Module 7 Cheat Sheet — Network Security
The threat chain
A vulnerability (weakness) is used by an exploit (working method) to carry out an attack (the act) against your data. A threat is the potential for that to happen. Defense in depth = layers, so one failure never means game over.
Data has three states
- At rest (on disk) — disk/file encryption, permissions, physical security.
- In transit (on the wire/air) — TLS, VPNs, WPA3.
- In use (in RAM/CPU) — the book called this unprotectable; TEEs / confidential computing now ship on every major cloud. Protectable — not solved.
Firewalls and friends
- Stateless — judges each packet alone against rules.
- Stateful (the minimum today) — tracks conversations; replies to what you started get in, unsolicited traffic does not.
- NGFW — adds application awareness (knows "this is Dropbox", not just port 443).
- Host firewall — on the endpoint itself; the laptop carries it everywhere.
- DMZ / screened subnet — public-facing servers live in a zone that cannot reach the inner LAN; if the web server falls, the LAN does not fall with it.
- IDS vs IPS — IDS detects and alerts (out of band); IPS sits inline and blocks.
Encryption essentials
- Symmetric — one shared key, fast, bulk data: AES. DES/3DES are retired (3DES disallowed by NIST after 2023).
- Asymmetric — a key pair, two distinct operation pairs: public key encrypts / private key decrypts (RSA-style key transport), and private key signs / public key verifies. Strangers can establish secrets over hostile networks.
- Signing ≠ encrypting. Private key signs, public key verifies; a signature proves author + integrity, hides nothing. ("Encrypt with the private key" is an RSA-only shortcut — ECDSA/Ed25519 have no encryption operation.)
- TLS 1.3 — asymmetric crypto to agree keys, symmetric AEAD to carry data (AES-GCM/AES-CCM or ChaCha20-Poly1305). The ordinary certificate-authenticated web handshake uses ephemeral (EC)DHE, so forward secrecy is the norm; resumed pre-shared-key sessions may skip the fresh exchange.
- Certificate chain — server cert ← intermediate CA ← root CA your OS already trusts. Free and automated since Let's Encrypt/ACME.
Who are you, what may you do
- AAA: authentication (prove identity) · authorization (least-privilege permissions) · accounting (log what happened).
- Factors: something you know · have · are. MFA = two different ones.
- Passwords (NIST SP 800-63B-4): length + blocklists win; no composition rules, no forced periodic expiry — force a change only on evidence of compromise.
- MFA ladder: password alone → SMS code → TOTP app → passkeys/FIDO2 (phishing-resistant, the 2026 direction).
- Access-control models: MAC — system-enforced labels, users can't override · DAC — the resource's owner decides · rule-based — ACL-style conditions · role-based (RBAC) — permissions follow the job role · attribute-based (ABAC) — computed per request from device, location, time and risk; the model zero trust runs on.
VPNs in 2026
Current stack: IKEv2/IPsec, TLS-based VPNs, WireGuard. PPTP was broken by published cryptanalysis in 1998, cracked as a paid service in 2012 and — with inbound L2TP — deprecated by Microsoft in 2024. Recognize it, never deploy it. Any IPsec client behind NAT relies on NAT-Traversal (ESP in UDP 4500).
Malware: the taxonomy and the landscape
Classic types: virus (attaches to a host file) · worm (self-spreads) · trojan (pretends to be wanted) · spyware (watches). The 2026 reality on top: ransomware appears in 48% of breaches, and initial access is now led by vulnerability exploitation at 31% — ahead of stolen credentials for the first time (DBIR 2026). Patching and MFA are anti-malware controls, in that order.
Network Essentials · Module 7 · Turning Point Academy — backbone: Al-Doori, Network Essentials, Ch. 14 & 15.