Network Security Fundamentals Curriculum

An interactive learning atlas by mindal.app

Launch Interactive Atlas

Generate a curriculum for network security fundamentals. The graph should start with the TCP/IP model, cover common ports and protocols, and introduce essential security monitoring tools.

This curriculum focuses on network security fundamentals, beginning with the TCP/IP model, its layers, and associated security implications. It then covers common network ports and protocols, identifying their functions and vulnerabilities, and introduces essential security monitoring tools for detection, analysis, and response.

Key Facts:

  • The TCP/IP model's four layers (Application, Transport, Internet, Network Access) each present unique security considerations and potential attack surfaces.
  • Understanding common ports and protocols, such as FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53), HTTP (80), HTTPS (443), and RDP (3389), is vital for identifying vulnerabilities and monitoring network traffic.
  • Essential security monitoring tools include packet analyzers (Wireshark), network scanners (Nmap), IDS/IPS (Snort), vulnerability scanners (Nessus Professional, OpenVAS), and SIEM systems (Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel).
  • The TCP/IP model was not originally designed with inherent security features, making additional security measures essential across all layers.
  • The curriculum emphasizes a pedagogical framework that integrates theoretical concepts with practical applications, focusing on vulnerability identification and defensive strategies.

Common Network Ports and Protocols

This sub-topic focuses on the identification and analysis of well-known ports, their corresponding protocols (both TCP and UDP), their functional purposes, and the common attack vectors or security risks associated with their use. Mastering this knowledge is vital for network monitoring and vulnerability assessment.

Key Facts:

  • Ports are numerical identifiers (0-65535) categorized into Well-known (0-1023), Registered (1024-49151), and Dynamic/Private (49152-65535).
  • Port 21 (FTP) is used for file transfer but is vulnerable to FTP bounce attacks and misconfigurations.
  • Port 22 (SSH) provides secure remote logins and file transfers but can be vulnerable to brute-force attacks.
  • Port 23 (Telnet) is highly insecure due to clear-text communication, making it susceptible to eavesdropping.
  • Port 443 (HTTPS) provides encrypted web traffic but can still be vulnerable to SSL/TLS misconfigurations.

Resources:

🎥 Videos:
📰 Articles:

Common Ports, Protocols, and Associated Security Risks

This sub-topic details specific well-known ports and their corresponding protocols (TCP/UDP), highlighting their functional purpose, typical vulnerabilities, and associated security risks. It emphasizes why understanding these risks is critical for network security practitioners.

Key Facts:

  • Port 21 (FTP) is vulnerable to FTP bounce attacks and misconfigurations, with SFTP/FTPS being secure alternatives.
  • Port 22 (SSH) provides secure remote access but can be vulnerable to brute-force attacks if not secured with MFA.
  • Port 23 (Telnet) is highly insecure due to plaintext communication, making it susceptible to eavesdropping and MITM attacks.
  • Port 53 (DNS) is vulnerable to DDoS attacks and DNS cache poisoning, primarily due to UDP's lack of connection validation.
  • Port 443 (HTTPS) provides encrypted web traffic, but can still be vulnerable to SSL/TLS misconfigurations and web attacks like XSS and SQL injection.

Resources:

🎥 Videos:
📰 Articles:

Default Port Security Best Practices

This sub-topic outlines essential security best practices for managing network ports to mitigate risks. It emphasizes strategies like closing unnecessary ports, utilizing firewalls, employing secure protocols, and implementing strong authentication mechanisms.

Key Facts:

  • Closing unnecessary ports is a critical first step to reduce the attack surface.
  • Implementing robust firewall protection ensures that open ports are secured.
  • Using secure protocol alternatives (e.g., SSH over Telnet, HTTPS over HTTP) is crucial for data integrity and confidentiality.
  • Strong authentication, including multi-factor authentication, should be enforced for services accessible via ports.
  • Network segmentation, placing open ports in a DMZ, isolates them from the internal network.

Resources:

🎥 Videos:
📰 Articles:

Port Categorization and Concepts

This sub-topic defines and categorizes network ports, which are numerical identifiers for communication endpoints, and introduces the fundamental networking protocols TCP and UDP. Understanding these classifications is crucial for grasping how network services operate and how data flows.

Key Facts:

  • Ports are numerical identifiers ranging from 0 to 65535, categorized by IANA.
  • Well-known Ports (0-1023) are assigned to common services like HTTP, FTP, and SSH.
  • Registered Ports (1024-49151) are used by user-specific or registered applications.
  • TCP (Transmission Control Protocol) is connection-oriented, providing reliable, ordered data transmission with built-in error recovery.
  • UDP (User Datagram Protocol) is connectionless, offering faster communication by sacrificing guaranteed delivery.

Port Scanning Techniques

This sub-topic introduces port scanning as a fundamental security assessment technique for identifying open ports and services on target systems. It covers various scanning methods, including TCP Connect, UDP, and SYN scans, and their operational characteristics.

Key Facts:

  • Port scanning is a fundamental technique for identifying open ports and services on target systems.
  • TCP Connect Scan initiates a full TCP connection to determine if a port is open.
  • UDP Scan sends UDP packets and analyzes responses to identify services, often being slower but essential for UDP services.
  • SYN Scan (Half-Open Scan) sends a SYN packet but does not complete the TCP connection, making it stealthier.
  • Tools like Nmap are widely used for port scanning, supporting various TCP and UDP scanning mechanisms.

Resources:

🎥 Videos:
📰 Articles:

Essential Security Monitoring Tools

This sub-topic introduces various categories of network security tools, including packet analyzers, Security Information and Event Management (SIEM) systems, vulnerability scanners, and intrusion detection/prevention systems (IDS/IPS). It covers prominent examples and their core functionalities for detection, analysis, and response.

Key Facts:

  • Packet analyzers like Wireshark capture and inspect real-time network traffic for deep packet inspection.
  • Network scanners/mappers such as Nmap are used for network discovery, port discovery, and OS detection.
  • Intrusion Detection/Prevention Systems (IDS/IPS) like Snort detect and prevent unauthorized activity and attacks.
  • Vulnerability scanners like Nessus Professional and OpenVAS identify misconfigurations and flaws in systems.
  • SIEM systems like Splunk Enterprise Security and IBM QRadar aggregate and analyze log and event data for real-time threat detection.

Resources:

🎥 Videos:
📰 Articles:

Intrusion Detection/Prevention Systems (IDS/IPS)

IDS/IPS systems monitor network traffic and system activities for suspicious patterns and malicious actions. They act as a first line of defense, detecting and, in the case of IPS, preventing unauthorized activity and attacks.

Key Facts:

  • IDS/IPS systems monitor network traffic and system activities for suspicious patterns.
  • Snort is a popular open-source network intrusion detection and prevention system.
  • They detect and prevent unauthorized activity and attacks, acting as a first line of defense.
  • Snort uses signature-based detection and protocol analysis to identify threats.
  • IDS/IPS can be configured to actively block malicious traffic.

Resources:

🎥 Videos:
📰 Articles:

Network Scanners/Mappers

Network scanners/mappers are used for network discovery, port discovery, OS detection, and security auditing. They help identify live hosts, open ports, running services, operating systems, and potential vulnerabilities within a network.

Key Facts:

  • Nmap is a powerful open-source tool for network discovery and security auditing.
  • These tools identify live hosts, open ports, running services, and operating systems.
  • Nmap can determine the operating system of target hosts through TCP/IP stack fingerprinting.
  • The Nmap Scripting Engine (NSE) allows for custom scripts to automate tasks and probe for vulnerabilities.
  • Network scanners can be integrated with vulnerability scanners for comprehensive security assessments.

Resources:

🎥 Videos:
📰 Articles:

Packet Analyzers

Packet analyzers, also known as 'packet sniffers,' are fundamental tools for capturing and inspecting real-time network traffic. They are essential for deep packet inspection, network troubleshooting, security issue examination, and debugging protocol implementations.

Key Facts:

  • Packet analyzers capture and inspect real-time network traffic for deep packet inspection.
  • Wireshark is a widely used open-source network protocol analyzer available for UNIX and Windows.
  • These tools help in understanding network communication, identifying anomalies, and investigating security incidents.
  • Wireshark displays detailed protocol information and allows filtering and searching packets.
  • Packet analyzers are crucial for examining security issues and debugging protocol implementations.

Resources:

🎥 Videos:
📰 Articles:

Security Information and Event Management (SIEM) Systems

SIEM systems aggregate and analyze log and event data from various sources across an organization's IT infrastructure. They provide real-time threat detection, security monitoring, and incident response capabilities by correlating events and identifying patterns indicative of security incidents.

Key Facts:

  • SIEM systems aggregate and analyze log and event data from various sources.
  • Splunk Enterprise Security and IBM QRadar are prominent examples of SIEM systems.
  • They provide real-time threat detection and security monitoring by correlating events.
  • SIEM integration with SOAR platforms enhances incident response times.
  • SIEM deployments involve defining objectives, integrating data sources, and configuring correlation rules.

Resources:

🎥 Videos:
📰 Articles:

Vulnerability Scanners

Vulnerability scanners identify misconfigurations and flaws in systems, applications, and devices. They help organizations prioritize and address identified risks, ensuring compliance with industry standards.

Key Facts:

  • Vulnerability scanners identify misconfigurations and flaws in systems and applications.
  • Nessus Professional is a leading commercial vulnerability assessment tool with an extensive database.
  • OpenVAS is an open-source alternative to Nessus, offering similar functionalities.
  • These tools help organizations prioritize and address identified risks for compliance.
  • Nessus provides detailed reports and offers robust reporting capabilities for identified vulnerabilities.

Resources:

🎥 Videos:
📰 Articles:

TCP/IP Model and Security

This sub-topic covers the foundational TCP/IP model, its four layers (Application, Transport, Internet, Network Access/Link), associated protocols, and the security implications and vulnerabilities inherent at each layer. Understanding this model is crucial for identifying potential attack surfaces and implementing effective security measures.

Key Facts:

  • The TCP/IP model consists of four layers: Application, Transport, Internet, and Network Access, each with distinct responsibilities.
  • Each layer of the TCP/IP model presents unique security considerations and potential attack surfaces, such as SYN floods at the Transport Layer.
  • The Application Layer handles protocols like HTTP, FTP, SMTP, DNS, and SNMP, and is vulnerable to attacks like phishing and SQL injection.
  • The TCP/IP model was not originally designed with inherent security features, necessitating additional security measures across all layers.
  • Security at the Network Access Layer involves measures like MAC address filtering, VLANs, and link-layer encryption.

Resources:

🎥 Videos:
📰 Articles:

Application Layer Security

The Application Layer is the top layer of the TCP/IP model, interacting directly with end-user services and applications like HTTP, FTP, and DNS. Due to its direct interaction with user services, it is a frequent target for attackers, necessitating specific security measures.

Key Facts:

  • The Application Layer handles protocols such as HTTP, FTP, SMTP, DNS, and DHCP, making it highly susceptible to user-facing attacks.
  • Common vulnerabilities include web application issues (e.g., SQL injection, XSS), DNS spoofing, DHCP vulnerabilities, and DDoS attacks.
  • Mitigation strategies involve HTTPS encryption, Web Application Firewalls (WAFs), DHCP snooping, input validation, and secure coding practices.
  • Attacks at this layer, such as session hijacking, exploit flaws in application code, logic, or functionality.
  • Strong authentication and session management are crucial for preventing unauthorized access and maintaining session integrity.

Resources:

🎥 Videos:
📰 Articles:

Internet Layer Security

The Internet Layer is responsible for addressing and routing data packets across networks, primarily using IP. Its security focuses on preventing IP manipulation, such as spoofing, and mitigating large-scale attacks like DDoS that exploit IP-level vulnerabilities.

Key Facts:

  • The Internet Layer handles the addressing and routing of data packets across networks, with IP as its primary protocol.
  • Key vulnerabilities include IP spoofing, which allows attackers to forge source IP addresses, and DDoS attacks that overwhelm targets with traffic.
  • Routing attacks, which manipulate routing tables to intercept or redirect traffic, are also a significant concern at this layer.
  • Mitigation strategies include ingress and egress filtering to prevent IP spoofing, secure routing protocols, and traffic filtering/rate limiting for DDoS protection.
  • Deep Packet Inspection (DPI) in modern DDoS mitigation solutions helps identify and filter malicious traffic by analyzing packet headers beyond just source IP.

Resources:

🎥 Videos:
📰 Articles:

Network Access Layer Security

The Network Access Layer manages the physical transmission of data within a network segment, including MAC addressing and error detection. Security at this layer is crucial for preventing local network compromises such as eavesdropping, unauthorized access, and ARP spoofing.

Key Facts:

  • The Network Access Layer handles the physical transmission of data and manages MAC addresses, framing, and error detection within a network segment.
  • Vulnerabilities include eavesdropping, MAC address spoofing, ARP spoofing, switching attacks (VLAN hopping), and physical access attacks.
  • Wireless networks are particularly susceptible to eavesdropping due to their broadcast nature.
  • Mitigation strategies involve MAC address filtering, port security, VLANs for network segmentation, and link-layer encryption.
  • Strong wireless security protocols (WPA2/WPA3), ARP inspection, DHCP snooping, and physical security measures are essential for this layer.

Resources:

🎥 Videos:
📰 Articles:

Transport Layer Security

The Transport Layer is critical for end-to-end communication, utilizing protocols like TCP and UDP, and is vulnerable to attacks that disrupt or manipulate data flow between applications. Securing this layer involves protecting data in transit and preventing service disruption.

Key Facts:

  • The Transport Layer facilitates end-to-end communication between applications on different hosts using TCP and UDP.
  • Vulnerabilities include Man-in-the-Middle (MITM) attacks, Denial-of-Service (DoS) attacks, port scanning, and TCP/IP fragmentation attacks.
  • Mitigation strategies involve firewall rules, secure transport layer protocols like TLS/SSL, and Intrusion Detection/Prevention Systems (IDS/IPS).
  • TLS/SSL encrypts data in transit, ensuring confidentiality, integrity, and providing authentication between communicating parties.
  • Regular software updates and connection timeouts are essential for addressing known vulnerabilities and preventing resource exhaustion.

Resources:

🎥 Videos:
📰 Articles: