Domain 4: Communication and Network Security
OSI model (know what lives where)
| # | Layer | Protocols / devices |
|---|---|---|
| 7 | Application | HTTP(S), FTP, SMTP, DNS, SNMP |
| 6 | Presentation | TLS handshakes (arguably), JPEG, encoding, encryption formats |
| 5 | Session | NetBIOS, RPC, sockets/session setup |
| 4 | Transport | TCP, UDP; firewalls (stateful), load balancers (L4) |
| 3 | Network | IP, ICMP, IGMP; routers, L3 switches, ACLs |
| 2 | Data link | Ethernet, ARP, MAC, switches/bridges, VLAN, 802.1X at access |
| 1 | Physical | cables, hubs, repeaters, wireless radio |
Mnemonics (top-down): Please Do Not Throw Sausage Pizza Away.
TCP vs UDP and the port table
TCP: connection-oriented, reliable, sequenced, 3-way handshake (SYN, SYN/ACK, ACK). UDP: connectionless, fast, no delivery guarantee — VoIP, video, DNS queries, DHCP.
| Port | Service | Port | Service |
|---|---|---|---|
| 20/21 | FTP | 143 / 993 | IMAP / IMAPS |
| 22 | SSH/SCP/SFTP | 161/162 | SNMP |
| 23 | Telnet (insecure) | 389 / 636 | LDAP / LDAPS |
| 25 / 587 | SMTP / submission | 443 | HTTPS |
| 53 | DNS | 445 | SMB |
| 67/68 | DHCP | 514 | Syslog |
| 69 | TFTP | 3306 / 5432 | MySQL / PostgreSQL |
| 80 | HTTP | 3389 | RDP |
| 88 | Kerberos | 5060/5061 | SIP |
| 110 / 995 | POP3 / POP3S | 1723 | PPTP (legacy) |
Addressing and segmentation
Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. NAT/PAT hides internals and conserves addresses; IPv6 removes NAT need (use ACLs/firewalls instead). Know CIDR basics: /24 = 256 addresses, /16 = 65,536.
Segmentation: VLANs (802.1Q tagging; inter-VLAN traffic needs a router or L3 switch), DMZ for public services, micro-segmentation east-west, and zero-trust network access (identity-based, per-session authorisation).
Firewalls and friends
- Packet filter (L3/4, stateless) → stateful (tracks connections) → application/proxy (L7, protocol aware) → NGFW (IPS + app-ID + user-ID) → UTM (all-in-one appliance).
- IDS detects (out-of-band), IPS blocks inline; signature vs anomaly/heuristic; false positive (benign flagged) vs false negative (missed attack).
- Honeypot/honeynet – decoys for detection and research.
- Proxy forward (clients) / reverse (publish servers); NAC = posture checks before network join; WAF protects web apps.
- Load balancers: round-robin, weighted, least-connections, affinity (sticky sessions); SSI health checks.
- SDN: control plane separated from data plane — central policy, programmable flows.
VPN and secure protocols
IPsec: AH (integrity+auth, no confidentiality) vs ESP (confidentiality + integrity); transport mode (host-to-host) vs tunnel mode (site-to-site, whole packet encapsulated); IKE for key negotiation. SSL/TLS VPN = clientless remote access over 443. TLS: 1.0/1.1 deprecated — require TLS 1.2/1.3. Use SSH (22) instead of Telnet (23); SFTP/FTPS instead of FTP; LDAPS, IMAPS, DNS over TLS.
Wireless security
| Standard | Encryption | Verdict |
|---|---|---|
| WEP | RC4, weak IVs | broken — never |
| WPA | TKIP (RC4 wrapper) | deprecated |
| WPA2 | AES-CCMP | minimum acceptable; use PMF |
| WPA3 | AES + SAE | current best; no offline dictionary attacks |
Enterprise mode = 802.1X/EAP (RADIUS): EAP-TLS (cert both sides, strongest), PEAP (tunnels password), TTLS; avoid LEAP/EAP-FAST legacy. Personal mode = PSK. Attacks: evil twin, rogue AP, IV attack, deauth/Karma, WPS PIN, bluejack/bluesnarf (Bluetooth), jamming. Counter with site surveys, WIPS, captive portals + VPN for open networks.
Network attacks & where they live
- SYN flood / SYN cookie – TCP handshake abuse.
- Smurf (ICMP) / Fraggle (UDP) – amplification.
- ARP spoofing / MITM – L2; counter: DAI, static ARP, encryption.
- MAC flooding → switch fails open to hub mode; port security stops it.
- VLAN hopping (double tagging, switch spoofing); disable auto-trunk.
- DNS poisoning / pharming – DNSSEC, DoH/DoT.
- DDoS – scrubbing services, CDNs, rate limiting.
- Replay – timestamps/sequence + TLS; on-path (MITM) – mutual auth.
Converged and modern networks
VoIP (SRTP, TLS-SIP, VLAD? no—put voice on its own VLAN), iSCSI/FCoE storage networks isolated, MPLS WAN vs SD-WAN with IPsec overlays, CDN edge caching also absorbs DoS, 5G slice security, quantum-safe links are emerging (post-quantum crypto migration planning).
Memory hooks
- OSI: Please Do Not Throw Sausage Pizza Away (7→1).
- Hub = L1, switch/bridge = L2, router = L3, stateful firewall/LB = L4, proxy/NGFW/WAF = L7.
- WEP dead → WPA/TKIP dead → WPA2/CCMP minimum → WPA3/SAE best.
- IPsec AH = integrity only; ESP = encryption (+integrity).
- Kerberos = port 88. Syslog = 514. RDP = 3389.
Exam tips
- When two protocols are listed, the ‘secure replacement’ answer wins (SSH over Telnet, SFTP over FTP, LDAPS over LDAP).
- IDS = detective control; IPS = preventive (inline).
- ‘Most secure cable’ = fibre (no EMI eavesdropping).
- Anomaly-based IDS catches zero-days but yields more false positives; signature-based is the reverse.
- Stateful firewalls track the whole connection; packet filters don't.