Network Security Foundations — CIA Triad, Threats, Controls & Packet Flow

 

Learning Outcomes

By the end, students can:

  • Explain CIA Triad and related security models (AAA, Zero Trust).

  • Identify common threats, actors, and attack techniques across network, endpoint, web, wireless, and human layers.

  • Map controls (preventive/detective/corrective) and design a defense‑in‑depth architecture with segmentation, firewalls, IDS/IPS, VPNs, and logging.

  • Trace a packet from a client to the Internet and back, describing what happens at each OSI layer and at a stateful firewall (policy, NAT, inspection, logging).

  • Use basic tools (ping, traceroute, nslookup/dig, netstat/ss, tcpdump/Wireshark) to observe packet flow and troubleshoot.

 

1) Core Security Models

CIA Triad

 

  • Confidentiality: Prevent unauthorized disclosure of data.

    • Controls: Encryption (at rest/in transit), access control (RBAC/ABAC), data classification & labeling, DLP, VPNs, need‑to‑know.

    • Metrics: # of unauthorized access incidents, % encrypted data, classification coverage.

 

  • Integrity: Ensure data is accurate and unaltered.

    • Controls: Hashing (SHA‑256), digital signatures, file integrity monitoring (FIM), checksums, immutability (WORM), version control, input validation.

    • Metrics: Hash mismatch rate, failed signature verifications.

 

  • Availability: Accessible when needed.

    • Controls: Redundancy (HA clusters, RAID), backups & DR, load‑balancers, DDoS protection, capacity planning, patching, UPS/generators.

    • Metrics: SLA uptime, MTTR/MTBF.

 

Extended Models & Principles

 

  • AAA: Authentication (prove identity), Authorization (what you can do), Accounting (logs/billing/audit).

  • Zero Trust: “Never trust, always verify”; continuous authZ, micro‑segmentation, strong identity, device posture checks, least privilege.

 

2) Threat Landscape

 

Threat Actors

 

  • External: Cybercriminals (ransomware groups), hacktivists, state‑sponsored, competitors.

  • Internal: Malicious insiders, careless users, contractors, misconfigurations.

 

Attack Surfaces & Common Attacks

 

  • Network layer:

    • Recon (port scanning, banner grabbing), sniffing, spoofing (IP/MAC), ARP poisoning, DHCP starvation, VLAN hopping, STP abuse, MITM, DDoS (SYN/UDP/ICMP floods), DNS poisoning/spoofing, BGP hijack (conceptual), fragmentation attacks.

 

  • Endpoint: Malware (virus, worm, Trojan), ransomware, keyloggers, rootkits, supply‑chain.

  • Web/App: SQLi, XSS, CSRF, SSRF, authN/authZ flaws, insecure deserialization, file inclusion (LFI/RFI), directory traversal.

 

  • Wireless: Evil twin AP, deauth attacks, weak pre‑shared keys, KRACK‑style issues (concept).

 

  • Human/Social: Phishing (bulk), spear phishing, whaling, vishing, smishing, pretexting, baiting.

 

Kill Chain / ATT&CK (high‑level)

 

  1. Recon → 2. Resource Development → 3. Initial Access → 4. Execution → 5. Persistence → 6. Privilege Escalation → 7. Defense Evasion → 8. Credential Access → 9. Discovery → 10. Lateral Movement → 11. Collection → 12. Command & Control → 13. Exfiltration/Impact.

 

3) Security Controls & Architecture

 

Control Types

 

  • By purpose: Preventive (MFA, NGFW), Detective (IDS, SIEM alerts), Corrective (patching, restore), Deterrent (warning signs/CCTV), Recovery (backups/DR), Compensating (interim safeguards).

 

  • By nature: Administrative (policies, training), Technical (crypto, ACLs, EDR), Physical (locks, guards, cages).

 

Defense in Depth (Layered)

 

  1. Physical (DC security, locks, cameras)

  2. Network (segmentation, firewalls, VPN)

  3. Endpoint (EDR, hardening)

  4. Application (WAF, SAST/DAST, secure SDLC)

  5. Data (encryption, DLP, backups)

  6. Users (MFA, awareness)

  7. Visibility (logs, SIEM, UEBA, SOAR)

 

Network Security Building Blocks

 

  • Segmentation & Zoning: VLANs/subnets, DMZ, management network, prod vs. dev/test; micro‑segmentation with NAC/SDN.

 

  • Firewalls:

    • Packet filters (stateless), stateful inspection, NGFW (app‑ID, user‑ID, IPS, URL filtering), WAF (HTTP/HTTPS layer 7 for web apps).

    • Rule anatomy: Source/destination, service/port, app/user, schedule, action, logging; implicit deny at end; “least privilege”.

 

  • NAT/PAT: Private → public translation, VIP/DNAT for services; preserves addressing and reduces exposure.

 

  • IDS/IPS: Signature, anomaly, behavior; inline prevention vs. passive detection; tuning to reduce false positives.

 

  • Proxies: Forward (users to Internet), reverse (Internet to apps in DMZ); caching, TLS termination, inspection.

 

  • VPNs:

    • IPSec (site‑to‑site, IKEv2, Phase 1 SA → Phase 2 ESP, tunnel mode),

    • SSL/TLS VPN (remote access, client, or portal).

 

  • Identity & Access: MFA, SSO, RBAC/ABAC, Privileged Access Mgmt (PAM), 802.1X + NAC.

 

  • Cryptography: Symmetric (AES‑GCM), Asymmetric (RSA/ECC), Hash (SHA‑256), HMAC, digital signatures, certificates & PKI, OCSP/CRL.

 

  • Key Management: Rotation, storage (HSM/TPM), secrets management vaults.

 

  • Data Protection: Classification, DLP (endpoint/email/gateway), backups (3‑2‑1 rule, offline/immutable), retention.

 

  • Monitoring & Response: Central logging, SIEM correlation, alert triage, playbooks, basic IR lifecycle (prepare → identify → contain → eradicate → recover → lessons learned).

 

4) OSI & TCP/IP Refresher (for Packet Flow)

 

  • OSI: L7 App, L6 Presentation, L5 Session, L4 Transport (TCP/UDP), L3 Network (IP), L2 Data Link (Ethernet), L1 Physical.

  • TCP/IP: Application, Transport, Internet, Network Access.

  • Data units: L2 Frame, L3 Packet, L4 Segment/Datagram.

 

 

5) Packet Flow: Client → Internet → Client (Narrative)

 

A. Getting Online (Bootstrapping)

 

  1. DHCP: Client broadcasts DHCPDISCOVER; server replies DHCPOFFER; client sends DHCPREQUEST; server sends DHCPACK. Lease includes IP, subnet mask, default gateway (router), DNS server.

  2. ARP: Client ARP‑resolves the MAC of its default gateway to send traffic off‑subnet.

 

B. DNS Resolution

 

  1. Client asks resolver (UDP/53 or TCP/53; DoT on port 853/DoH on port 443, if enabled).

  2. Resolver may query root → TLD → authoritative servers, caches response.

  3. Response returned with TTL.

 

C. TCP 3‑Way Handshake (to web server)

 

  1. SYN → 2. SYN‑ACK → 3. ACK; session established; window size and MSS negotiated.

  2. TLS Handshake (HTTPS): ClientHello (ciphers, SNI, ALPN) → ServerHello (+ certificate) → key exchange (ECDHE) → Finished messages → Encrypted HTTP.

 

D. Through the Switch & Router/Firewall (Outbound)

 

  1. Switch (L2) forwards frames by MAC table; may apply port‑security, VLAN tagging.

  2. Router/Firewall (L3/NGFW) inbound processing (typical order, vendor‑neutral):

    • Interface/Zoning check → sanity (anti‑spoof/RPF) → Session lookup → Route lookup → Security policy → NAT → Security profiles → Log decision → Egress queue/QoS.

  3. NAT/PAT translates private source IP/port to public IP/port; session table records mapping and timers.

 

E. Across the Internet

 

  • ISP edge → upstream routers via BGP → destination network. Latency, MTU/MSS, fragmentation avoidance (PMTUD) affect performance.

PreviousNext