Chapter 1: Networks and Systems

Networks and Systems 🌐

Know the system before you defend it.

Open a web page on your school laptop and a small miracle happens in about a second. Your request is chopped into packets, labeled with addresses, passed across a wireless access point, a switch, a firewall, a router and several networks owned by companies you have never heard of, then answered by a server that might be in another state. Every one of those steps follows rules. Every one of those steps can also fail, be misconfigured or be abused.

Defenders do not start with hacking tools. They start with a map. You cannot protect a door you do not know exists, and you cannot spot unusual traffic if you do not know what normal traffic looks like. This chapter builds that map. You will learn the seven-layer model that professionals use to describe network communication, design a network for a school with security built into its shape, compare the ports and protocols that online services use, weigh the trade-offs of cloud services, and finish with the unglamorous work that stops most real attacks: hardening, patching and taming the smart devices that now fill every building.

1.1 — The OSI Model 🧱

When two engineers argue about why a video call keeps freezing, they need a shared vocabulary. Is the cable broken? Is a device sending traffic to the wrong address? Is the app itself buggy? The OSI model gives them that vocabulary. Published by the International Organization for Standardization in the 1980s, the Open Systems Interconnection model splits network communication into seven layers, each with one job.

The Seven Layers

Layer	Name	Job	Example	A threat at this layer
7	Application	The services people and apps use	HTTP, DNS, email	Phishing pages, injected commands
6	Presentation	Formatting, compression, encryption	TLS encryption, file formats	Weak or outdated encryption
5	Session	Opening and managing conversations	Login sessions, video call setup	Session hijacking with stolen cookies
4	Transport	Reliable or fast delivery between programs	TCP, UDP, port numbers	Floods of half-open connections
3	Network	Addressing and routing between networks	IP addresses, routers	Spoofed source addresses
2	Data Link	Delivery inside one local network	MAC addresses, switches, Wi-Fi frames	Fake address announcements on a LAN
1	Physical	Signals on cables, light and radio	Ethernet cable, fiber, Wi-Fi radio	Cut cables, rogue devices plugged in

A popular memory trick from Layer 7 down is “All People Seem To Need Data Processing.” From Layer 1 up, try “Please Do Not Throw Sausage Pizza Away.”

Encapsulation: Envelopes Inside Envelopes

When your browser sends a request, each layer wraps the data from the layer above with its own header, like putting a letter in an envelope, then that envelope in a shipping box, then the box on a truck. Transport adds port numbers and calls the result a segment. Network adds IP addresses and makes a packet. Data Link adds MAC addresses and makes a frame. Physical turns it all into bits on a wire or radio wave. At the other end, each layer opens its own envelope and passes the rest upward. This process is called encapsulation, and it explains why a firewall that only reads IP addresses cannot tell a safe web request from a malicious one hidden inside it: the danger is in an envelope it never opens.

Why Defenders Still Use a Model from the 1980s

The internet actually runs on the simpler four-layer TCP/IP model, and some layers of OSI (Session and Presentation especially) blur together in real software. So why learn seven? Because the OSI model is a troubleshooting and defense checklist. When an incident report says “a Layer 2 attack,” every analyst knows it happened inside the local network, among switches and MAC addresses, and that a firewall at the internet edge would never have seen it. Security tools are also described by layer: a traditional firewall works at Layers 3 and 4, while a next-generation firewall or web application firewall inspects Layer 7 content.

Thinking in layers also reminds you that attackers pick the weakest layer, not the most interesting one. A company can encrypt every connection perfectly at Layer 6 and still lose data because someone left a network port live in an empty conference room at Layer 1.

1.2 — Designing a Secure Network 🗺️

A network diagram is a defender’s blueprint. It shows every component, how the components connect and where trust changes. Good security is designed into that shape from the start; it is much harder to bolt on later.

The Components and Their Security Jobs

Component	Layer	Normal job	Security function
Modem / ISP connection	1-2	Connects the building to the internet provider	The boundary where outside traffic arrives
Router	3	Moves packets between networks	Can filter traffic with access control lists
firewall	3-7	Enforces rules about allowed traffic	The main gatekeeper between zones
Switch	2	Connects wired devices inside a network	Port security, VLANs to separate groups
Wireless access point	1-2	Connects Wi-Fi devices	WPA3 encryption, separate guest network
IDS / IPS	3-7	Watches traffic for known attack patterns	Alerts on (IDS) or blocks (IPS) suspicious traffic
VPN gateway	3	Lets remote users connect securely	Encrypts traffic across untrusted networks
Servers	7	Provide files, email, websites	Should sit in a protected zone, not with laptops

Segmentation: Do Not Put Everything in One Room

The most important design idea is network segmentation. Imagine a school network where student laptops, teacher laptops, the grading server, security cameras, the heating system and the guest Wi-Fi all share one flat network. If one smart camera with an old password is compromised, the attacker can now talk directly to the grading server.

A segmented design gives each group its own zone, usually a VLAN (virtual LAN) with its own subnet, and puts a firewall between zones with rules such as “student devices may reach the internet and the learning platform, but never the finance server.” Common zones include:

Staff and student zones, separated because they need different access
A server zone that only accepts the specific connections each server needs
An IoT zone for cameras, printers, projectors and building systems
A guest zone that reaches the internet and nothing else
A DMZ (demilitarized zone) for anything the public must reach, such as a web server, so that a compromise there does not land inside the trusted network

Hardware Connection Risks

Some of the most practical risks are physical connections. An unused wall jack in a library that is still live lets anyone plug in a laptop. A student or visitor could plug in a cheap wireless router and create a rogue access point that bypasses the firewall. A USB device found in the parking lot could carry malware or act as a fake keyboard that types commands. Defenders reduce these risks by disabling unused switch ports, using port security or 802.1X network access control so only approved devices can join, scanning for rogue access points, and setting device policies that block unknown USB storage.

Reading a Diagram Like a Defender

Once a diagram exists, defenders trace paths across it. Pick any device and ask: if this were compromised tonight, what could it reach? A well-designed network gives a short, boring answer. A flat network gives the answer “everything.” Defenders also mark the single points of failure, such as one internet connection or one core switch, because availability is part of security too, and they keep the diagram current, since an outdated map is almost as dangerous as no map.

1.3 — Ports and Protocols 🔌

If an IP address is a building’s street address, a port is the apartment number. One server can run a website, an email service and a remote login service at the same time, and port numbers tell incoming traffic which service it is for. A protocol is the agreed set of rules that service speaks.

Common Ports Every Defender Knows

Port	Protocol	Service	Encrypted?	Notes
20/21	FTP	File transfer	No	Replace with SFTP (over SSH)
22	SSH	Secure remote command line and SFTP	Yes	Target of password-guessing; use keys
23	Telnet	Old remote command line	No	Sends passwords in plain text; disable
25	SMTP	Email between servers	Optional (STARTTLS)	Sender addresses can be forged
53	DNS	Turning names into IP addresses	Usually no	Can be spoofed or used to amplify floods
80	HTTP	Web	No	Redirect to HTTPS
443	HTTPS	Web over TLS	Yes	Also used by HTTP/3 over UDP
445	SMB	Windows file sharing	Depends on version	Never expose to the internet
3389	RDP	Windows remote desktop	Yes	A favorite ransomware entry point when exposed

TCP ports are used when delivery must be reliable and in order; UDP is used when speed matters more, as in DNS lookups, voice calls and games. TCP begins every conversation with a three-step handshake (SYN, SYN-ACK, ACK). That politeness can be abused: a flood of opening SYN messages that never finish can tie up a server waiting for replies, which is why firewalls and servers include protections against half-open connection floods. UDP has no handshake at all, which makes it easy to fake a sender’s address, the root of the amplification attacks described below.

Matching Protocols to Attacks

Each protocol has typical weaknesses, and knowing them tells you what to defend:

Plain-text protocols (Telnet, FTP, HTTP) can be read by anyone positioned on the path, so an on-path attacker can capture passwords. The fix is the encrypted version.
DNS answers can be forged to send people to a fake site, and open DNS servers can be abused to bounce huge replies at a victim in an amplification flood. DNSSEC signs answers, and encrypted DNS hides lookups.
SMTP was designed before spam existed, so anyone can claim any sender address. SPF, DKIM and DMARC records let receiving servers check whether a message really came from the domain it claims.
SMB version 1 was the doorway for the WannaCry worm in 2017, which spread automatically between unpatched Windows machines. Modern versions and patching close that door.
RDP left open to the internet invites password-guessing. Put it behind a VPN with multi-factor authentication.

Seeing Your Own Open Ports

With a teacher’s permission, you can see which ports your own computer is listening on. This is a defensive habit: anything listening is something to justify.

Windows:   netstat -ano | findstr LISTENING
macOS:     lsof -nP -iTCP -sTCP:LISTEN
Linux:     ss -tuln

Only run checks like these on devices you own or are authorized to examine. Scanning other people’s networks without permission is illegal in many places, a point Chapter 5 returns to.

1.4 — Cloud Service Models ☁️

Most of what you use every day lives in the cloud: your school email, your learning platform, your shared documents. “The cloud” simply means computing resources rented over the internet from a provider instead of owned and run on site. The security question is always: who is responsible for what?

IaaS, PaaS and SaaS

Model	You rent	You still manage	Example
Infrastructure as a Service (IaaS)	Virtual servers, storage, networks	Operating system, patches, apps, data, access	Renting virtual machines from a major cloud provider
Platform as a Service (PaaS)	A ready platform to run your code	Your code, its settings, data, access	Hosting a web app without managing servers
Software as a Service (SaaS)	A finished application	Your data, users, sharing settings	School email, online document editors

The Shared Responsibility Model

Every major provider publishes a shared responsibility model. The provider always secures the physical data centers, hardware and core network. The customer always owns their data, their user accounts and who has access. In between, the line moves: with IaaS you patch your own operating system; with SaaS the provider does.

Many of the best-known cloud data leaks were not caused by the provider being breached at all. They came from customers misconfiguring their side, for example making a storage bucket publicly readable or leaving an administrator account without multi-factor authentication.

Public, Private, and Hybrid Clouds

Service models describe what you rent. Deployment models describe who else shares it. A public cloud runs many customers’ workloads on the provider’s shared hardware, kept apart by software isolation; it is the cheapest and most flexible option. A private cloud dedicates the infrastructure to one organization, either in its own building or hosted by a provider, which gives more control at a higher cost. A hybrid cloud combines the two, for example keeping sensitive student records on a private system while running email and video in the public cloud. Most large organizations end up hybrid, and also multicloud, using services from more than one provider. Every extra environment is another set of accounts, settings and logs that someone must secure and watch.

Evaluating a Cloud Choice

When a school district or business evaluates a cloud service, four questions cover most of the risk:

Security: Does the provider support single sign-on, multi-factor authentication, encryption and detailed logs? Has it passed independent audits?
Availability: What uptime does the service level agreement (SLA) promise, and what happens to the school if it goes down during exam week? When one large cloud region has an outage, as has happened several times in recent years, thousands of apps that depend on it can fail together.
Operational risk: Can we get our data out if we leave (avoiding vendor lock-in)? Where is the data stored, and does that meet student privacy laws?
Benefits: Lower cost up front, automatic patching of the platform, global reach and professional security teams that a small district could never afford.

1.5 — Hardening, Patching, and IoT 🛠️

Most successful attacks do not use brilliant new techniques. They walk through doors that were left open: a default password, a service nobody uses, a patch that was never installed. Closing those doors is the daily work of defense.

Hardening an Operating System

Every device has an attack surface: every open port, running service, installed app and user account is a possible way in. hardening means shrinking it. A hardening plan for a Windows, macOS, Linux or ChromeOS device usually covers:

Remove and disable: uninstall unused software, turn off services that are not needed, disable or rename default accounts.
Lock down accounts: daily work on a standard account, administrator rights only when needed, strong sign-in with multi-factor authentication.
Protect data: turn on full-disk encryption (BitLocker, FileVault or the Linux equivalent) and secure boot.
Filter traffic: enable the host firewall and block inbound connections that are not required.
Watch and update: turn on logging, endpoint protection and automatic updates.

Organizations rarely invent these settings from scratch. Free, consensus-based guides such as the CIS Benchmarks list recommended settings for each operating system, and management tools push them to thousands of devices at once.

Patching: Fast or Careful?

A patch fixes a known flaw, and attackers study patches to find what was fixed. Microsoft releases monthly updates on “Patch Tuesday,” the second Tuesday of each month, and CISA, the U.S. Cybersecurity and Infrastructure Security Agency, maintains a Known Exploited Vulnerabilities catalog listing flaws that attackers are actively using.

Patching immediately and automatically, in real time, has clear advantages: the window of exposure shrinks, and no human has to remember. The 2017 Equifax breach, which exposed personal data of about 147 million people, began with a web software flaw for which a patch had been available for months. But real-time updates have a cost, too. On July 19, 2024, a faulty content update to CrowdStrike’s security software was pushed to Windows computers around the world at once and crashed an estimated 8.5 million machines, grounding flights and disrupting hospitals. The update was meant to protect them.

Most organizations therefore use staged rollouts: test updates on a small group first, then deploy widely, while fast-tracking emergency patches for actively exploited flaws. When a patch cannot be installed yet, for example on a medical device or an old lab computer, defenders apply compensating controls such as isolating the device on its own network zone.

The Internet of Things

The Internet of Things (IoT) means everyday objects with network connections: cameras, smart speakers, thermostats, door locks, projectors, even school HVAC controllers. IoT devices are often the weakest computers in a building because they ship with default passwords, rarely receive updates, run for years and have no screen to warn anyone. In 2016 the Mirai malware took over hundreds of thousands of cameras and routers by trying lists of factory-default passwords, then used them in denial-of-service floods that knocked major websites offline. Since April 2024, the United Kingdom has required consumer connected devices to avoid universal default passwords and to state how long they will receive security updates.

To analyze an IoT device, ask: Can the default password be changed (and was it)? Does it still receive updates? What data does it collect, and where is it sent? Which network zone is it on? Does it really need internet access at all?

Chapter 1 Activity: Blueprint for a Secure School 🗺️

You are the new network security lead for Riverside High, a fictional school with 900 students, 80 staff, a library, a front office, 40 security cameras, smart projectors and a guest Wi-Fi network. Work on paper or in a district-approved drawing tool.

Part 1: Annotate the Layers

Draw a seven-layer OSI diagram for one action: a student opening the learning platform on a laptop. For each layer, write what happens to the data, one device or protocol involved, and one threat and one defense at that layer.

Part 2: Draw the Network

Create a diagram of Riverside’s network with at least six zones (staff, students, servers, IoT, guest and a DMZ). Label every component with its role and its security function, and write three firewall rules in plain English between zones. Add a mitigation strategy for hardware connection risks: live wall jacks, rogue access points and unknown USB devices.

Part 3: Ports, Protocols, and the Cloud

Make a table of six services Riverside needs (for example web, email, file sharing, remote support, DNS and the camera system). Give each its port and protocol, one attack it is vulnerable to and the safer configuration you would choose. Then pick one service and compare running it on site versus as SaaS on security, availability, operational risk and benefits.

Part 4: Harden and Patch

Write a one-page hardening plan for the staff laptops, using the five categories from section 1.5, and a patching policy that explains when updates roll out automatically and when they are staged. Finish by analyzing one IoT device from the building for its vulnerabilities and deciding which zone it belongs in.