used only if DHCP fails.

Exam trap: NAT hides topology and hampers reconnaissance, but it is NOT a reliable security control. It does not inspect content, does not filter upper layers and breaks down as soon as an outbound session is initiated from inside. Security remains the job of the firewall and ACLs, not NAT.

4.3 Subnetting and CIDR (calculation)

To ease administration and segment traffic, a network is divided into subnets. Since the address alone does not distinguish subnets, the subnet mask does it: a mask bit is 1 when the matching address bit serves the network or subnet, and 0 when it serves the host. The mask 11111111 11111111 11111111 00000000 is written 255.255.255.0, or /24 in CIDR notation (the count of 1s in the mask).

CIDR (Classless Inter-Domain Routing) frees partitioning from classes: you choose the prefix length to fit the need. To subnet, you borrow bits from the host part. The number of subnets created is 2 to the power of the borrowed bits. The number of addresses per subnet is 2 to the power of the remaining host bits, but the number of usable hosts is that result minus 2, because the first address identifies the network and the last is the broadcast address.

Worked example: split 192.168.1.0/24 into /26. Borrow 2 bits (24 to 26), so 2^2 = 4 subnets: .0, .64, .128, .192. Six host bits remain, so 2^6 = 64 addresses per subnet, of which 64 - 2 = 62 usable hosts each. The /26 mask is 255.255.255.192.

Remember the master formula: usable hosts = 2^(host bits) - 2, subnets = 2^(borrowed bits). Useful exam landmarks: /30 = 2 hosts (point-to-point links), /29 = 6 hosts, /28 = 14 hosts, /25 = 126 hosts, /23 = 510 hosts. To get at least N subnets, pick the smallest b such that 2^b is greater than or equal to N. This section is enriched beyond the manual (provenance cbk), since the official text stays light on detailed calculation.

4.4 IPv6, ICMP and transmission modes

IPv6 modernizes IPv4 and fixes several of its weaknesses. Its address field grows from 32 to 128 bits, that is 2^128 addresses (a 39-digit number), which makes exhaustion theoretically impossible. It natively integrates IPsec for integrity, confidentiality and mutual authentication of partners, and improves QoS. An IPv6 address is written in eight hexadecimal groups. Important: a single network cannot run IPv4 and IPv6 simultaneously; the transition uses dual stack, tunneling or native conversion, via a bridge or gateway.

ICMP (Internet Control Message Protocol), the well-known ping, exchanges control messages between hosts and gateways. It is the basis of diagnostic tools such as ping and traceroute. It is a routed protocol, using the routing infrastructure without contributing to it. Useful for administration, ICMP is also abused for attacks: MITM, DoS, ping flooding, smurf (broadcast amplification).

Layer 3 has four transmission modes. Unicast is one-to-one: one sender, one recipient. Multicast is one-to-many-of-a-group: the sender delivers to a subset of hosts that joined a multicast group (managed by IGMP). Broadcast is one-to-all on the segment: every host receives, which serves service discovery (for example an ARP request) but consumes bandwidth and can be abused to flood a segment.

Anycast is one-to-one-of-many: several nodes share the same address, and the message goes to the topologically closest node (fewest hops) or the least-loaded path. CDNs use it to bring content closer to users. Exam trap: do not confuse multicast (a defined group of subscribers) with broadcast (the whole segment), nor anycast (the nearest of a group) with unicast (a single fixed target).

4.5 Routing and routers

The router is the emblematic layer-3 device. It reads a packet's destination IP and, based on its view of the network, determines the next hop. If it does not know the destination network, it sends the packet to its default gateway, hoping it knows more. The router relies on a routing table and, for basic security, on an ACL (access control list) that permits or denies addresses and ports. A router placed between the LAN and the outside world is a boundary router (often on the DMZ).

Static and dynamic routing must be distinguished. Static routing pins routes by hand: simple and predictable, but unmanageable at scale. Dynamic routing uses routing protocols that automatically exchange information to build and maintain tables. Mind the trap: a routing protocol (RIP, OSPF, BGP) coordinates routers with each other, whereas a routed protocol (IPv4, IPv6, ICMP) is simply carried by the infrastructure.

Routing protocols split into IGP and EGP. IGPs (Interior Gateway Protocols) operate inside an autonomous system (AS). They include RIP (distance-vector, hop-count metric, capped at 15 hops, RIPv1/v2 obsolete) and the link-state OSPF and IS-IS, which compute the shortest path (SPF) accounting for link speed, congestion and availability. OSPF converges fast but consumes CPU and memory.

EGPs (Exterior Gateway Protocols) connect ASes together. The main one is BGP (path-vector), the Internet backbone, which advertises an AS's networks to another. Trap and security stake: BGP relies on correct configuration; misconfigured peers can redirect traffic (route hijack), opening the door to monitoring or DoS, as in 2017 when financial institutions' traffic was rerouted through a Russian ISP. Boundary routers between ASes therefore carry major security responsibility.

5.1 TCP vs UDP and the three-way handshake

TCP (Transmission Control Protocol) is a connection-oriented protocol that guarantees reliable, ordered delivery. It numbers segments, letting the receiver request retransmission of a missing or corrupted segment, and it handles flow control. This reliability has a cost: connection setup, acknowledgments and teardown add overhead, especially when losses force retransmissions.

A TCP connection opens with a three-way handshake. The initiator sends a packet with the SYN flag set to 1 (state SYN-SENT). The server allocates resources and replies with a SYN-ACK (state SYN-RECEIVED). The initiator returns an ACK: the connection is ESTABLISHED on both sides. Graceful teardown uses FIN then ACK on each side (states FIN-WAIT, CLOSE-WAIT, LAST-ACK, CLOSED). The main flags to know are SYN, ACK, FIN, RST (abrupt reset), PSH and URG.

UDP (User Datagram Protocol) is connectionless: the sender just sends, expecting no acknowledgment. There is no handshake, no state, no native retransmission. This delivers maximum throughput and minimal overhead, ideal for voice, video, DNS or CDNs where occasional loss is acceptable. The flip side: the lack of state makes UDP convenient for attacks, since routers and firewalls have no connection to observe and track.

Exam trap: do not confuse reliable with secure. TCP is reliable (guaranteed delivery) but neither TCP nor UDP encrypts on its own; confidentiality comes from TLS on top. And remember that the three-way handshake is exactly what a SYN flood exploits.

5.2 Ports, sockets and assigned protocols

A port is a 16-bit numeric identifier designating the targeted software service on a host. Both TCP and UDP use ports to steer traffic: an HTTPS browser directs its data to port 443. The combination IP address + port number forms a socket, that is, the unique endpoint of a communication. It is the socket, not just the IP, that lets a machine hold several simultaneous conversations.

IANA sorts ports into three ranges. Well-known ports (0 to 1023) map to the core TCP/IP protocols (DNS 53, SMTP 25, HTTP 80, HTTPS 443). Registered ports (1024 to 49151) are often tied to vendor proprietary applications (RADIUS 1812, MS SQL Server 1433/1434, Docker 2375/2376). Dynamic or private ports (49152 to 65535) are assigned on the fly for a session on the client side, then released.

Worth memorizing: 20/21 FTP, 22 SSH, 23 Telnet, 25 and 587 SMTP, 53 DNS, 69 TFTP, 80 HTTP, 161/162 SNMP, 389/636 LDAP/LDAPS, 443 HTTPS, 1433/1434 MS SQL, 3389 RDP. Several services offer an encrypted port and a cleartext port (FTP/SFTP, HTTP/HTTPS, Telnet/SSH, LDAP/LDAPS): when in doubt, always deploy the most secure version of the protocol.

Exam trap: assigned port numbers are a convention, not a law. An administrator can remap a service to another port, which is sometimes used to obscure usage. Security must therefore never rest on the port number alone (security through obscurity); a firewall that filters only by port is bypassed by a relocated service.

5.3 Firewalls: from packet filter to NGFW

A firewall enforces policy by filtering traffic against a rule set, ideally with a default deny posture (anything not explicitly allowed is rejected). The packet filter, the historical form, is stateless: it decides packet by packet by looking at IP address, port, protocol and TCP flags, at Layer 3/4. Fast and simple, but blind to context: it cannot tell whether a packet belongs to a legitimate already-established connection.

Stateful inspection fixes this by keeping a connection state table. It allows the return traffic of a session it saw opening and blocks packets that match no expected state, making it far more resistant to forged packets. It still operates mainly at Layer 3/4. Above it, proxies work at the session or application level: the circuit-level proxy creates a TCP/UDP conduit (Layer 5) without inspecting content, while the application proxy relays traffic per application (Layer 7) and analyzes the payload, spotting for instance buffer overflows, at the cost of higher overhead. A proxy also hides the internal host behind its own address.

The next-generation firewall (NGFW) consolidates these capabilities in a single framework: stateful inspection, proxy services, intrusion prevention (IPS) and tight IAM integration to permit only authorized users. It filters from Layer 3 (IP ranges) to Layer 7 (APIs and applications), where the traditional firewall stayed at Layer 4. The WAF (Web Application Firewall) is specialized for Layer 7 web: it protects web applications against SQL injection, XSS and application abuse.

Exam trap: NGFW and WAF are not interchangeable. The NGFW is a general-purpose multilayer firewall for network traffic; the WAF is dedicated to a web application's HTTP/HTTPS traffic. And remember the packet filter (stateless) vs stateful (tracks connection state) distinction, a QCM classic.

5.4 IDS/IPS and filtering architectures

An IDS (Intrusion Detection System) watches traffic or host activity to detect suspicious behavior, then alerts. It is passive and placed out-of-band: it receives a copy of the traffic, typically via a TAP or a mirror port, and is not on the packet path. Consequence: it does not slow the network, but on its own it cannot stop an attack. An IPS (Intrusion Prevention System) does the same detection work but inline, on the traffic path, letting it block or alter malicious packets. Formula to remember: the IDS detects and alerts, the IPS detects and blocks.

Scope comes in two families. The NIDS/NIPS monitors a network segment via a sensor; the HIDS/HIPS is an agent installed on a host, also seeing local events (file integrity, logs). They are often combined: NIDS for the overall view, HIDS for detail on sensitive assets.

Two detection methods coexist. Signature-based detection compares traffic to a database of known attack patterns: precise on the known, but blind to the new (false negatives on 0-days). Anomaly-based (behavioral) detection first establishes a baseline of normal traffic then flags deviations: able to spot the unknown, but prone to false positives if the baseline is poorly calibrated. Every alert, false positive or true positive, demands human analysis.

On the architecture side, filtering is organized into zones. The bastion host is a heavily hardened, exposed server, the only one allowed to talk to the outside (jump box). The dual-homed host has two interfaces with no direct routing between them. The screened host puts a firewall in front of a bastion. The screened subnet (DMZ between two firewalls) isolates exposed servers (mail, web) from the internal network. Exam trap: place the NIPS inline at choke points (gateway, DMZ boundary) and the NIDS listening on segments to monitor; confusing passive/active or detect/block is the most common mistake.

6.1 Session layer: RPC and dialogue modes

The session layer (Layer 5) establishes, maintains and tears down dialogues between two nodes. It is the layer that, when a connection to a remote system is lost, tries to re-establish it. The dialogue can follow three modes: simplex (transmission one way only, like a sensor that only emits), half-duplex (both directions but not at once, like a walkie-talkie) and full-duplex (both directions simultaneously, like a phone call). Knowing these three modes and being able to illustrate them is an exam classic.

A hallmark mechanism of this layer is the Remote Procedure Call (RPC). RPC allows code to be executed on a remote host: the RPC client sends a request (the calling code) to a called procedure residing on another host. RPC behaves as a brokering service that provides basic authentication and a way to request that work be performed remotely. Properly implemented, it is not a risk; poorly configured or not robust, it becomes a significant entry point.

A crucial security point: the ISO 7498-2 standard states that no security services are provided at the session layer. Vulnerabilities must therefore be addressed by applying security services above or below it (for example TLS, which establishes a session but provides encryption and spills outside the OSI model). Attacks targeting this layer include session hijack, man-in-the-middle (MITM), man-in-the-browser (MITB) and SSH downgrade attempts. Countermeasures: replace weak password authentication protocols (PAP), migrate to strong identity management, use a PKI and actively monitor with IDS/IPS/SIEM.

6.2 Presentation layer: encoding, formats, encryption

The presentation layer (Layer 6) takes the information formatted by the sender and reformats it so the receiver can understand it. This reformatting covers three services: character encoding, encryption and compression. It is the layer responsible for information formatting - a recurring exam point (the right answer to 'which layer formats information?' is presentation, not application).

The translation service handles standard encoding sets: ASCII, EBCDIC (inherited from IBM mainframes) and Unicode (UTF-8 now dominates the Web). When two platforms use different encodings, a gateway performs the conversion: it is the only device that truly operates at the presentation layer. The gateway can also convert IPv4 to IPv6 or provide compression and encryption. The classic example: an ASCII to EBCDIC gateway linking a modern workstation to a mainframe.

Encryption and compression are Layer 6 services here, even though they can be managed by other layers (the OSI model is a guideline, not a strict specification). SSL/TLS and S/MIME are often cited as encryption protocols of this layer. On the threat side, L6 attacks mainly target confidentiality and integrity: exfiltration of encrypted data using the system's own encryption capabilities, downgrade of encryption to a breakable algorithm, SQL injection and cross-site scripting. Countermeasures include deep inspection of application traffic, WAF and migration to a zero trust architecture.

6.3 Application layer and legacy protocols

The application layer (Layer 7) is the closest to the user and offers the largest attack surface of the whole model. Watch the trap: the applications the user launches (browser, office suite, Teams, Zoom) do not reside at this layer; they consume Layer 7 services. Among the emblematic protocols: HTTP/HTTPS (which use TCP, not UDP, and where HTTPS adds TLS), FTP (file transfer), SMTP (mail sending), SNMP (infrastructure management), Telnet (remote terminal) and LDAP (directory services).

The central exam point of this lesson: legacy protocols. The original Internet protocols were never designed with security as a primary goal. FTP, Telnet and the finger command transmit credentials and data in clear-text, offer no strong authentication and are subject to packet manipulation. Telnet exposes a terminal session in clear (replace with SSH); FTP exposes login and files (replace with SFTP or FTPS). SNMP v1 and v2 use community strings sent in clear, easily intercepted by brute-force or sniffing - only SNMPv3 adds encryption. LDAP runs by default in clear on TCP port 389; its version 3 can use TLS (LDAPS) to encrypt.

LDAP deserves special attention: heir to the X.500 standard, it organizes entries in a hierarchical tree with the concepts of Distinguished Name (DN, unique identifier), Relative Distinguished Name (RDN, first component of the DN), Common Name (CN), Domain Component (DC) and Organizational Unit (OU). Directories are prime targets because they concentrate information about users and resources and integrate tightly with IAM tools. Layer 7 threats are numerous: SQL injection, SNMP abuse, HTTP floods/DDoS, cross-site scripting, LDAP injection, and attacks on name and address resolution (rogue DHCP, DNS poisoning). Countermeasures: MFA, deep inspection, WAF, blocking suspicious sites/bots and migration to secure protocols.

6.4 DNS: name space, resolution and records

The Domain Name System (DNS) resolves Fully Qualified Domain Names (FQDN) to IP addresses, because humans poorly remember long strings of numbers. Invented by Mockapetris, Postel and Su, DNS relies on a hierarchical name space: at the very top the root, represented by the administrative trailing dot of a FQDN, which manages the Top-Level Domains (TLD: .com, .org, .gov, .edu...). TLDs point to second-level domains (such as isc2.org), then come third- or fourth-level subdomains (www.isc2.org, mail.isc2.org). Each level must be resolvable to a unique IP address.

Resolution follows a precise path. The client first checks its local DNS cache, then its local HOSTS file. If it does not find it, it sends a query to its local DNS server: this is a recursive query, where the resolver takes on all the work and returns the final answer to the client. To obtain that answer, the resolver itself chains iterative queries by successively asking the root servers, then TLD, then the authoritative servers until it finds the record. Distinguishing recursive (the resolver does everything for the client) from iterative (the resolver hops from server to server) is an exam point.

Different services require different record types. The most used: A (resolves a FQDN to an IPv4 address), AAAA (to IPv6), MX (identifies a domain's mail relay), CNAME (creates a name alias), NS (delegates a zone to a name server), PTR (reverse resolution address to name, the reverse lookup), TXT (free text, often for SPF/DKIM/DMARC), SOA (Start of Authority) and SRV (locates the port and host of a service such as LDAP or SIP). DNS is organized into zones: a coherent set of records administered as a unit, delegated by an NS record.

6.5 DNSSEC, DHCP and associated attacks

The original DNS specification never built in security: no authentication, no non-repudiation, and no mechanism guaranteeing that zone transfers were not manipulated. The IETF therefore published DNSSEC (DNS Security Extensions), which automates the trust anchor process to validate the many DNS systems in a resolver's hierarchy. DNSSEC signs the records (RRset) with RRSIG signatures, and each level of the chain (root, TLD, domain) signs the child level's key via DS records, forming a chain of trust anchored at the root. The resolver validates the signatures: if they are missing or invalid, the answer is rejected. Major exam point: DNSSEC guarantees the integrity and authenticity of DNS answers, but NOT confidentiality - DNS traffic remains in clear.

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses from a preconfigured pool. Its exchange follows the four-step DORA cycle: Discover (the client broadcasts a request), Offer (the server proposes an address), Request (the client asks to accept that address) and Acknowledge (the server confirms). If no server replies within the allotted time, the client self-assigns an APIPA address in the 169.254.x.x range. DHCPv6 does the equivalent for IPv6.

These infrastructure services are the target of characteristic attacks. On the DNS side: cache poisoning injects a forged answer into a resolver's cache to redirect victims to a rogue IP; DNS spoofing falsifies answers; DNS hijacking diverts the configuration or the domain itself. DNSSEC counters these forgeries by rejecting any answer with an invalid signature. On the DHCP side: a rogue DHCP server distributes false configurations (attacker-controlled gateway, DNS) to perform a MITM; DHCP starvation exhausts the address pool by massively requesting leases, causing a denial of service and easing the planting of the rogue server. Countermeasures: DNSSEC, DHCP snooping and port security on switches, monitoring for rogue DHCP servers.

7.1 Secure vs unsecured protocols: overview

The Internet's legacy protocols authenticate and transmit in the clear by design. Telnet sends each character echoed between hosts and is limited to username/password authentication with no encryption; once low-level credentials are captured, privilege escalation is trivial because the telnetd daemon often runs with system privileges. The UNIX services rlogin, rsh and rcp rely on unverified host/IP mutual trust and transmit without encryption: they are subject to interception and should be replaced by SSHv2.

The modern approach substitutes an encrypted equivalent for the cleartext protocol, usually on a different port. A few pairs to memorize: HTTP (80) becomes HTTPS via TLS (443); FTP (20/21) becomes FTPS (TLS) or SFTP (transfer over SSH, 22); Telnet (23) becomes SSH (22); SMTP (25) is secured via STARTTLS or authenticated submission (587); SNMPv1/v2 (161/162) becomes SNMPv3; LDAP (389) becomes LDAPS via TLS (636).

The layer choice matters. TLS sits above TCP and protects a given application (an HTTPS flow protects all of its content); IPsec operates below IP and protects all traffic between two points without changing applications. The exam reflex: a cleartext protocol is never fixed by a mere password; you must either replace it or wrap it in a cryptographic channel (TLS, SSH, IPsec).

7.2 TLS/SSL and the handshake

Transport Layer Security (TLS) is the successor of Secure Sockets Layer (SSL), now obsolete and forbidden (SSLv2/SSLv3 are vulnerable, e.g. POODLE). TLS establishes a session then provides encryption and integrity; it fits neatly into neither the OSI nor TCP/IP model and acts as a cross-layer protocol above TCP. HTTPS, for instance, carries HTTP inside a TLS tunnel on port 443.

The handshake negotiates everything both parties need. The client sends a ClientHello (supported versions, cipher suites, random value); the server replies with a ServerHello (chosen suite, random), presents its X.509 certificate (server authentication via the PKI) and the key-exchange parameters. Both sides then perform a key exchange, then each sends a Finished message; application traffic then flows in a channel encrypted with a symmetric session key.

Forward secrecy (PFS) is a key exam point: by using an ephemeral Diffie-Hellman exchange (ECDHE/DHE), the session key never derives directly from the certificate's private key. Thus a later compromise of that private key does not allow decryption of captured past sessions. TLS 1.3 mandates forward-secret suites, removes weak algorithms and reduces the handshake to 1 RTT (versus 2 RTT in TLS 1.2). Trap: SSL is dead, talking about SSL today means TLS; and the certificate authenticates the server, not the client (unless mutual TLS).

7.3 IPsec: AH, ESP, transport vs tunnel

Internet Protocol Security (IPsec) is a suite of protocols that secures IP by providing authentication and encryption. Standard IPsec only authenticates hosts to each other; to authenticate users, IPsec is combined with L2TP. IPsec offers two protection protocols. The Authentication Header (AH) proves the origin's identity and guarantees integrity through a negotiated hash, and includes a per-packet sequence number to counter replay: AH provides authenticity and integrity but NOT confidentiality. The Encapsulating Security Payload (ESP) encrypts the packet and guarantees its integrity; it has a header (SA + sequence), an encrypted payload (with IV if needed), a trailer (padding) and an optional authentication field.

IPsec operates in two modes. In transport mode, only the IP payload is protected and the original IP header is kept: this is end-to-end (host-to-host) use, typically client to server. In tunnel mode, the payload AND the original IP header are protected, then the whole becomes the payload of a new packet with a new IP header: this is between-networks (gateway-to-gateway) use, typically firewall-to-firewall VPNs.

This difference is critical against NAT. IPsec interprets any address change in the headers as an attack; tunnel mode survives NAT because the original source stays protected inside, whereas transport mode would have the packet rejected as altered. NAT-Traversal (NAT-T) solves this by encapsulating IPsec in UDP port 4500. Keys are managed by Internet Key Exchange (IKE), built on ISAKMP, relying on Diffie-Hellman (between routers) or public-key certificates (user VPN). Each Security Association (SA) defines algorithms, the AH/ESP choice and direction; since an SA is unidirectional, two-way communication requires two SAs.

7.4 SSH, S/MIME, SNMPv3, SRTP and email security

Secure Shell (SSHv2) is the standard for remote administration: it replaces Telnet, rlogin, rsh and rcp by offering strong authentication (public keys or password), confidentiality and integrity on port 22. It also serves as transport for SFTP and as a tunnel to forward other protocols. Exam trap: beware SSH downgrade attempts (forcing a weak version or algorithms) and prefer key-based authentication.

On the email side, S/MIME provides signing (integrity + non-repudiation) and message encryption via per-user X.509 certificates. Three anti-spoofing mechanisms complete the defense at the DNS level: SPF (Sender Policy Framework) publishes the servers authorized to send for a domain; DKIM (DomainKeys Identified Mail) cryptographically signs the message to prove its authenticity and integrity; DMARC builds on SPF and DKIM to define the policy (reject, quarantine) and reporting. SPF, DKIM and DMARC are not in the D4 textbook (DKIM/S/MIME appear in the cheat sheet) and are here of cheat/cbk provenance.

SNMP manages network infrastructure via a manager and agents. SNMPv1/v2 transmit community strings (passwords) in cleartext and are vulnerable to brute force; SNMPv3 fixes this by adding authentication and encryption: it is the only version to deploy. Finally, SRTP (Secure Real-time Transport Protocol) secures voice and video (VoIP) by encrypting and authenticating RTP flows, where plain RTP is in the clear. SRTP is an exam complement not detailed in the textbook (cbk provenance).

7.5 Kerberos: network authentication

Kerberos is a ticket-based network authentication protocol that lets a client and a service mutually prove their identity without sending a password over the network. It relies on a trusted third party, the Key Distribution Center (KDC), made up of the Authentication Server (AS) and the Ticket Granting Server (TGS). Kerberos uses symmetric cryptography and provides mutual authentication, which counters server impersonation.

The flow has two stages. First the client authenticates to the AS and receives an encrypted Ticket Granting Ticket (TGT). Then, to access a service, it presents the TGT to the TGS, which issues a service ticket; the client finally presents that ticket to the target service, which validates it. The major benefit is single sign-on: one initial login grants access to many services via tickets, and the password never travels in the clear.

The most important exam weakness is sensitivity to clock skew. Tickets contain timestamps to limit their lifetime and counter replay; if the clocks of the client, KDC and service diverge beyond tolerance (typically 5 minutes), authentication fails, hence the critical dependence on reliable NTP synchronization. Another sensitive point: the KDC is a single point of failure and a high-value target, because its compromise exposes the entire authentication domain.

8.1 Wi-Fi 802.11 and its security (WEP to WPA3)

Wi-Fi rests on the IEEE 802.11x family of standards. A Wi-Fi network associates clients with a wireless access point (WAP), itself usually connected to the wired network. The WAP broadcasts a network identifier, the SSID. A single WAP forms a Basic Service Set (BSS); several WAPs sharing the same SSID form an Extended Service Set (ESS) that enables roaming. Wi-Fi operates on two main bands: 2.4 GHz (longer range, more crowded) and 5 GHz (higher throughput, shorter range). Versions have evolved (802.11n, 802.11ac, then 802.11ax/Wi-Fi 6); backward compatibility lets an old laptop connect to a recent router, but maximum throughput requires the same generation on both ends.

Wi-Fi security is a timeline of breaks and fixes. WEP (1999) uses RC4 with a 24-bit IV that is too short plus a static key: it has been broken for years, a key is recovered in minutes. WPA (2003) was a transitional patch introducing TKIP (still on RC4, with a per-packet key): deprecated. WPA2 (2004) mandates AES in CCMP mode, the real qualitative leap, but remains vulnerable to the KRACK attack on the four-way handshake. WPA3 (2018) replaces the PSK exchange with SAE (Simultaneous Authentication of Equals, a.k.a. Dragonfly), bringing forward secrecy and resisting offline dictionary attacks.

Two recurring traps. First WPS (Wi-Fi Protected Setup): this PIN-based setup mechanism is vulnerable to brute force and must be disabled, regardless of the WPA protocol chosen. Second, the mode distinction: the -Personal suffix (PSK) shares a single passphrase for everyone, while -Enterprise delegates authentication to a RADIUS server via 802.1X (see next lesson), offering individual identities and revocation. Hiding the SSID or filtering MAC addresses are not reliable security controls: both are trivially bypassed by sniffing.

8.2 Wireless authentication: 802.1X and EAP

IEEE 802.1X is a port-based access control framework. It stages three roles: the supplicant (the client wanting to connect), the authenticator (the WAP or switch that controls the access port), and the authentication server (typically a RADIUS server holding the identity directory). Until authentication succeeds, the authenticator keeps the port closed to all traffic except the authentication messages themselves. This is the key difference from PSK mode: each user has their own identity, centrally verified and individually revocable.

The authentication dialogue uses EAP (Extensible Authentication Protocol). EAP is not a single method but an extensible envelope: supplicant and server negotiate a concrete method. On the wireless segment EAP is encapsulated in EAPOL (EAP over LAN) between supplicant and authenticator; the authenticator then relays toward the server in RADIUS packets. The textbook stresses that EAP uses stronger encryption to protect credentials during their exchange, either with a pre-shared key (EAP-PSK), or with TLS (EAP-TLS) for more robust protection, or via PEAP which lets the organization choose the kind of certificate-based authentication that fits its architecture.

The variants differ in strength and deployment cost. EAP-TLS requires certificates on BOTH client and server (mutual authentication): it is the most robust but mandates a PKI. PEAP sets up a TLS tunnel authenticated server-side only, inside which simpler credentials are presented: lighter to deploy, very widespread. EAP-PSK relies on a pre-shared key: simple, but security collapses if the key leaks. Exam trap: 802.1X is the framework, EAP the method, RADIUS the transport to the server; WPA2-Enterprise and WPA3-Enterprise rely on this trio.

8.3 Other wireless technologies

Beyond Wi-Fi, the exam expects a mental map of other wireless technologies, ordered by increasing range. At the shortest, NFC (Near Field Communication, 13.56 MHz, under 10 cm) serves contactless payment, badging and pairing bootstrap. RFID (passive batteryless tags or active battery-powered ones, from a few centimeters to several meters) equips inventory and physical access control. Bluetooth (IEEE 802.15, WPAN) aims to replace cables between nearby peripherals: the textbook cites a maximum range of 100 m, but the common Class 2 caps around 10 m, with enough throughput for high-fidelity audio; pairing establishes trust between two devices.

Zigbee (a network layer atop IEEE 802.15.4) targets very-low-power connected objects, over mesh, tree or star topologies. The textbook stresses its key management: devices ship with a preinstalled 128-bit symmetric key that Zigbee can update, the goal being to avoid sending the key in the clear on the data channel. But it warns that many home-automation products kept only the factory key, never refreshed, and that this key has sometimes become public: as in any symmetric scheme, if the key leaks, all security falls.

For long range, cellular (generations 1G to 5G, standardized by 3GPP) covers kilometer-scale cells via base stations; 5G NR targets rates up to 20 Gbps and massive IoT, interoperating with 4G LTE where coverage is lacking. Satellite delivers broadband to remote areas, at the cost of higher latency and packet loss, sensitive to weather and line of sight. Finally Li-Fi transmits over visible light: very high local throughput, confined to the room and immune to RF interference, but blocked by any opaque obstacle.

8.4 Wireless attacks and countermeasures

Because the medium is shared and open, wireless concentrates a family of dedicated attacks. Reconnaissance often starts with war driving: roaming an area to map reachable Wi-Fi networks and their protection level. Next comes the rogue AP, an unauthorized access point plugged into the corporate network by an employee or attacker, opening a back door that bypasses the perimeter. Its cousin, the evil twin, is a fake WAP mimicking the legitimate SSID to lure clients: the attacker then inserts a man-in-the-middle and captures credentials.

Several attacks exploit 802.11 management frames, historically unauthenticated. The deauthentication (deauth) attack sends forged disassociation frames to kick clients off; it serves as DoS, but also as a primer: you disconnect the victim to push them onto an evil twin, or to capture the four-way handshake for an offline crack. KRACK (Key Reinstallation Attack) targets that very WPA2 handshake by forcing reinstallation of an already-used key, allowing replay and decryption of traffic. Jamming saturates the RF band: a pure interference DoS, which the textbook lists among the intrinsic risks of wireless.

On Bluetooth, bluejacking sends unsolicited messages to a device within range (annoying but benign), while bluesnarfing exfiltrates data (contacts, files) through a pairing flaw: far more serious. RFID skimming covertly reads a tag or contactless card to clone its data. Countermeasures layer in defense in depth: strong encryption (WPA3, AES-CCMP) and enterprise authentication (802.1X/EAP-TLS); detection of rogue/evil twin via a WIPS (Wireless Intrusion Prevention System) that spots duplicated SSIDs and deauth bursts; protected management frames (PMF/802.11w) against deauth; secure-mode Bluetooth pairing and disabling it when unused; shielding or disabling wireless on IoT; and policies banning any unmanaged WAP.

9.1 Segmentation, DMZ and micro-segmentation

Segmenting a network means dividing it into trust zones separated by controls (usually firewalls), so that a compromise in one zone does not spread freely. Classic segmentation distinguishes at least three zones: the public zone (internet), an exposed semi-trusted zone, and a trusted internal zone. This is the Trust, but Verify logic illustrated by the perimeter network: every boundary crossing requires authentication and authorization.

The DMZ (demilitarized zone), also called a screened subnet, is that buffer zone where services that must be reachable from outside live: web server, mail server, bastion (jump box), edge servers. The point is never to expose the internal network directly: an attacker who compromises a DMZ service must not find a direct path to the database. The DMZ is bounded by two sets of rules (outward, inward), often realized as two firewalls or a three-legged firewall.

Micro-segmentation pushes this logic to the extreme: instead of a few large zones, individual workloads (even application flows) are isolated, with a control point at nearly every connection (next-generation firewalls). Its main security benefit is to drastically limit lateral movement: even inside the perimeter, nothing communicates without an explicit rule. It is a frequent building block of Zero Trust networks.

Exam trap: 'DMZ' and 'screened subnet' mean the same thing; and micro-segmentation is NOT a synonym for Zero Trust (it is a possible component, never sufficient on its own). Placing a database in the DMZ is the classic mistake to recognize.

9.2 Network defense in depth and cloud controls

Defense in depth applies controls at every layer rather than betting everything on a single perimeter: segmentation, firewalls, IDS/IPS, encryption of data in transit, RBAC on equipment and the management console, MFA for privileged actions, continuous auditing of privileged calls. No single control is perfect, so they are stacked so that the failure of one is caught by another.

In IaaS cloud, these controls take a different form. The VPC (Virtual Private Cloud) is the isolation building block: a logically isolated section where the customer controls IP ranges, subnets, route tables and gateways. The golden rule: any failure of the VPC isolation is likely to cause a breach. Watch out too for provider-managed services, often located outside the customer VPC and sometimes reachable from the internet by default (e.g. an object storage bucket).

Two cloud filtering mechanisms complement and contrast with each other for exam purposes. The security group applies at the instance level (the VM) with stateful rules: the response to allowed traffic is implicitly permitted. The NACL (Network Access Control List) applies at the subnet level with stateless rules: inbound and outbound are evaluated separately, and each direction must be allowed explicitly. A NACL can allow or deny; a security group, classically, expresses only allows.

NFV (Network Functions Virtualization) completes the picture: network functions (firewall, router, load balancer) become software running on commodity hardware. This is what makes defense in depth elastic and programmable in the cloud. Exam trap: confusing stateful (security group, instance) with stateless (NACL, subnet) is the classic mistake.

9.3 SDN and SD-WAN

SDN (Software-Defined Networking) separates decision from forwarding. It is organized in three planes. The application plane carries the network needs of business applications, expressed via APIs called northbound interfaces (NBI), often proprietary. The control plane is the brain: a centralized controller programs the flows and talks to devices through southbound interfaces (SBI), of which OpenFlow was the pioneering protocol. The data plane (or forwarding plane) gathers switches, routers and other devices, physical or virtual, that merely forward traffic according to the decisions received.

Flow terminology is tricky because it has two uses. In the SDN sense, north-south denotes movement up or down the plane stack (NBI/SBI), while east-west denotes exchanges within a single plane (for example the control plane talking to hypervisors and storage). In the broader security sense, north-south traffic means what enters and leaves the organization, and east-west traffic means internal traffic between workloads. Both readings are valid; you must identify which one the question is using.

SD-WAN (Software-Defined WAN) extends SDN to interconnecting remote sites over the internet, typically as part of cloud migration. It replaces legacy WAN architectures, may be hosted by one or several cloud providers, and brings micro-segmentation of traffic types (broadband, MPLS, internal vs external), reduced on-premises hardware footprint and centralized administration.

Decisive security stake: by centralizing intelligence in the control plane, SDN creates a single control point - hence a point of failure and a prime target. If the controller is compromised, the attacker programs the whole network. Exam trap: 'software-defined' is not limited to networking (there is software-defined security too); and SDN's benefits do not erase the concentration risk on the control plane.

9.4 CDN and edge computing

A CDN (Content Distribution Network or Content Delivery Network) is a large distributed system of servers deployed across multiple data centers throughout the internet, whose goal is to serve content to users with high availability and high performance. Typical content is streaming video or multimedia, but news media also use it to push field correspondents' work to an origin server and then distribute it on demand.

A CDN has two major components. The origin server hosts the source content (web pages, rich media, audio, video). Edge servers receive this content by push and redistribute it to end users. The trick is geographic: by placing edge servers as close as possible to regions with high user density, latency and distance traveled are reduced. Content is held in a proximity cache on the edge, which avoids hitting the origin on every request.

Edge computing generalizes this idea beyond mere delivery: edge servers provide compute capacity nearest to the organization's outer edge. Their use cases include acquiring and reducing data from large sensor fleets, or controlling and managing diverse, dispersed IoT fleets.

Security value: the dispersion and distributed capacity of a CDN help absorb traffic surges and mitigate volumetric DDoS attacks, since load is spread across many points of presence rather than concentrated on the origin. CDNs are evolving toward specialized security and optimization services. Exam trap: do not confuse the origin server (single source) with edge servers (distributed cache copies); and remember the DDoS benefit comes from distribution, not from encryption.

9.5 Trust-but-Verify vs Zero Trust (NIST 800-207)

The historical trust-but-verify model starts from an implicit assumption: once a subject is authenticated and authorized to cross a boundary (a token with a time-to-live), it is trusted as long as the token has not expired. This model is typically seen with SSO: a Single Sign On drops the user onto the LAN/WAN, from which they have broad visibility, if not access, to a large share of systems. It is convenient, but the trust window stays open and wide.

Zero Trust inverts the assumption: no access is implicit, inside or outside the perimeter. The principle is summed up as never trust, always verify. Every action or request by a subject must be authenticated and authorized, and the trust window (the token time-to-live) becomes vanishingly small. Zero Trust networks are often micro-segmented, with next-generation firewalls at nearly every connection point.

NIST formalized the approach in SP 800-207 (Zero Trust Architectures, ZTA), which gives a logical view. Three components structure the control plane. The Policy Engine (PE) makes the access decision by evaluating policy and available signals. The Policy Administrator (PA) executes that decision by establishing or tearing down the session. The Policy Enforcement Point (PEP) is the enforcement point placed on the path between subject and resource: it allows or blocks each request. No subject-resource connection bypasses the PEP.

NIST stresses: Zero Trust goes beyond network technique. It is not just about cables, routers, firewalls or even micro-segmentation; strategic, tactical, operational and technological approaches must be combined. Exam traps: a DMZ is not Zero Trust (it is trust-but-verify perimeter); micro-segmentation is necessary but not sufficient; and Zero Trust controls per request, not per long-lived session.

10.1 VPN: remote access vs site-to-site

A VPN establishes a point-to-point connection that extends a private network across a public network, usually through an encrypted tunnel. A tunnel is the encapsulation of one protocol inside another. Two topologies dominate. The remote-access VPN links a roaming host (running a VPN client) to an organization gateway: the user regains access to internal resources as if at the office. The site-to-site VPN links two gateways (gateway-to-gateway), for example two sites or a partner, to carry inter-site traffic over the Internet without an expensive dedicated link.

Two protocol families are contrasted on the exam. IPsec VPN operates at Layer 3: it encrypts IP packets via AH/ESP, negotiates keys with IKE and runs in tunnel mode (whole packet protected, typical of site-to-site and remote-access) or transport mode (payload only). It carries any IP protocol but needs a client. SSL/TLS VPN relies on TLS and PKI to generate a session key; it is reachable through a browser, so light to deploy and compatible with nearly any network that permits outbound HTTP. Historical note: SSL is obsolete and insecure, replaced by TLS. PPTP (legacy, GRE) and L2TP (which does not encrypt and relies on IPsec) round out the tunnel landscape.

Split tunneling lets the remote host send part of its traffic through the tunnel (to the enterprise) and the rest directly to the Internet. It is convenient and saves bandwidth, but it creates a potential bridge between the Internet and the internal network, bypassing perimeter controls. The classic countermeasure is full tunneling (all traffic flows through the gateway and its controls).

Exam trap: do not confuse the VPN type (who connects to whom: remote-access or site-to-site) with the protocol (how it is secured: IPsec or TLS). The two questions are orthogonal. And remember the SSL/TLS VPN is simpler to deploy on the client side, while the IPsec VPN is more universal for non-web traffic.

10.2 Network AAA and NAC: RADIUS, TACACS+, Diameter

AAA services (authentication, authorization, accounting) centralize network access control. RADIUS (Remote Authentication Dial-In User Service) uses UDP (ports 1812/1813), encrypts only the password in the packet and combines authentication and authorization in a single exchange. It is a widely deployed open standard for network and wireless access. Its successor, Diameter, runs over a reliable transport (TCP or SCTP), adds stronger security and more extensibility; it is found mainly in mobile networks (IMS, 4G/5G).

TACACS+ (Cisco) uses TCP (port 49), encrypts the entire payload and separates the three A's (authentication, authorization, accounting). That separation enables fine per-command control, ideal for network device administration. Exam mnemonic: TACACS+ = TCP, encrypts everyThing, separates AAA; RADIUS = UDP, encrypts only the password, combines authn and authz.

Network Access Control (NAC) does not create policy, it enforces it. It provides visibility into who and what connects (employees, BYOD, IoT, guests) and checks the device posture before admission: patch level, active antivirus, firewall rules, integrity. A noncompliant host is isolated in a quarantine network, optionally remediated, then admitted. 802.1X is a Port-based NAC protocol with three roles: the supplicant (the device), the authenticator (switch or access point) and the authentication server (often RADIUS). NAC can be agent-based (installed software, rich posture) or agentless (network scan, lighter but shallower).

Provenance: RADIUS appears in the D4 textbook only as a port (1812); TACACS+ and Diameter are nearly absent from the textbook and are added here from the cheat sheet and cross-cutting CBK. Trap: RADIUS combines authn and authz and encrypts only the password; do not credit it with AAA separation or full encryption, which are TACACS+ markers.

10.3 Voice/video convergence: VoIP, SIP, QoS

VoIP (Voice over IP) carries voice over IP networks: voice is digitized, compressed by a codec, split into packets, transmitted and reassembled at the far end. It is the foundation of unified communications (web and video conferencing) and has been absorbed into multimedia collaboration platforms (Zoom, Teams, Skype). Compared with POTS (plain old telephone system, analog circuit-switched), VoIP offers encryption, recording and conferencing, but it inherits all the risks of the IP world.

Two planes coexist. Signaling sets up, modifies and tears down the call: that is the role of SIP (Session Initiation Protocol, RFC 2543 then successors), which lets any compatible device talk to another. SIP supports digest authentication (historically via MD5 hashing) and encryption, notably over TLS, plus privacy extensions (encryption, caller ID suppression). The media (the voice itself) travels in RTP; its secure variant SRTP adds encryption and authentication of the audio stream. A gateway bridges the IP world to the PSTN to reach analog phones, and many jurisdictions mandate E911 and geolocation services.

Quality of service (QoS) is critical: voice tolerates latency, jitter and packet loss poorly. It is prioritized (DiffServ marking, queuing) and voice is often isolated in a dedicated VLAN. On the security side, threats include eavesdropping (interception of unencrypted RTP), SPIT (Spam over Internet Telephony), toll fraud, SIP signaling hijacking, and DoS that degrades calls.

Exam trap: SIP signals, RTP/SRTP carry the media - do not confuse them. And remember VoIP does not erase risk: it inherits IP risks (spoofing, DoS, sniffing) while adding its own (SPIT, toll fraud). The right reflex is SRTP for media and SIP over TLS for signaling.

10.4 Converged and storage networks

Convergence means carrying historically separate traffic (data, voice, storage) over one IP infrastructure. iSCSI (Internet Small Computer Systems Interface) passes SCSI commands over IP networks, avoiding dedicated storage cabling. Ideally iSCSI runs on a dedicated network, because bulk transfers contend with time-sensitive transactions. It supports several authentication schemes: older implementations use CHAP, but Kerberos or SRP (Secure Remote Password) are preferable.

FCoE (Fibre Channel over Ethernet) encapsulates Fibre Channel inside Ethernet frames to simplify the data center environment. Properly implemented, FCoE mimics the behavior of a Fibre Channel storage network while sharing the Ethernet infrastructure. MPLS (Multiprotocol Label Switching) operates between Layers 2 and 3: it switches on a label rather than an address lookup at every hop, improving performance and enabling traffic engineering, service prioritization and resiliency (for example MPLS Fast Reroute). The edge router (MPLS Edge Node) imposes or pops the label, and LSRs (Label Switching Routers) switch inside the domain.

Third-party connectivity demands management practices: onboarding/monitoring/offboarding policy, inventory of relationships and risk evaluation, monitoring and auditing consistent with contracts. At access termination, verify that IAM reflects privilege removal, that physical and logical interconnections are removed and that hardware is recovered.

Finally, endpoint security rests on a Root of Trust (RoT): an immutable hardware component (trust anchor), often a TPM chip, that guarantees the authenticity and integrity of boot (BIOS, system components). Immutability is hard to achieve in software, hence the hardware anchor. Modern endpoint management covers identity, configuration, health verification, remote management and geolocation. Trap: iSCSI and FCoE are converged/storage protocols, not VPNs; and MPLS improves performance and QoS but is not an encryption mechanism.

10.5 Network attacks and countermeasures

Network attacks sort by the security service they affect. Availability attacks aim to interrupt service. A DoS saturates a target from one source; a DDoS does so from a distributed botnet (IoT proliferation has made wireless volumetric DDoS spectacular). Distinguish volumetric DDoS (saturates bandwidth) from application-layer DDoS (exhausts server resources with little traffic). Amplification/reflection abuses services that reply larger than the request: Smurf sends an ICMP echo to the broadcast address with the victim's IP spoofed, triggering a flood of replies; DNS and NTP also serve as reflectors. Countermeasures: rate limiting, scrubbing/anti-DDoS, upstream filtering (CDN/ISP), closing open resolvers, ingress anti-spoofing (BCP38).

Confidentiality and integrity attacks intercept or alter traffic. MITM (man-in-the-middle) places the attacker between two parties; it often results from ARP poisoning/spoofing (injecting false IP-MAC mappings) or DNS poisoning. Countermeasure: end-to-end encryption (TLS), mutual authentication, HSTS, and at the switch level Dynamic ARP Inspection (DAI) and DHCP snooping. Session hijacking steals a token or cookie of an established session; defend with random tokens, Secure/HttpOnly cookies, timeout and re-authentication. Spoofing forges an identity (IP, ARP, DNS, MAC); DNSSEC protects DNS integrity, ingress anti-spoof filtering limits IP spoofing. Replay re-sends captured legitimate packets; counter it with nonces, timestamps, sequence numbers and IPsec anti-replay.

Classic exam trap: the question asks which attacker poses as an intermediate system. The precise answer is often ARP spoofing (the mechanism), which creates a MITM situation (the general term). Also know that a teardrop is a DoS using non-reassemblable fragments, and that route poisoning is not an attack but a RIP mechanism. The right reflex: map each attack to the service (C/I/A) and to its dedicated countermeasure rather than memorizing isolated names.