# Network Security Foundations

> Chapter 9 of the Courseiva ISC2-CC curriculum — https://courseiva.com/learn/isc2-cc/network-security-foundations

**Official objective:** 3.1 — Describe basic networking concepts, protocols (TCP/IP, OSI model), and common network threats.

## Introduction

Network Security Foundations. This is the bedrock of every cybersecurity exam and every real-world network. If you don't understand how data travels and how attackers try to intercept it, you cannot secure anything. For the CC exam, this chapter gives you the language to describe threats and the logic to choose the right defence.

## The Warehouse Shipping Clerk Analogy

A warehouse shipping clerk named Alex. Alex's job is to receive incoming packages, check the paperwork, and send packages out to the correct destinations. The warehouse has a strict set of rules. Every package must have a label with a source address, a destination address, and a list of contents. The label also has a 'protocol' field that says what kind of item is inside, like 'Fragile: Electronics' or 'Perishable: Food'. 

When a truck arrives from 'Supplier A', Alex doesn't just open the gate. First, he checks the truck's ID badge. Then, he verifies the driver against a pre-approved list. He looks at the shipping manifest and makes sure it matches the actual load. This is like a firewall inspecting traffic. Once inside, Alex sorts the packages. Some go to the 'Internal Distribution' shelf, some go to 'Customer Shipments', and some are marked for 'International Air Freight'. He uses a colour-coded routing system: red for urgent, blue for standard, and yellow for hazmat. If a package has no label or a bad address, Alex quarantines it in a locked cage labelled 'Suspicious Items'. He does not forward it to the customer. 

When he sends a package out, he writes the entire journey on a 'shipping log' — tracking number, time, driver, and delivery confirmation. If a package goes missing, he can trace it back to the last checkpoint. Alex is the network security team. The labels and rules are the TCP/IP and OSI models. The suspicious packages are network threats. Without Alex, the warehouse would be chaos: lost goods, stolen items, and angry customers.

The whole operation depends on every package following the same rules. If Alex makes a mistake, a dangerous package gets through. If the rules change without warning, nothing ships at all. That is network security foundations in a nutshell.

## Core explanation

A network is simply two or more computers connected together so they can share information. The 'Internet' is the biggest public network. But before any data can move from one computer to another, both computers must agree on how to talk. That agreement is called a protocol. A protocol is a set of rules. For example, when you send a letter, you both agree on the format: an envelope, a stamp, an address on the front, and a return address on the back. If you wrote the address on the back and put the stamp inside the envelope, the post office would not deliver it. Networks have the same problem.

The two main protocol 'models' you need to know are the OSI model and the TCP/IP model. The OSI model has seven layers. The TCP/IP model has four layers. Think of them as instruction manuals that tell different parts of the network hardware and software what to do. The key point: data does not magically appear. It is broken into small pieces called packets. Each packet is wrapped in headers (like an envelope) that contain addressing and control information.

Let us start with the TCP/IP model because it is the one actually used on the Internet. The four layers are:
- Application Layer: This is where your software lives. Web browsers, email clients, and file transfer programs operate here. Protocols like HTTP (for websites), FTP (for file transfers), and SMTP (for email) are application layer protocols.
- Transport Layer: This layer makes sure the data arrives correctly and in order. The two main protocols here are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol). TCP is like a registered post service. It establishes a connection, checks that every packet arrived, and resends any that got lost. UDP is like a postcard. It sends the data with no confirmation. If it gets lost, too bad. UDP is used for video streaming and online gaming because speed matters more than perfect accuracy.
- Internet Layer: This is where the IP (Internet Protocol) lives. IP handles the addressing — it puts the source and destination IP addresses on each packet. Routers at this layer decide how to forward packets across multiple networks. The most common version is IPv4 (like 192.168.1.1), but we are gradually moving to IPv6 because we ran out of IPv4 addresses.
- Network Access Layer: This is the physical hardware: Ethernet cables, Wi-Fi signals, network interface cards. It handles the raw transmission of bits over a medium.

The OSI model is more detailed. It has seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. For the CC exam, you only need to understand the parts that relate to security. The key OSI layers for security are the Network layer (where IP and routers live), the Transport layer (where firewalls inspect ports), and the Application layer (where attacks like SQL injection happen). A common exam trick is to ask which OSI layer corresponds to a specific security device. For example, a firewall typically operates at the Network and Transport layers.

Now, common network threats. A threat is anything that could harm a network. The most basic are:
- Denial of Service (DoS): An attacker floods a server with so many requests that it cannot handle legitimate traffic. Imagine a million people calling a pizza place at once. No one can place an order.
- Man-in-the-Middle (MitM): An attacker intercepts communication between two parties. They can read, modify, or inject messages. This is like a postal worker opening your mail, reading it, and resealing the envelope.
- Packet Sniffing: Using software to capture data packets as they travel across a network. If the data is not encrypted, the attacker can read everything — passwords, credit card numbers, messages.
- ARP Spoofing: The Address Resolution Protocol (ARP) maps IP addresses to physical MAC addresses. An attacker sends fake ARP messages to associate their MAC address with the IP of a legitimate device. Traffic meant for that device now goes to the attacker.
- Rogue Access Points: An attacker sets up a fake Wi-Fi hotspot with a name like 'Free Airport Wi-Fi'. When you connect, they capture all your traffic.

Why does this matter for the CC? Because every security control — firewalls, VPNs, intrusion detection systems, encryption — is designed to stop one or more of these threats. Without understanding how data moves (the models) and how attackers exploit the movement (the threats), you cannot know which control to apply where. The exam will ask you to identify the threat given a scenario, and it will ask you to match a protocol or device to its correct OSI layer.

## Real-world context

An IT security professional at a mid-sized company, let us call it 'BrightTech Ltd', is responsible for the company's internal network. BrightTech has 200 employees, a website, and a customer database. Every day, the IT pro does not just 'think about security' — they perform specific actions.

First, they check the firewall logs. The firewall is the gatekeeper between BrightTech's internal network and the Internet. The IT pro looks for unusual outbound connections. For example, if an employee's computer suddenly starts sending data to a server in a foreign country at 3 AM, that is a red flag. It could be malware exfiltrating data. The IT pro uses a tool called Wireshark to capture a sample of the traffic. They look at the packet headers: the source IP, the destination IP, the port number, and the protocol (TCP or UDP). They might see traffic on an unusual port, like port 4444, which is often used by remote access trojans. This step-by-step analysis is exactly what the OSI model describes — the IT pro is examining the Network and Transport layers.

Second, they run vulnerability scans on the network. Using a tool like Nessus, they scan every device's IP address. The scanner sends packets to common ports (like port 80 for web servers, port 22 for SSH) and sees which ones respond. If a server responds with a known vulnerable version of software, the scanner flags it. The IT pro then prioritises patching. This is a direct application of understanding how TCP/IP works: the scanner is opening TCP connections to specific ports and analysing the 'handshake' (SYN, SYN-ACK, ACK) to determine the operating system and services.

Third, they manage the VPN (Virtual Private Network). Remote employees connect to BrightTech's network via VPN. The IT pro configures the VPN server to use strong encryption (AES-256) and checks the logs for failed authentication attempts. If someone tries to connect 100 times with the wrong password, it is a brute-force attack. The IT pro blocks that IP address using an ACL (Access Control List) on the router. The ACL is a list of rules that says 'allow this traffic' or 'deny that traffic'. This is a real-world implementation of security at the Internet layer.

Fourth, they set up network segmentation. BrightTech has a public-facing web server and an internal database server. The IT pro puts the web server in a 'DMZ' (Demilitarised Zone) — a separate network segment that is isolated from the internal network. If the web server is hacked, the attacker cannot directly reach the database. This segmentation is achieved by configuring VLANs (Virtual Local Area Networks) on the network switches. Each VLAN is a separate broadcast domain, meaning traffic in one VLAN does not normally flow to another. It takes an extra device (a router or a firewall) to move data between VLANs. The IT pro configures firewall rules to allow only specific traffic from the web server to the database (like SQL queries on port 1433) and nothing else.

Finally, they respond to an incident. An employee clicks a link in a phishing email. The malware tries to call home. The IT pro isolates the infected computer from the network by disabling its switch port. They then capture a memory dump and network logs to understand what the malware did. They trace the attack path: the email came from a spoofed sender address (Application layer), the link led to a malicious site (HTTP at the Application layer, TCP at the Transport layer), and the malware tried to connect to a command-and-control server on an external IP (Internet layer). Each step corresponds to a layer in the OSI model. Without understanding those layers, the IT pro would have no systematic way to investigate.

## Exam focus

The CC exam tests 'Network Security Foundations' in a specific, predictable way. You will see multiple-choice questions that require you to identify, match, or order concepts. The examiners love to test the following:

- The OSI model layers and their order. You must memorise the seven layers from bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, Application. A common trap is asking which layer a protocol belongs to. For example, 'TCP operates at which OSI layer?' The correct answer is Transport. They will list options like 'Network' or 'Application' as distractors. Another trap: they might describe a function and ask for the layer. For example: 'Which layer is responsible for routing packets across different networks?' Answer: Network layer.
- The TCP/IP model layers and how they map to the OSI model. The exam may ask: 'The TCP/IP Internet layer corresponds to which OSI layer?' Answer: Network layer. Or: 'Which TCP/IP layer includes IP addressing?' Answer: Internet layer.
- The difference between TCP and UDP. This is a classic exam question. You must know that TCP is connection-oriented, reliable, and slower. UDP is connectionless, unreliable, and faster. A trap: they might describe a service (like 'video conferencing') and ask which protocol it uses. The correct answer is UDP because video conferencing needs speed over perfect delivery. Another trap: they might describe a file transfer and say 'TCP'. Pay attention: file transfers need reliability, so TCP is correct.
- Common network threats. The exam will present a scenario: 'An attacker intercepts communication between two hosts and modifies the data. What is this called?' Answer: Man-in-the-Middle attack. They will list other threats as options: DoS, phishing, spoofing. Know the precise definition of each. Another example: 'An attacker sends a large number of requests to a server to overwhelm it. This is a...' Answer: Denial of Service.
- Port numbers and associated protocols. You need to memorise a few key ports: HTTP = 80, HTTPS = 443, FTP = 21, SSH = 22, DNS = 53, DHCP = 67/68. The exam might ask: 'Which port does HTTPS use?' Or: 'An administrator is configuring a firewall to allow secure web traffic. Which port should they open?' Answer: 443.
- The role of firewalls, ACLs, and VPNs. You need to know what each does at a basic level. A firewall filters traffic based on rules. An ACL is a list of rules on a router. A VPN creates an encrypted tunnel over an untrusted network. The exam may ask: 'Which device inspects packet headers and makes decisions based on source IP, destination IP, and port?' Answer: Firewall. Or: 'Which technology allows remote employees to securely connect to the corporate network?' Answer: VPN.

The exam will not ask you to memorise the entire OSI model in minute detail. But they will test your ability to match a common function or protocol to the correct layer. Focus on the Network, Transport, and Application layers because those are most relevant to security.

A specific trap: questions that mix up 'encryption' with a layer. Encryption happens at the Presentation layer in the OSI model, but many students incorrectly associate it with the Application layer. Remember: the Presentation layer handles data translation, encryption, and compression. The Application layer is where the user interacts with the software (like a web browser).

Another trap: questions about 'port numbers'. They might ask: 'Which protocol uses port 53?' Answer: DNS. Do not confuse DNS (which resolves domain names to IP addresses) with DHCP (which assigns IP addresses). DHCP uses ports 67 and 68.

## Step by step

1. **Data Encapsulation** — When a computer sends data, the application layer creates the data. It then moves down the OSI model layers. At each layer, a header (and sometimes a trailer) is added. This wrapping is called encapsulation. At the Network layer, the IP header is added. At the Data Link layer, the MAC address header and a frame check sequence trailer are added. The receiving computer reverses this process (de-encapsulation), stripping headers until the raw data reaches the application. Understanding this flow is critical for knowing where security controls like encryption (Presentation layer) or firewalls (Network/Transport) operate.
2. **The TCP Three-Way Handshake** — TCP establishes a connection before sending data. The process is: SYN (client says 'hello'), SYN-ACK (server says 'hello back'), ACK (client says 'got it, let us talk'). This confirms both sides are ready. Security devices like firewalls and intrusion detection systems monitor this handshake. For example, a firewall might block incomplete handshakes (lots of SYN packets with no ACK) — that is a SYN flood attack, a type of DoS. Memorising this handshake helps you understand how connection-oriented communication works.
3. **IP Routing** — Once a packet is formed, it travels from source to destination across multiple networks. Routers at the Internet layer read the destination IP address and consult a routing table. The table tells the router which neighbour to forward the packet to next. This is called hop-by-hop routing. Security professionals configure ACLs on routers to permit or deny traffic based on IP addresses or port numbers. A misconfigured ACL can block legitimate traffic or allow malicious traffic into the network.
4. **Port Number Filtering** — When a firewall inspects a packet, it looks at the destination port number. Port numbers are logical endpoints for services. For example, a web server listens on port 80 for HTTP. By blocking port 80 on the firewall, you prevent any external traffic from reaching the web server. This is a basic security control. Attackers often try to bypass firewalls by using non-standard ports. For instance, malware might use port 443 (HTTPS) to blend in with normal secure web traffic.
5. **Encryption at the Presentation Layer** — When you visit a secure website (HTTPS), the data is encrypted at the Presentation layer of the OSI model. Encryption scrambles the data so that even if a packet is sniffed, the contents are unreadable. The encryption is typically done using TLS (Transport Layer Security). Without encryption, any packet sent across the network is visible in plain text. This is why using secure protocols (HTTPS, SFTP) instead of their insecure counterparts (HTTP, FTP) is a fundamental security practice.
6. **Packet Analysis with Wireshark** — An IT professional captures network traffic using a tool like Wireshark. They see every packet in real time. They can filter by protocol (e.g., 'tcp' or 'dns'), by IP address, or by port. They look for anomalies: unexpected protocols, unusual source IPs, or repeated failed connections. This is a direct application of understanding the TCP/IP model. For the CC exam, you will not be asked to use Wireshark, but understanding that traffic can be captured and analysed is key to grasping network threats like packet sniffing.

## Comparisons

### TCP vs UDP

**TCP:**
- Connection-oriented (requires a handshake)
- Reliable (retransmits lost packets)
- Slower but ensures data integrity

**UDP:**
- Connectionless (no handshake)
- Unreliable (no retransmission)
- Faster but may lose data

### OSI Model vs TCP/IP Model

**OSI Model:**
- 7 layers (conceptual reference model)
- Developed by ISO as a teaching tool
- Layers: Physical, Data Link, Network, Transport, Session, Presentation, Application

**TCP/IP Model:**
- 4 layers (practical implementation)
- Developed by DoD for ARPANET
- Layers: Network Access, Internet, Transport, Application

### Firewall vs VPN

**Firewall:**
- Filters traffic based on rules
- Operates at Network/Transport layers
- Blocks or permits packets

**VPN:**
- Creates an encrypted tunnel
- Operates at all layers (encrypts payload)
- Protects data in transit over untrusted networks

### IPv4 vs IPv6

**IPv4:**
- 32-bit address (e.g., 192.168.1.1)
- Approximately 4.3 billion possible addresses
- Uses NAT to conserve addresses

**IPv6:**
- 128-bit address (e.g., 2001:db8::1)
- Virtually unlimited addresses (340 undecillion)
- No need for NAT; built-in security features

### Intrusion Detection System (IDS) vs Intrusion Prevention System (IPS)

**Intrusion Detection System (IDS):**
- Monitors traffic and alerts
- Passive (does not block traffic)
- Often deployed out-of-band

**Intrusion Prevention System (IPS):**
- Monitors traffic and blocks malicious traffic
- Active (can drop packets)
- Deployed inline (traffic flows through it)

## Diagram

_The OSI model layers from top (Application) to bottom (Physical), with example protocols mapped to each layer._

```mermaid
flowchart TD
    A[Application Layer] --> B[Presentation Layer]
    B --> C[Session Layer]
    C --> D[Transport Layer]
    D --> E[Network Layer]
    E --> F[Data Link Layer]
    F --> G[Physical Layer]
    H[HTTP, SMTP, FTP] --> A
    I[TLS/SSL] --> B
    J[TCP, UDP] --> D
    K[IP, ICMP] --> E
    L[Ethernet, MAC] --> F
```

## Common misconceptions

- **Misconception:** TCP/IP and OSI are two completely different, competing networking models that you must choose between. **Reality:** TCP/IP is the practical model used on the Internet. OSI is a conceptual reference model used for teaching and troubleshooting. They complement each other — you can map OSI layers to TCP/IP layers. (Beginners often think they are rivals because they hear 'OSI vs TCP/IP' in discussions. In reality, OSI is a theoretical framework and TCP/IP is the actual implementation.)
- **Misconception:** A firewall blocks all threats automatically once it is installed. **Reality:** A firewall only enforces the rules you configure. If you misconfigure it (e.g., allow all traffic, or leave a port open), threats can still pass through. Firewalls require ongoing management. (People think security tools are 'set and forget'. They underestimate how much human judgement and continuous tuning a firewall needs.)
- **Misconception:** The OSI model 'Session layer' and 'Presentation layer' are irrelevant for cybersecurity. **Reality:** The Session layer manages connection establishment and termination (relevant for session hijacking attacks). The Presentation layer handles encryption (relevant for SSL/TLS). Attackers can target these layers, so security professionals need to understand them. (Beginners focus on the Network and Transport layers because that is where IP and TCP/UDP live. They overlook the upper layers, but many attacks (like session hijacking) exploit those higher layers.)
- **Misconception:** Packet sniffing only works on unencrypted networks like public Wi-Fi. **Reality:** Packet sniffing can also work on wired networks if the attacker has physical or logical access to a switch port (e.g., via ARP spoofing). Encryption (like HTTPS) protects the content, but metadata (source/destination IP, port) is still visible. (Common advice is 'use a VPN on public Wi-Fi', which makes people think only Wi-Fi is vulnerable. Attackers inside an organisation can sniff internal wired traffic if no encryption is used.)
- **Misconception:** IP addresses and MAC addresses are interchangeable and serve the same purpose. **Reality:** IP addresses are logical, hierarchical addresses that routers use to deliver packets across networks. MAC addresses are physical, flat addresses assigned to a network interface card, used within a local network segment. They serve different layers of the OSI model (Network vs Data Link). (Both are 'addresses' and beginners use the terms loosely. They do not understand that IP addresses change as you move networks (e.g., you get a new IP at a coffee shop) but a MAC address is usually fixed to the device.)

## Key takeaways

- The OSI model has seven layers: Physical, Data Link, Network, Transport, Session, Presentation, Application — memorise this order from bottom to top.
- TCP is connection-oriented and reliable; UDP is connectionless and fast — video streaming uses UDP, file downloads use TCP.
- A firewall filters traffic at the Network and Transport layers based on rules like source IP, destination IP, and port number.
- Common network threats include DoS, Man-in-the-Middle, packet sniffing, and ARP spoofing — know what each does.
- VPNs create an encrypted tunnel over a public network, protecting data in transit from eavesdropping.
- Port numbers identify specific services: HTTP=80, HTTPS=443, FTP=21, SSH=22, DNS=53.

## FAQ

**Do I need to memorise every OSI layer number and name?**

Yes, for the CC exam you must memorise the seven layers in order (Physical, Data Link, Network, Transport, Session, Presentation, Application) and their basic functions. A mnemonic like 'Please Do Not Throw Sausage Pizza Away' helps.

**What is the difference between a router and a switch?**

A router operates at the Network layer (Layer 3) and routes packets between different networks using IP addresses. A switch operates at the Data Link layer (Layer 2) and forwards frames within the same network using MAC addresses.

**How does encryption protect against packet sniffing?**

Encryption scrambles the data inside the packet so that even if an attacker captures it, they cannot read the original content. The packet headers (source/destination IP) are still visible, but the payload is unreadable.

**Can a single packet contain both a TCP header and an IP header?**

Yes. When data is encapsulated, the IP header is added at the Network layer, and the TCP header is added at the Transport layer. Both headers are part of the same packet.

**What is a 'port' in networking?**

A port is a logical endpoint in a computer's operating system that identifies a specific process or service. For example, a web browser connects to a server on port 80 (HTTP) or 443 (HTTPS). Ports allow multiple services to run on the same IP address.

**Why is UDP used for video streaming instead of TCP?**

UDP is faster because it does not wait for acknowledgements or retransmit lost packets. Video streaming can tolerate a small amount of lost data (it appears as a brief glitch) but cannot tolerate the delay that TCP retransmissions would cause.

## Check your understanding

1. **At which OSI layer does a router operate?**

   Answer: The Network layer (Layer 3), because routers use IP addresses to forward packets between different networks.

2. **Which protocol is connection-oriented: TCP or UDP?**

   Answer: TCP is connection-oriented. It establishes a session before sending data and ensures reliable delivery.

3. **What is the main purpose of a firewall?**

   Answer: A firewall filters incoming and outgoing network traffic based on a set of rules, allowing or blocking packets based on criteria like IP address, port, and protocol.

4. **What port does HTTPS use by default?**

   Answer: HTTPS uses port 443.

5. **Name a common network threat where an attacker intercepts and alters communication between two parties.**

   Answer: A Man-in-the-Middle (MitM) attack.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-cc/network-security-foundations