04 - Communication and Network Security (Domain 4, 13%)¶

Domain Overview¶

Domain 4 covers network protocols, network architecture, secure communication, and the technologies enabling secure data transit. It is heavy on protocols, port numbers, and network device behavior. Understanding the OSI model end-to-end is foundational.

OSI Reference Model¶

Mnemonics: - All People Seem To Need Data Processing (top-down) - Please Do Not Throw Sausage Pizza Away (bottom-up)

TCP/IP Model¶

Common Protocols and Ports¶

TCP/IP Fundamentals¶

TCP three-way handshake¶

SYN -> SYN/ACK -> ACK

TCP four-way termination¶

FIN -> ACK -> FIN -> ACK (each side closes independently)

TCP vs UDP¶

• TCP: connection-oriented, reliable, ordered, slower
• UDP: connectionless, unreliable, faster, low overhead (DNS queries, VoIP, streaming)

IP addressing¶

• IPv4: 32-bit, dotted decimal, ~4.3B addresses
• IPv6: 128-bit, hexadecimal with colons, vast space
• Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• Loopback: 127.0.0.0/8 (IPv4), ::1 (IPv6)
• Link-local: 169.254.0.0/16 (IPv4), fe80::/10 (IPv6)
• Multicast: 224.0.0.0/4 (IPv4), ff00::/8 (IPv6)

CIDR¶

• /24 = 256 addresses (254 usable)
• /16 = 65,536 addresses
• /8 = 16.7M addresses
• VLSM allows variable subnet sizes

NAT types¶

• Static NAT - 1:1
• Dynamic NAT - many:many from pool
• PAT (NAPT) - many:1 with port translation

IPv6 features¶

• Built-in IPsec support (often disabled in practice)
• No broadcast (replaced by multicast and anycast)
• SLAAC (Stateless Address Autoconfiguration)
• ND replaces ARP

Network Devices¶

Firewall Types¶

• Stateless (packet filter) - rules on IP, port, protocol
• Stateful - tracks connection state
• Application proxy - terminates and reassembles
• Next-Generation Firewall (NGFW) - app-aware, identity, IPS, threat intel
• Web Application Firewall (WAF) - L7 specifically for web apps

IDS/IPS¶

• Signature-based - known attack patterns
• Anomaly-based / heuristic - deviations from baseline
• Behavior-based - learned normal behavior
• NIDS / NIPS - network-based
• HIDS / HIPS - host-based

False positive vs false negative trade-off; tuning critical.

Honeypots and Honeynets¶

• Decoy systems to detect, study, deter attackers
• Honeytokens: fake credentials placed to detect lateral movement
• Legal considerations (entrapment in some jurisdictions)

Secure Network Design¶

Defense in Depth Network Layers¶

• Perimeter (edge firewall, IDS/IPS)
• DMZ (publicly accessible services)
• Internal network (segmented)
• Sensitive zones (PCI, HR, R&D)
• Endpoint (host firewall, EDR)

Network Segmentation¶

• VLANs (L2 segmentation)
• Subnets (L3 segmentation)
• VPNs (logical segmentation across networks)
• Microsegmentation (per-workload, often via SDN or service mesh)
• Air-gapping (physical isolation)

Zero Trust Networking¶

• No implicit trust based on network location
• Verify every connection
• Identity-aware policies (user, device, app)
• Continuous evaluation
• BeyondCorp (Google), NIST SP 800-207

SDN (Software-Defined Networking)¶

• Separation of control plane and data plane
• Centralized controller
• Programmable network (APIs)
• Enables microsegmentation, dynamic policy

SD-WAN¶

• WAN built on SDN principles
• Uses multiple transport (MPLS, broadband, LTE/5G)
• Application-aware routing

SASE (Secure Access Service Edge)¶

• Convergence of network (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS)
• Cloud-delivered

Network Access Control (NAC)¶

• Posture assessment before granting access
• 802.1X for port-based authentication
• Quarantine non-compliant devices

Wireless Networks¶

802.11 Standards¶

Wi-Fi Security¶

• WEP - broken (RC4 weakness)
• WPA - improved on WEP, still weak
• WPA2 - AES-CCMP, strong with good password
• WPA2-Enterprise - 802.1X, EAP, RADIUS
• WPA3 - SAE (Simultaneous Authentication of Equals) replacing PSK; forward secrecy
• WPA3-Enterprise - optional 192-bit mode

EAP Variants¶

• EAP-TLS - mutual cert auth (strongest)
• EAP-TTLS - server cert + tunneled auth
• PEAP - Microsoft tunneled, MS-CHAPv2 inside
• EAP-FAST - Cisco, replaces LEAP
• LEAP - deprecated

Wi-Fi Threats¶

• Rogue AP
• Evil twin (rogue with target's SSID)
• Deauthentication attacks
• KRACK (key reinstallation against WPA2)
• Karma attack (probe responses to all SSIDs)
• Wardriving

Wireless Site Survey¶

• Coverage planning
• Channel assignment to minimize co-channel interference
• AP placement to avoid signal bleed beyond intended boundary

Other Wireless¶

• Bluetooth: 2.4 GHz, short range, classic vs BLE; threats include bluejacking, bluesnarfing, bluebugging
• Zigbee: low-power IoT mesh
• NFC: very short range (cm), payments, badges
• RFID: active vs passive; supply chain, asset tracking
• Cellular (4G/5G): 5G adds network slicing, virtualization
• Satellite: latency, throughput trade-offs

Secure Communication Protocols¶

TLS (replacing SSL)¶

• TLS 1.2: widely supported, can be configured securely
• TLS 1.3: simplified handshake, removed weak ciphers, encrypted handshake
• Always disable SSL ⅔, TLS 1.0/1.1
• Cipher suites: KX_AUTH_BULK_MAC (e.g., ECDHE-RSA-AES256-GCM-SHA384)
• PFS (Perfect Forward Secrecy) requires ephemeral key exchange (ECDHE, DHE)

IPsec¶

• AH (Authentication Header) - integrity and authenticity, NOT confidentiality
• ESP (Encapsulating Security Payload) - confidentiality + optional integrity/auth
• Modes:
• Transport mode - encrypts payload (host-to-host)
• Tunnel mode - encrypts entire packet (gateway-to-gateway, VPN)
• IKEv2 for key management
• SA (Security Association) per direction

SSH¶

• Replaces telnet, rsh, rlogin
• Port 22
• Public key auth or password
• Tunneling (port forwarding)

S/MIME and PGP¶

• S/MIME: cert-based email signing/encryption (uses PKI)
• PGP/GPG: web of trust model
• Both provide confidentiality, integrity, authenticity, non-repudiation

DNS Security¶

• DNSSEC - signs DNS records (integrity, authenticity)
• DNS over HTTPS (DoH) - privacy from network observers
• DNS over TLS (DoT) - similar
• DANE - publishes TLS certs in DNSSEC-signed records

Email Security¶

• SPF - which servers may send for a domain
• DKIM - cryptographic signature on emails
• DMARC - policy combining SPF/DKIM, reporting
• BIMI - logo display when DMARC enforced

VPN Technologies¶

Multilayer Protocol Considerations¶

Encapsulating one protocol in another can hide threats from inspection. Examples: - DNS tunneling (data in DNS queries) - ICMP tunneling - HTTPS-tunneling (covers any L7 protocol) - IPv6 tunnels (Teredo, 6to4)

Implications: deep packet inspection limited if encrypted; rely on metadata, behavior, endpoint visibility.

Converged Protocols¶

• FCoE - Fibre Channel over Ethernet (storage on Ethernet)
• iSCSI - SCSI over IP (storage on IP networks)
• VoIP - voice over IP (SIP, RTP, SRTP for encryption)
• MPLS - label-switched networks for performance and traffic engineering

Content Distribution Networks¶

• Caching, edge delivery
• DDoS absorption (large network capacity)
• TLS termination at edge
• Bot management
• Examples: Cloudflare, Akamai, Fastly, AWS CloudFront

Network Attacks¶

Common Exam Pitfalls¶

• Confusing OSI layer of devices (firewall at multiple layers)
• Picking PPTP when modern alternatives exist
• Forgetting AH provides no confidentiality
• Mixing TCP and UDP port assignments
• Choosing WEP/WPA when WPA2/WPA3 exists
• Forgetting DNSSEC provides integrity, not confidentiality
• Confusing transport mode and tunnel mode IPsec
• Picking signature-based IDS when zero-day is the threat