Network Security Fundamentals

It builds a chain from the certificate up to a locally trusted root, verifies every signature, checks the validity dates, matches the hostname against the subject alternative name, and consults revocation status. It never checks whether the owner is honest.

It needs traffic that is unauthenticated or downgradeable plus a path the attacker already sits on — a shared local network, a rogue gateway, a poisoned name resolution. Authenticated encryption with strict certificate validation and HSTS removes it.

TLS protects data in transit — confidentiality, integrity, and authentication of the server through its certificate. It does not protect data at rest, does not hide who talks to whom, and gives nothing once one of the endpoints is compromised.

Classic DNS answers are unauthenticated and unencrypted, so a resolver on the path can be fed a forged record. DNSSEC signs records so a client can verify authenticity, while DoH and DoT encrypt the query channel for confidentiality. They solve different halves and neither replaces the other.

A stateless filter judges each packet alone against static rules, so return traffic needs its own permissive rule. A stateful firewall tracks connections and lets replies through automatically. Default-deny drops everything not explicitly allowed, so a forgotten service is closed rather than exposed.

Both sides agree a cipher suite, the server proves identity with a certificate, and an ephemeral key exchange derives the symmetric key that encrypts the session. Forward secrecy means stealing the long-term key later cannot decrypt recorded traffic.

Segment by exposure. Internet-facing components (web/mobile entry, reverse proxy) go in a DMZ. The backend with business logic sits in an internal application segment, reachable only from the DMZ. The database goes in an isolated segment with no direct path from the internet — only the backend reaches it, so a breached DMZ host cannot touch the DB directly.

TCP is connection-oriented: a handshake sets it up, then it guarantees ordered, reliable delivery with retransmission and flow control — at the cost of latency. UDP is connectionless: it sends datagrams with no ordering or delivery guarantee, so it is faster and used for DNS, streaming and gaming where speed beats reliability.

Ordinary TLS authenticates only the server, so the callee still has to trust a bearer token to know who called. Mutual TLS makes the client present its own certificate, binding identity to the connection itself, issued and rotated by an internal certificate authority rather than a shared secret.

A VPN authenticates once and then drops the user onto the network, so a stolen laptop reaches everything routable — trust follows location. Zero-trust access authorises each application on identity and device posture, so a compromise yields one resource.

A volumetric flood saturates the link, so it must be absorbed upstream by a scrubbing provider or the transit carrier — nothing on your own server helps once the pipe is full. Application-layer floods look like valid requests, so they need rate limits, caching and per-client quotas.

ICMP is a network-layer control protocol for error and diagnostic messages — Echo (ping), Destination Unreachable, Time Exceeded (used by traceroute). The trick: ICMP has no ports — it is neither TCP nor UDP, so you cannot close a port. You block it by protocol with a firewall rule (IP protocol number 1).

An intrusion detection system watches a copy of the traffic and only raises alerts; an intrusion prevention system sits inline and can drop the connection. Inline blocking turns every false positive into an outage and adds latency and availability risk.

Seven layers bottom-up: physical (bits on the medium), data link (frames, MAC, error control), network (routing, IP addresses), transport (TCP/UDP, end-to-end delivery), session (connections), presentation (encoding, encryption), application (HTTP, DNS). Each layer serves the one above it.

They authenticate the client to the access point and encrypt the radio link, so a listener nearby cannot read the frames. A shared passphrase authenticates the network, not the user, so enterprise credentials are per-user and guests get their own segment.

Pinning narrows trust from every public root to one specific key or issuer, so a certificate wrongly issued by any other authority is rejected. The cost is operational — a rotated or renewed key bricks every shipped client until it is updated, so teams pin a long-lived key and ship backup pins.

Replace the open route with default-deny egress — reach the object store over a private endpoint, allow the registry through a proxy allowlist, drop everything else. Log denied flows and resolver DNS queries, since with egress narrow an outbound attempt is itself the alert.

Port scanning maps which services listen. A SYN (half-open) scan reads SYN-ACK as open, RST as closed and never completes the handshake, so it leaves no connection log and needs flow/IDS detection. TCP connect completes it — reliable but logged. UDP is ambiguous: silence means open or filtered, ICMP unreachable means closed.

Terminating at the edge means the balancer decrypts, so every hop behind it carries plaintext of the same sensitivity. That is acceptable only if the internal segment is genuinely isolated and monitored; otherwise re-encrypt to the backend host.

Traceroute maps the path packets take to a destination. It sends probes with the IP TTL starting at 1 and incrementing each round; each router that decrements TTL to zero drops the packet and returns an ICMP Time Exceeded, revealing that hop's address and round-trip time. It stops when the destination itself replies.

Three rules face the whole internet that must not: management ports 22 and 3389, plus the database on 5432. Restrict administrative access to the bastion subnet, let only the application security group reach the database, keep 80 and 443 public, and replace the open egress with default-deny.