Network Security Fundamentals

Objectives

Network+ 4.1 - 4.5
~20% of exam

Topics

Authentication, Firewalls, VPNs, IDS/IPS, Attacks, Hardening

Duration

60-75 minutes

Why Security Matters

Security is not optional - it's fundamental to every network design decision. A network without security is like a house without locks.

Prepared by: EQ6

The CIA Triad

The foundation of all information security:

Confidentiality

Data is only accessible to authorized users. Encryption, access controls, and authentication protect confidentiality.

Threat: Data breaches, eavesdropping

Integrity

Data has not been altered or tampered with. Hashing, digital signatures, and checksums verify integrity.

Threat: Man-in-the-middle, data corruption

Availability

Systems and data are accessible when needed. Redundancy, backups, and DDoS protection ensure availability.

Threat: DoS attacks, hardware failure

Exam Tip

When analyzing security scenarios, always consider which element of CIA is being protected or threatened.

Authentication Methods

Verifying identity - "Who are you?"

1⃣ Something You Know

Passwords, PINs, security questions

2⃣ Something You Have

Smart cards, tokens, mobile devices

3⃣ Something You Are

Fingerprint, retina scan, facial recognition

4⃣ Somewhere You Are

Geolocation, IP-based restrictions

Multi-Factor Authentication (MFA)

Combining two or more factors dramatically increases security. Example: Password (know) + SMS code (have)

AAA Framework

The complete access control process:

A

Authentication - "Who are you?"

Verify identity through credentials

A

Authorization - "What can you do?"

Determine permissions and access levels

A

Accounting - "What did you do?"

Log and track all activities for audit

Common AAA Protocols

RADIUS - UDP 1812/1813 - Network access (Wi-Fi, VPN)

TACACS+ - TCP 49 - Device administration (Cisco)

RADIUS vs TACACS+

Feature	RADIUS	TACACS+
Protocol	UDP (1812/1813)	TCP (49)
Encryption	Password only	Entire packet
AAA Separation	Combined	Separate processes
Best For	Network access (Wi-Fi, VPN)	Device administration
Vendor	Open standard (IETF)	Cisco proprietary

Exam Tip

RADIUS = User access to network. TACACS+ = Admin access to devices. TACACS+ encrypts everything, RADIUS only encrypts the password.

Kerberos Authentication

Ticket-based authentication system (Active Directory default)

User

→

KDC

→

TGT

→

Service Ticket

→

Resource

Key Components

KDC - Key Distribution Center

TGT - Ticket Granting Ticket

TGS - Ticket Granting Service

Port: TCP/UDP 88

Why Kerberos?

Passwords never sent over the network. Uses symmetric encryption. Single sign-on (SSO) capability.

LDAP - Directory Services

Lightweight Directory Access Protocol - accessing directory databases

What is LDAP?

Protocol for querying directories
Stores users, groups, computers
Hierarchical structure (tree)
Active Directory uses LDAP

Ports

LDAP - TCP 389 (unencrypted)

LDAPS - TCP 636 (SSL/TLS)

LDAP Structure

DN - Distinguished Name (full path)

CN - Common Name (object name)

OU - Organizational Unit

DC - Domain Component

Example DN:

CN=JSmith,OU=Sales,DC=corp,DC=com

Security Note

Always use LDAPS (port 636) in production. Plain LDAP sends credentials in clear text!

802.1X Port-Based Access Control

Network access control at the switch port level

Supplicant

Client device

→

Authenticator

Switch/AP

→

Auth Server

RADIUS

EAP Types

EAP-TLS: Certificate on both sides (most secure)

PEAP: Server cert + password

EAP-FAST: Cisco's faster alternative

Use Cases

• Corporate Wi-Fi (WPA2/3-Enterprise)

• Wired network access control

• Guest network isolation

Firewall Types

Type	How It Works	OSI Layer
Packet Filter	Examines headers (IP, port). No state tracking.	Layer 3-4
Stateful	Tracks connection state. Allows return traffic.	Layer 3-4
Application/Proxy	Inspects application data. Deep packet inspection.	Layer 7
NGFW	Stateful + App awareness + IPS + threat intel	Layer 3-7
UTM	All-in-one: FW + AV + IDS + VPN + content filter	Layer 3-7

NGFW vs UTM

NGFW: High performance, enterprise focus, application control. UTM: All-in-one convenience, SMB focus, may sacrifice performance.

Firewall Rules & Zones

Rule Components

Source - Where traffic comes from

Destination - Where traffic goes

Port/Protocol - What service

Action - Permit or Deny

Rule Order Matters!

Rules processed top-to-bottom. First match wins. Implicit deny at end.

Common Zones

T

Trusted (Inside) - Internal LAN

U

Untrusted (Outside) - Internet

D

DMZ - Public-facing servers

VPN - Virtual Private Networks

Secure tunnels over public networks

Site-to-Site VPN

Connects entire networks. Always-on tunnel between offices. Uses hardware VPN devices.

Remote Access VPN

Individual users connect to corporate network. Software client on device. On-demand connection.

Client-to-Site

Same as remote access. User initiates connection. Common for work-from-home.

Clientless VPN

Browser-based access. No software install. Limited to web applications.

Split Tunnel vs Full Tunnel

Split: Only corporate traffic through VPN (faster, less secure). Full: All traffic through VPN (slower, more secure).

IPSec VPN

Industry standard for site-to-site VPNs

IPSec Components

IKE - Key exchange (UDP 500)

ESP - Encrypts payload (Protocol 50)

AH - Authentication only (Protocol 51)

IPSec Modes

Transport Mode: Encrypts payload only. Host-to-host.

Tunnel Mode: Encrypts entire packet. Gateway-to-gateway.

IKE Phases

1

Phase 1 (IKE SA)

Authenticate peers, establish secure channel

2

Phase 2 (IPSec SA)

Negotiate encryption for data tunnel

SSL/TLS VPN

Browser-friendly VPN using HTTPS

Feature	IPSec VPN	SSL/TLS VPN
Port	UDP 500, ESP/AH	TCP 443 (HTTPS)
Client	Requires software	Browser or lightweight client
Firewall Friendly	May be blocked	Usually allowed (port 443)
Best For	Site-to-site, full network access	Remote access, web apps

Modern Trend

SSL/TLS VPNs increasingly popular for remote workers due to ease of use and firewall traversal. Many organizations use both.

IDS vs IPS

Intrusion Detection and Prevention Systems

IDS - Intrusion Detection

Passive monitoring

Detects and alerts
Does NOT block traffic
Out-of-band (copy of traffic)
No latency impact

IPS - Intrusion Prevention

Active blocking

Detects AND blocks
Inline with traffic
Can drop malicious packets
Adds some latency

Detection Methods

Signature-Based

Matches known attack patterns. Fast and accurate for known threats. Cannot detect zero-day attacks.

Anomaly-Based

Learns "normal" baseline. Detects deviations. Can catch unknown attacks. Higher false positives.

Common Network Attacks

DoS/DDoS

Overwhelm resources with traffic. DDoS uses multiple sources. Targets availability.

Man-in-the-Middle

Attacker intercepts communication. Can read/modify data. ARP spoofing enables MITM.

Spoofing

Impersonating another device. IP spoofing, MAC spoofing, ARP spoofing, DNS spoofing.

VLAN Hopping

Access other VLANs illegally. Double tagging or switch spoofing. Mitigate with proper trunk config.

Brute Force

Try all password combinations. Dictionary attacks use word lists. Account lockout mitigates.

Phishing

Social engineering via email. Tricks users into revealing credentials. User training is key defense.

DDoS Attack Types

Attack Type	Target Layer	Method
Volumetric	Layer 3-4	Flood bandwidth (UDP flood, ICMP flood, amplification)
Protocol	Layer 3-4	Exhaust resources (SYN flood, Ping of Death, Smurf)
Application	Layer 7	Target web apps (HTTP flood, Slowloris)

Amplification Attacks

Small request → Large response. DNS, NTP, SSDP commonly abused. Spoofed source IP = reflection.

Mitigation

Rate limiting, blackholing, scrubbing centers, CDN protection, ISP filtering.

Wireless Security

Protocol	Encryption	Status
WEP	RC4 (weak)	Deprecated - easily cracked
WPA	TKIP	Legacy - avoid if possible
WPA2-Personal	AES-CCMP	Good - uses PSK
WPA2-Enterprise	AES-CCMP	Better - uses 802.1X
WPA3	AES-GCMP / SAE	Best - latest standard

WPA3 Improvements

SAE: Simultaneous Authentication of Equals (replaces PSK). Forward secrecy. Protected management frames. Resistant to offline dictionary attacks.

Network Hardening

Device Hardening

Change default credentials
Disable unused services/ports
Update firmware regularly
Use SSH instead of Telnet
Enable logging and monitoring
Implement access control lists

Network Hardening

Segment with VLANs
Implement 802.1X
Disable unused switch ports
Enable port security
Use private VLANs
Enable DHCP snooping

Common Mistakes

Leaving defaults, unused ports enabled, Telnet for management, no logging, flat network (no segmentation), outdated firmware.

Security Best Practices

Least Privilege

Users get minimum access needed. Reduce attack surface. Regular access reviews.

Defense in Depth

Multiple security layers. If one fails, others protect. No single point of failure.

Separation of Duties

No one person has all access. Requires collusion for fraud. Audit trails.

Security Policies

Document acceptable use. Incident response plans. Regular training and updates.

Zero Trust Model

"Never trust, always verify." Assumes breach has occurred. Verify every access request regardless of location. Micro-segmentation.

Summary - Key Exam Points

Authentication

RADIUS - UDP 1812/1813 - Network access

TACACS+ - TCP 49 - Device admin

Kerberos - TCP/UDP 88 - AD auth

LDAP - TCP 389/636 - Directory

802.1X - Port-based NAC

VPN

IPSec - Site-to-site (UDP 500)

SSL/TLS - Remote access (TCP 443)

Firewalls

Stateless → Stateful → App → NGFW

Rules: Source, Dest, Port, Action

Zones: Trusted, Untrusted, DMZ

Detection

IDS - Detect and alert (passive)

IPS - Detect and block (inline)

Signature vs Anomaly detection

Remember: CIA Triad

Confidentiality (encryption) | Integrity (hashing) | Availability (redundancy)