Unit 3: Securing Networks — AP Cybersecurity

TCP/IP Model Layers

Layer	Name	Key protocols / concepts
4	Application	HTTP/HTTPS, DNS, SMTP, FTP, SSH, Telnet
3	Transport	TCP (reliable, connection-oriented), UDP (fast, connectionless)
2	Internet	IP addresses, routing, ARP (maps IP→MAC address)
1	Network Access	MAC addresses, Ethernet frames, physical transmission media

Network Attacks

Attack	Mechanism	CIA pillar
ARP poisoning	Sends fake ARP replies linking the attacker's MAC to a legitimate IP. Redirects traffic through the attacker (MitM at Layer 2).	Confidentiality, Integrity
MAC flooding	Overwhelms switch's CAM table with fake MACs, forcing hub-mode broadcast — all frames go to all ports, enabling eavesdropping.	Confidentiality
DNS poisoning	Injects false DNS records so a legitimate domain name resolves to an attacker-controlled IP. Users are silently redirected.	Integrity, Confidentiality
DDoS	Botnet floods a target with traffic, exhausting bandwidth or resources, denying service to legitimate users.	Availability
Man-in-the-Middle (MitM)	Attacker secretly intercepts and optionally modifies communications between two parties. ARP poisoning and evil twin APs are both MitM setups.	Confidentiality, Integrity

Firewalls and ACL Rules

Stateful vs. Stateless

Stateless firewall: Evaluates each packet independently. Cannot distinguish a legitimate reply from an unsolicited inbound connection. Faster but less secure.
Stateful firewall: Tracks active connection state (TCP handshake phases). Automatically permits return traffic for established outbound sessions. Industry standard for perimeter security.

ACL First-Match-Wins Logic

An Access Control List is an ordered list. The firewall evaluates rules top to bottom and applies the first rule that matches the packet — then stops. A packet matching no explicit rule hits the implicit deny all at the end.

Example ACL

Rule 1: PERMIT  TCP  10.0.0.0/24  →  192.168.1.10  port 443
Rule 2: DENY    TCP  10.0.0.0/24  →  192.168.1.10  port 80
Rule 3: PERMIT  TCP  10.0.0.0/24  →  192.168.1.0/24  port 80
Rule 4: DENY    ALL  →  ANY

Query: Packet from 10.0.0.5 → 192.168.1.10 on port 80. Answer: matches Rule 2 → DENY. Rule 3 would permit it to the broader subnet, but Rule 2 was matched first — reading stops there.

Most common exam error: Students scan all rules, find Rule 3 permits port 80 to the /24 subnet, and answer "permit." The correct answer is DENY because Rule 2 matched first. Always stop at the first match.

Writing ACL Rules for the FRQ

When the FRQ asks you to add or modify a rule to close a vulnerability, specify all five fields:

Action (PERMIT or DENY)
Protocol (TCP, UDP, ICMP, or ANY)
Source IP address or range
Destination IP address or range
Port (if TCP/UDP)

Position the new rule before any existing rule that would otherwise match the same traffic first.

Network Segmentation

VLAN: Logically separates devices on the same physical switch into isolated broadcast domains. A compromised device in VLAN 10 cannot directly reach VLAN 20 without traversing a router or Layer 3 switch — which applies ACLs and can alert on lateral movement.
DMZ (Demilitarized Zone): A network segment between the internet and the internal network hosting public-facing servers (web, email, DNS). A compromised DMZ server does not automatically expose the internal network, which sits behind a second firewall.
Microsegmentation: Software-defined fine-grained isolation applied at the individual workload level. Prevents lateral movement even within the same VLAN.

IDS and IPS

System	Placement	Response
NIDS	Passive tap or SPAN port on the network	Detects and alerts only — cannot block traffic
NIPS	Inline — all traffic passes through the device	Detects, alerts, and blocks in real time
HIDS	Runs on individual host or server	Monitors system calls, file integrity, local logs for anomalies

Detection methods: Signature-based = matches against known attack patterns (fast, low false-positive rate, misses zero-days). Anomaly-based = deviates from a learned baseline (detects novel attacks, higher false-positive rate).

SIEM

Security Information and Event Management aggregates logs from all sources (firewalls, servers, IDS/IPS, cloud services) and applies correlation rules to find attack patterns invisible in any single log.

Log aggregation: Centralizes logs — no single device's logs can be selectively deleted to hide an attack
Correlation rules: "5 failed logins from the same source IP within 60 seconds → alert" combines individually benign events into a meaningful signal
Alert triage: Analysts review alerts, investigate, and escalate confirmed incidents

Secure Protocol Replacements

Insecure (plaintext)	Secure replacement	Why
Telnet (port 23)	SSH (port 22)	Telnet sends credentials and data in plaintext; SSH encrypts the entire session.
HTTP (port 80)	HTTPS (port 443)	HTTP transmits content in plaintext; HTTPS wraps it in TLS encryption.
FTP (port 21)	SFTP or FTPS	FTP sends credentials in plaintext; SFTP tunnels through SSH; FTPS adds TLS.

Worked FRQ Scenario: ACL Configuration

Original Practice Scenario · Tian2 AP

Scenario: A company's firewall ACL currently reads:

Rule 1: PERMIT  TCP  ANY  →  10.10.1.5  port 22
Rule 2: PERMIT  TCP  ANY  →  10.10.1.5  port 23
Rule 3: DENY    ALL  →  ANY

A security audit finds that Telnet (port 23) is enabled on the web server at 10.10.1.5, exposing administrator credentials in plaintext. SSH is already available on the same server.

(A) Identify the vulnerability and explain the risk it creates.

Telnet transmits all session data — including authentication credentials — in plaintext. An attacker conducting a packet capture or man-in-the-middle attack anywhere on the network path can read the administrator's username and password without decryption. This violates Confidentiality and could grant full administrative control of the server.

(B) Write the corrected ACL to remediate this vulnerability.

Rule 1: PERMIT  TCP  ANY  →  10.10.1.5  port 22
Rule 2: DENY    TCP  ANY  →  10.10.1.5  port 23
Rule 3: DENY    ALL  →  ANY

Rule 2 is changed from PERMIT to DENY for port 23. SSH (port 22) remains permitted in Rule 1. Because ACL rules use first-match-wins logic, any Telnet connection attempt to 10.10.1.5 now matches Rule 2 and is dropped, preventing plaintext credential exposure.

3. Securing Networks