Network components and transmission media

Sub-domain 4.2 asks you to secure network components: the operation of hardware, transmission media, network access control devices and endpoint security. A security manager does not configure every switch, but must know what each component can and cannot do, how it fails, and which settings matter. This lesson covers transmission media, switches and routers, the families of firewalls, proxies, intrusion detection and prevention, network access control and the endpoint's role in network security. The cabling details that matter for data centres are covered in DCE-320 and the hardware in DCE-210; here we look at the security side.

Transmission media

Every network starts with a medium that carries signals. Twisted-pair copper, such as Category 6 and 6A cabling for Ethernet, is cheap and easy to install. It radiates small electromagnetic signals and can be tapped by someone with physical access, and its distance is limited to 100 metres per channel for standard Ethernet. Coaxial cable, now mostly used for cable broadband, has a central conductor and a shield that resists interference. Optical fibre carries light, is immune to electromagnetic interference, does not radiate and supports long distances and very high speeds. Fibre is harder to tap without detection, though not impossible: bending a fibre leaks a little light that a skilled attacker can capture, and some tapping devices are designed to do just that.

Wireless media, radio and, in rare cases, infrared or free-space optics, broadcast signals to anyone within range. Lesson 6 covers wireless security. For all media, the main physical threats are eavesdropping, cutting and interference. Controls include locked telecommunications rooms and pathways, conduit or armoured cable in shared spaces, tamper-evident seals, inspection of pathways, protected distribution systems for classified information in government settings and, above all, encryption at higher layers so that a tapped cable reveals nothing useful. Emanations from equipment can also leak information; standards for shielding against compromising emanations are known in government circles by the code name TEMPEST.

Hubs, switches and bridges

A hub, now obsolete, repeats every incoming signal out of every port, so every attached device sees all traffic. A bridge connects two segments and forwards frames based on MAC addresses. A switch is a multiport bridge: it learns which MAC address lives on which port by watching source addresses and stores them in a content-addressable memory table, then forwards each frame only to the port where its destination lives. Switching reduces eavesdropping compared with hubs, but switches can be attacked. MAC flooding fills the address table with fake entries; when it is full, some switches fall back to flooding all frames out of all ports, behaving like a hub. Port security, which limits the number of MAC addresses per port and can shut the port down on violation, defends against this.

Switches also run protocols that need protection. The Spanning Tree Protocol prevents loops by electing a root bridge and blocking redundant paths; an attacker who sends superior bridge protocol data units can become the root and draw traffic through their device. BPDU guard on access ports and root guard on distribution ports stop this. Port mirroring, called a SPAN port on some vendors' switches, copies traffic to a monitoring port for intrusion detection or troubleshooting; it is useful for defenders and dangerous if an attacker can configure it, which is another reason to protect switch management. Power over Ethernet delivers power to phones, cameras and access points through the data cable; disabling PoE on unused ports and documenting PoE budgets are small but real controls.

Routers and layer 3 switches

Routers connect networks and forward packets between them. Their access control lists can filter traffic by source and destination address, protocol and port, which makes them the simplest form of packet filter. Router security has three planes to protect. The data plane forwards user traffic; protect it with filtering and anti-spoofing. The control plane runs routing protocols; protect it with neighbour authentication and route filtering, as lesson 2 discussed. The management plane carries administrative access; protect it with SSH rather than Telnet, SNMPv3, centralized authentication through TACACS+ or RADIUS with individual accounts, role-based command authorization and logging, and access only from management networks. Configuration should be backed up, compared against an approved baseline and changed only under change control.

Firewalls

Firewalls enforce policy at boundaries. Their capabilities have grown over decades, and exam questions expect you to know the families and what each can see.

Packet-filtering firewalls, the first generation, examine each packet's header in isolation: source and destination addresses, protocol and ports. They are fast but cannot tell whether a packet belongs to a legitimate connection, so rules must allow return traffic broadly, often by allowing all high ports inbound. Stateful inspection firewalls track connections in a state table, recording each session's addresses, ports and TCP state; they allow return traffic only for sessions that were initiated in a permitted direction. Stateful inspection is the baseline for any modern firewall.

Application-level gateways, or proxy firewalls, terminate the connection from the client and open a new one to the server, inspecting the application protocol in between. They understand commands such as HTTP methods or FTP verbs and can enforce rules on them, at the cost of more processing and the need to support each protocol. Circuit-level gateways, such as the older SOCKS proxies, relay TCP sessions after checking the handshake but do not inspect content. Next-generation firewalls, NGFWs, combine stateful inspection with application identification regardless of port, user identity awareness, intrusion prevention, TLS inspection and threat intelligence feeds. Web application firewalls, WAFs, protect web applications specifically, inspecting HTTP requests for attacks such as SQL injection and cross-site scripting; they sit in front of the application, often as part of a reverse proxy or content delivery network.

Firewall rule bases are processed top-down, and the first matching rule usually decides. That makes order critical. A broad allow rule placed above a narrow deny rule shadows the deny, so the deny never takes effect. A narrow rule placed below a broad rule with the same action is redundant. Over years, rule bases accumulate hundreds or thousands of such rules, many for projects long finished. Good practice is to place specific rules above general ones, end with an explicit deny-all rule that logs, document an owner and business justification for every rule, review rules at least annually, and remove rules that have not matched any traffic in a defined period after confirming with their owners.

import ipaddress as ip
# (name, source, destination, port, action) evaluated top-down; port None means any
rules = [
    ('R1 allow users to web', '10.20.0.0/24', '0.0.0.0/0', 443, 'allow'),
    ('R2 allow users anywhere', '10.20.0.0/24', '0.0.0.0/0', None, 'allow'),
    ('R3 deny users to payroll DB', '10.20.0.0/24', '10.30.5.10/32', 5432, 'deny'),
    ('R4 allow app to payroll DB', '10.30.1.0/28', '10.30.5.10/32', 5432, 'allow'),
    ('R5 deny all', '0.0.0.0/0', '0.0.0.0/0', None, 'deny'),
]
def covers(a, b):
    sa, da, pa = ip.ip_network(a[1]), ip.ip_network(a[2]), a[3]
    sb, db, pb = ip.ip_network(b[1]), ip.ip_network(b[2]), b[3]
    return sb.subnet_of(sa) and db.subnet_of(da) and (pa is None or pa == pb)
for j, later in enumerate(rules):
    for earlier in rules[:j]:
        if covers(earlier, later):
            kind = 'redundant' if earlier[4] == later[4] else 'SHADOWED (never takes effect)'
            print(f"{later[0]} is {kind} by {earlier[0]}")
            break

R3 deny users to payroll DB is SHADOWED (never takes effect) by R2 allow users anywhere

Proxies and gateways

A forward proxy sits between internal users and the internet, making requests on their behalf. It can authenticate users, filter by category and reputation, scan downloads for malware, enforce data loss prevention policies and log activity for investigations. Secure web gateways, now often delivered from the cloud, are the modern form. A reverse proxy sits in front of servers, accepting requests from the internet on their behalf; it can terminate TLS, balance load, cache content, hide server details and host a WAF. Load balancers distribute requests across servers for availability and scale and are commonly combined with reverse proxies.

Inspecting encrypted traffic requires TLS interception: the proxy decrypts traffic using a certificate issued by an internal certificate authority that managed devices trust, inspects it and re-encrypts it. Interception improves visibility but breaks end-to-end encryption, adds latency, creates a valuable target in the proxy itself and raises privacy and legal questions. Policies usually exempt categories such as banking and health sites, and organizations should tell employees that monitoring takes place, consult legal counsel and limit who can see decrypted content. Certificate pinning in some applications deliberately prevents interception, so exceptions are needed.

Intrusion detection and prevention

An intrusion detection system, IDS, monitors traffic or host activity and raises alerts; an intrusion prevention system, IPS, sits in the traffic path and can block. Network-based systems watch traffic from a mirror port or tap, or inline; host-based systems run on endpoints and watch logs, files and processes. Detection methods are signature-based, matching known attack patterns, which is accurate for known threats but blind to new ones; anomaly or behaviour-based, comparing activity against a baseline, which can find new attacks but produces more false positives; and stateful protocol analysis, which checks that traffic follows protocol specifications.

Tuning is everything. A false positive is an alert on benign activity; a false negative is a missed attack. An IPS that blocks a false positive can stop a business process, so inline systems are often deployed first in detection mode. Encrypted traffic is invisible to network IDS unless it is decrypted somewhere, which is one reason endpoint detection and response, EDR, has become central: it sees activity on the host after decryption. Honeypots, decoy systems that no legitimate user should touch, and honeynets, networks of them, give high-confidence alerts because any interaction is suspicious. Lesson 11 connects these sensors to monitoring and the security operations centre.

Network access control and endpoints

Network access control, NAC, decides whether a device may connect and to what. IEEE 802.1X provides port-based authentication with three roles: the supplicant, software on the device; the authenticator, the switch or wireless access point; and the authentication server, usually RADIUS, which checks credentials or certificates against a directory. Until authentication succeeds, the port passes only authentication traffic. NAC products add posture assessment, checking that a device has current patches, running endpoint protection and disk encryption, and can place non-compliant devices into a remediation VLAN. Devices that cannot run a supplicant, such as printers and some IoT devices, are often admitted through MAC authentication bypass, which is weak because MAC addresses are easily spoofed; such devices should land in restricted segments. Pre-admission control checks before a device joins; post-admission control monitors behaviour after.

Endpoints are part of the network's security. Host-based firewalls, EDR, application allow-listing, full-disk encryption, timely patching and secure configuration baselines all reduce the chance that a compromised endpoint becomes a launching point. Mobile device management and unified endpoint management enforce these policies on laptops and phones, including personal devices in bring-your-own-device programs, where containerization separates corporate data from personal data. In zero trust designs, endpoint health is one of the main inputs to every access decision.

Operating network hardware securely

Network equipment needs the same life cycle management as servers. Keep an inventory of every device with its firmware version and support status. Apply vendor security updates promptly; edge devices such as VPN concentrators and firewalls have been among the most exploited targets of recent years, with several government advisories urging emergency patching. Replace devices before they reach end of support. Use redundant power supplies and uninterruptible power for core equipment, and plan for warranty and spare parts. Change default credentials before deployment, disable unused services and ports, and protect configuration backups, which often contain secrets.

Thinking like a manager

When an exam question asks which device can stop a particular attack, match the device's depth of inspection to the attack's layer. When it asks how to reduce alert fatigue, the answer is tuning and correlation, not switching off the IDS. When it describes a rule base that has grown out of control, the answer is governance: ownership, documentation, periodic review and removal. When it describes untrusted devices joining the network, the answer is NAC with authentication and restricted segments for devices that cannot authenticate strongly.