Network Components and Secure Protocols
Firewalls and segmentation
- Packet filtering (layer 3/4) — fast, stateless, examines headers only.
- Stateful inspection — tracks connection state; the modern baseline.
- Proxy / application-layer — understands the protocol; slowest but most thorough.
- Next-generation firewalls add identity, application awareness, and IPS features.
- A screened subnet (DMZ) isolates internet-facing services from the internal network.
Secure protocols
- IPSec — AH provides integrity and authentication; ESP adds confidentiality. Tunnel mode protects the whole packet, transport mode only the payload.
- TLS — protects application traffic; replaces the deprecated SSL.
- SSH — secure remote administration; replaces Telnet, rlogin, and FTP.
- DNSSEC signs DNS records to prevent cache poisoning; DNS itself provides no integrity.
- 802.1X — port-based network access control, usually with RADIUS and EAP.
Wireless
WEP is broken (weak IV reuse with RC4). WPA improved it with TKIP but is also deprecated. WPA2 uses AES-CCMP and WPA3 adds SAE for stronger handshake protection. Enterprise mode uses 802.1X/RADIUS rather than a shared passphrase.
Common attacks
ARP poisoning and MAC flooding at layer 2, IP spoofing and smurf attacks at layer 3, SYN floods and session hijacking at layer 4, and DNS poisoning and phishing higher up. Match the attack to the layer and the control follows.