Network Security Foundations: threats, controls, packet flow

Network Security Foundations — CIA Triad, Threats, Controls & Packet Flow

Learning Outcomes

By the end, students can:

• Explain CIA Triad and related security models (AAA, Zero Trust).

• Identify common threats, actors, and attack techniques across network, endpoint, web, wireless, and human layers.

• Map controls (preventive/detective/corrective) and design a defense‑in‑depth architecture with segmentation, firewalls, IDS/IPS, VPNs, and logging.

• Trace a packet from a client to the Internet and back, describing what happens at each OSI layer and at a stateful firewall (policy, NAT, inspection, logging).

• Use basic tools (ping, traceroute, nslookup/dig, netstat/ss, tcpdump/Wireshark) to observe packet flow and troubleshoot.

1. Core Security Models

CIA Triad

• Confidentiality: Prevent unauthorized disclosure of data.

• Controls: Encryption (at rest/in transit), access control (RBAC/ABAC), data classification & labeling, DLP, VPNs, need‑to‑know.

• Metrics: # of unauthorized access incidents, % encrypted data, classification coverage.

• Integrity: Ensure data is accurate and unaltered.

• Controls: Hashing (SHA‑256), digital signatures, file integrity monitoring (FIM), checksums, immutability (WORM), version control, input validation.

• Metrics: Hash mismatch rate, failed signature verifications.

• Availability: Accessible when needed.

• Controls: Redundancy (HA clusters, RAID), backups & DR, load‑balancers, DDoS protection, capacity planning, patching, UPS/generators.

• Metrics: SLA uptime, MTTR/MTBF.

Extended Models & Principles

• AAA: Authentication (prove identity), Authorization (what you can do), Accounting (logs/billing/audit).

• Zero Trust: "Never trust, always verify"; continuous authZ, micro‑segmentation, strong identity, device posture checks, least privilege.

2. Threat Landscape

Threat Actors

• External: Cybercriminals (ransomware groups), hacktivists, state‑sponsored, competitors.

• Internal: Malicious insiders, careless users, contractors, misconfigurations.

Attack Surfaces & Common Attacks

• Network layer:

• Recon (port scanning, banner grabbing), sniffing, spoofing (IP/MAC), ARP poisoning, DHCP starvation, VLAN hopping, STP abuse, MITM, DDoS (SYN/UDP/ICMP floods), DNS poisoning/spoofing, BGP hijack (conceptual), fragmentation attacks.

• Endpoint: Malware (virus, worm, Trojan), ransomware, keyloggers, rootkits, supply‑chain.

• Web/App: SQLi, XSS, CSRF, SSRF, authN/authZ flaws, insecure deserialization, file inclusion (LFI/RFI), directory traversal.

• Wireless: Evil twin AP, deauth attacks, weak pre‑shared keys, KRACK‑style issues (concept).

• Human/Social: Phishing (bulk), spear phishing, whaling, vishing, smishing, pretexting, baiting.

Kill Chain / ATT&CK (high‑level)

• Recon → 2. Resource Development → 3. Initial Access → 4. Execution → 5. Persistence → 6. Privilege Escalation → 7. Defense Evasion → 8. Credential Access → 9. Discovery → 10. Lateral Movement → 11. Collection → 12. Command & Control → 13. Exfiltration/Impact.

3. Security Controls & Architecture

Control Types

• By purpose: Preventive (MFA, NGFW), Detective (IDS, SIEM alerts), Corrective (patching, restore), Deterrent (warning signs/CCTV), Recovery (backups/DR), Compensating (interim safeguards).

• By nature: Administrative (policies, training), Technical (crypto, ACLs, EDR), Physical (locks, guards, cages).

Defense in Depth (Layered)

• Physical (DC security, locks, cameras)

• Network (segmentation, firewalls, VPN)

• Endpoint (EDR, hardening)

• Application (WAF, SAST/DAST, secure SDLC)

• Data (encryption, DLP, backups)

• Users (MFA, awareness)

• Visibility (logs, SIEM, UEBA, SOAR)

Network Security Building Blocks

• Segmentation & Zoning: VLANs/subnets, DMZ, management network, prod vs. dev/test; micro‑segmentation with NAC/SDN.

• Firewalls:

• Packet filters (stateless), stateful inspection, NGFW (app‑ID, user‑ID, IPS, URL filtering), WAF (HTTP/HTTPS layer 7 for web apps).

• Rule anatomy: Source/destination, service/port, app/user, schedule, action, logging; implicit deny at end; "least privilege".

• NAT/PAT: Private → public translation, VIP/DNAT for services; preserves addressing and reduces exposure.

• IDS/IPS: Signature, anomaly, behavior; inline prevention vs. passive detection; tuning to reduce false positives.

• Proxies: Forward (users to Internet), reverse (Internet to apps in DMZ); caching, TLS termination, inspection.

• VPNs:

• IPSec (site‑to‑site, IKEv2, Phase 1 SA → Phase 2 ESP, tunnel mode),

• SSL/TLS VPN (remote access, client, or portal).

• Identity & Access: MFA, SSO, RBAC/ABAC, Privileged Access Mgmt (PAM), 802.1X + NAC.

• Cryptography: Symmetric (AES‑GCM), Asymmetric (RSA/ECC), Hash (SHA‑256), HMAC, digital signatures, certificates & PKI, OCSP/CRL.

• Key Management: Rotation, storage (HSM/TPM), secrets management vaults.

• Data Protection: Classification, DLP (endpoint/email/gateway), backups (3‑2‑1 rule, offline/immutable), retention.

• Monitoring & Response: Central logging, SIEM correlation, alert triage, playbooks, basic IR lifecycle (prepare → identify → contain → eradicate → recover → lessons learned).

4. OSI & TCP/IP Refresher (for Packet Flow)

• OSI: L7 App, L6 Presentation, L5 Session, L4 Transport (TCP/UDP), L3 Network (IP), L2 Data Link (Ethernet), L1 Physical.

• TCP/IP: Application, Transport, Internet, Network Access.

• Data units: L2 Frame, L3 Packet, L4 Segment/Datagram.

5. Packet Flow: Client → Internet → Client (Narrative)

A. Getting Online (Bootstrapping)

• DHCP: Client broadcasts DHCPDISCOVER; server replies DHCPOFFER; client sends DHCPREQUEST; server sends DHCPACK. Lease includes IP, subnet mask, default gateway (router), DNS server.

• ARP: Client ARP‑resolves the MAC of its default gateway to send traffic off‑subnet.

B. DNS Resolution

• Client asks resolver (UDP/53 or TCP/53; DoT on port 853/DoH on port 443, if enabled).

• Resolver may query root → TLD → authoritative servers, caches response.

• Response returned with TTL.

C. TCP 3‑Way Handshake (to web server)

• SYN → 2. SYN‑ACK → 3. ACK; session established; window size and MSS negotiated.

• TLS Handshake (HTTPS): ClientHello (ciphers, SNI, ALPN) → ServerHello (+ certificate) → key exchange (ECDHE) → Finished messages → Encrypted HTTP.

D. Through the Switch & Router/Firewall (Outbound)

• Switch (L2) forwards frames by MAC table; may apply port‑security, VLAN tagging.

• Router/Firewall (L3/NGFW) inbound processing (typical order, vendor‑neutral):

• Interface/Zoning check → sanity (anti‑spoof/RPF) → Session lookup → Route lookup → Security policy → NAT → Security profiles → Log decision → Egress queue/QoS.

• NAT/PAT translates private source IP/port to public IP/port; session table records mapping and timers.  

E. Across the Internet

• ISP edge → upstream routers via BGP → destination network. Latency, MTU/MSS, fragmentation avoidance (PMTUD) affect performance.