Introduction
Every once in a while, it is good to brush off your knowledge and repeat the fundamentals. Sometimes you are completely new and need to build an understanding of the big picture or you don’t even know where to begin asking questions.
One important but ever-present area in cybersecurity is networks. It is one of many things that the blue team defends and the red team tries to breach. It is in the air and in the walls around you. It is with you when you travel and it keeps the world connected.
When thinking about networks I like to think about it from the perspective of the user and their devices. These devices at the “end of the line”, our phones and computers, are also known as endpoints.
In order for them to get updates, send messages, use certain apps or do anything productive in the web browser they need to be connected to the network. The smartphone or the computer might be connected wirelessly to a wi-fi, while a stationary computer might be connected with an ethernet cable.
The physical setup
In a business environment you sometimes see devices in the ceiling. There are devices like these that broadcast one or multiple wireless networks. Have you ever connected to a guest network at an office or a wi-fi in a café? It is likely that your device was communicating with that device in the ceiling, often called access point, or referred to as an AP.
So how is the access point able to broadcast a network for you to connect to? It happens to talk with something called a switch. It has a large number of ports, which are outlets for network cables. The switch can be managed by the IT team, segmenting the network traffic so that some devices cannot talk to other devices even if they are physically connected to the same switch. This division of traffic is referred to as Virtual Local Area Network (“VLAN”). This is a great way to enhance network security, for the simple reason that some devices might not be very safe and needs to be kept isolated.
The question then arises, how does the switch get network access and data to distribute throughout the workplace? Usually there is a router in the building that is connected to the outside, usually through a coaxial, copper or fibre-optic cable. Through this connection the router is talking to the company providing the customer with internet, the so-called internet service provider (“ISP”). When you look up your own or someone else’s IP-address online, it is the address of the router that you find, the public IP-address.
In a home environment on the other hand, it is common that you have only one device that does all things. It broadcasts wireless internet, distributes network through physical ports and has network protection in the form of a firewall. A firewall is basically a set of rules that allows and blocks certain traffic from going in or out. In a business grade environment, the firewall can be located in separate devices.
The non-physical side
We looked at the physical devices that can be used in networking, but it is only one side of the story. We also need to cover a bit about the things that you might not see, that are equally important.
Let’s start with the devices that you connect to the network, in order for the information to go to the right device they are provided an internal (“local”) IP-address on the network by something called the DHCP-server. IP stands for Internet Protocol and DHCP stands for Dynamic Host Configuration Protocol.
The IP-address that your phone is given on the network itself is normally not visible outside the network, when your phone visits a website it is your public IP-address that is shown. This is why devices on completely separate networks might have the same IP-address without any conflict. If two devices have the same IP-address on the same network however, it might cause issues. You can see the public IP-address as the address to an office building which the postal service is trying to deliver mail to. The local IP-address works like an identifier for the specific office to which the receptionist in the building is carrying the letter to. The router on the network, also called a gateway, has an IP-address too. This is so that your phone knows where to send the outgoing data for example.
It is worth mentioning MAC addresses as well, these are unique identifiers that is connected to the hardware in your device. While IP-addresses are provided and can change, the MAC normally cannot. However, it is possible to fake your MAC address, making it look like you use a different device than you actually are using. The act of faking this identifier can also be referred to as spoofing your MAC address.
When you visit a website you might enter a website address in the web browser, but your devices are thinking in IP-addresses, so there is something called DNS that helps with this translation. DNS stands for Domain Name System and it works like a phonebook. First your computer checks if the IP for the address that you are searching for already is stored in memory, otherwise it talks to a DNS server to get the correct IP so that it can communicate with the website. The DNS server can exist in different locations such as at your Internet Service Provider or at a public DNS provider (Cloudflare and Google being two commonly used ones). There is a certain type of attack called DNS poisoning that basically means that the phonebook contains malicious entries, so that the translation is corrupted. So even if you enter the correct website address, it connects you to a bad IP-address.
Finally, we will take a brief look at what is actually sent across the network.
The simplified version is that the raw data is sent through the network in wrappers called packets. Something called protocols define how the data is contained in these packets. With older and unencrypted protocols sensitive data might be intercepted if someone is sniffing the network.
The role of the defender
As you can see, there are many components that interact with each other and the defensive task doesn’t get easier. Taking inventory of what you need to protect, updating firmware and maintaining firewall policies are just a small part of network security. Security hardening is the process of reducing vulnerabilities and making your system harder to attack and that is something you need to work with regularly as a defender.