Skip to content
academia.sh
tr
Log in

Course Intermediate

Network Security

Published Updated

By the end of this course

Start course

01

Protocol Security

Counting the claims network protocols accept without verification: the claim distribution per layer, the claims an open port is ready to accept, the corrupted records in address and name resolution caches, rogue address assignment, denial of service measured by capacity arithmetic, on-path attacks as an evidence-chain gap, and replay and spoofing measured in terms of freshness proof.

  1. 01 Layer Models and Attack Surface Measuring the network surface in claims: a single meter reading carrying 18 claims across four layers with none of them having proof, five defenses making 11 claims verifiable while leaving 7 open, a defense being unable to see any claim of the layer beneath it, and verification costing 4 extra round trips, 13 key items, 25 manual items, 11 rejected connections, and 6 devices left out.
  2. 02 Common Ports and Services Measuring open services in claims: 20 services opening 49 accept points across 6 hosts, 21 accept points resting on no proof at all, 4 externally reachable services receiving not one legitimate request in 30 days, closing unused services and narrowing access cutting accept points to 27 while breaking 4 periodic flows, and verifying the last 7 accept points excluding 240 devices.
  3. 03 Address Resolution Attacks Measuring how the address resolution cache is corrupted by an unverified reply: 6 of 18 records corrupted in a set of 26 replies, a pinned record rescuing 4 and leaving 2, a consistency check rescuing 5 and leaving the single most valuable record, accepting only the requested reply rescuing all six while cutting 3 legitimate announcements, and the three defenses together rejecting 4 legitimate replies and never forming 2 records at all.
  4. 04 Name Resolution Attacks Measuring how the name resolution cache is corrupted by an unverified reply: 7 of 16 names corrupted, misdirecting 38 of 73 dependent services; signed verification rescuing 3 records and leaving 4 in an unsigned zone; an expired signature making 2 names fully unresolvable and stopping 9 services; strict mode zeroing out corrupted records while stopping 47 services; and a lifetime cap cutting corrupted-record duration by 88.1% while raising query count by 346.5%.
  5. 05 Address Assignment Risks Measuring address assignment in claims: 14 endpoints accepting 70 claims without verification at 5 claims per reply, the first-reply-wins rule binding 7 endpoints to a source with no proof, port trust zeroing out misconfiguration while leaving 2 endpoints unconfigured, and pool inspection combined with static assignment correctly configuring the same 12 endpoints with 3 manual items while leaving 2 endpoints misconfigured.
  6. 06 Denial of Service Attacks Measuring denial of service through capacity arithmetic: the same 4,000 req/s load producing the same result across four different source distributions, a 4,096-slot state table filling in 1.02 seconds, a per-source rate limit cutting the load to 5 on a single source while changing nothing at 4,000 sources, handshake proof ending slot exhaustion without ever lowering the request rate, and load shedding cutting legitimate traffic to 22%.
  7. 07 On-Path Attacks Measuring an on-path attack as a missing chain of evidence: 3 of 8 flows having no chain at all across 36 hops and 16 of those hops being able to read the content, the number of parties that could produce the identity claim being 272, endpoint verification raising that number to 509, root pinning lowering it to 11, and the single flow carrying 89,400 requests staying chainless because it cannot verify.
  8. 08 Replay and Spoofing Attacks Measuring replay and spoofing in terms of freshness proof: 10 message types accepting a replay as is with no freshness proof, the counter fully protecting 75% of the volume without covering even a single state-changing type, the timestamp staying open for a 120-second window, the nonce with a separate store staying open by 2 recipients, and 36,460 requests still being repeatable without limit even with all three proofs on.

02

Perimeter Defense

How many claims the boundary drawn around the network itself makes provable: the space firewall generations see and prove, the path segmentation closes in the zone graph plus the demilitarized zone, the proxy and jump server as checkpoint, the difference between detection and prevention over the same event set, the early signal a honeypot and a sinkhole produce, the access scope of a virtual private network, and how rule evaluation order changes flow outcomes.

  1. 01 Firewall Generations The forty-eight claims carried by eight flow classes are run across three firewall generations: how many the packet-filtering box sees, how many the stateful one sees, how many the application-aware one proves, how many new items each generation must watch in return, and how much of what is proven encrypted flow takes back.
  2. 02 Network Segmentation and the Demilitarized Zone Four layouts are run over an eight-zone graph: flat network, perimeter control alone, segmentation without a demilitarized zone, and full segmentation; each one counts the open path count, the item reached at the first hop and transitively from the outside zone, the zone reached when one zone falls, and the legitimate flow missed when rules were written.
  3. 03 Proxy Servers and the Jump Server Ten connection classes run across four layouts: once a checkpoint is set up, how many of the period's connections pass through a single point, how many skip the point, how many classes remain once skip paths are closed by a rule change, what the point's own load is and how much path its failure cuts, and which claim becomes provable at the point.
  4. 04 Intrusion Detection and Prevention Systems Fourteen event classes and seven signatures run over the same period: the difference in what network-based and host-based sensors see, caught and missed events, how many alerts are false positives, the legitimate work cut once switching to prevention mode, and the detection that closing a noisy signature loses in the same move.
  5. 05 Honeypots and Sinkholes Four decoy items that legitimate work never visits are run over the same period: how low the interaction false-positive rate stays next to signature-based detection, how many bad event classes never appear under this arrangement, and how many legitimate connections the sinkhole cuts per connection it drops.
  6. 06 Virtual Private Networks The access scope a tunnel opens is run across three placements: how many items the remote endpoint reaches directly when it lands in the internal zone, how many items fall out of scope when it lands in a separate zone and in a zone per role; how many connections a split tunnel leaves outside inspection, and how many connections a single verification is enough to count as proven subject identity.
  7. 07 Access Control Lists Rule evaluation order is run across ten rules and sixteen known flows: the first matching rule is found for each flow, the same list is evaluated in five separate orders, and how many flows' outcomes change when the order changes is counted; how many legitimate flows a hardening move cuts and the path that specific-to-general ordering opens are measured.

03

Wireless Security

How many of the claims still hold once the cable ends: the claim encryption generations prove and leave open, along with the devices left out in the transition, the difference between a single shared secret and a per-person identity in terms of trust root and revocation step, the claim a client cannot verify against an evil twin and the path that mutual authentication closes, the frame type that protected management frames close and the one they leave open, the area where the signal spills past the building boundary on a coverage map, and the item unauthorized device scanning finds and the one it does not.

  1. 01 Wireless Encryption Generations Four wireless encryption generations are measured against the same set of ten claims: the old generation built on a stream cipher proves none of the ten claims, the generation using a block cipher in counter mode proves five, and the simultaneous-authentication generation raises that to seven. The cost of the transition is counted in the device inventory: when the top generation is made mandatory, four thousand three hundred twenty-one of four thousand five hundred forty devices are left out.
  2. 02 Authentication Methods Personal and enterprise mode are separated in terms of trust root: a single shared secret in personal mode grants access to all twelve items on a network, and changing it means touching four thousand five hundred forty devices; per-person identity in enterprise mode brings that down to an average of two and a half items, and revocation is a single step. Enterprise mode ties six of seven claims to proof but adds one claim, and does not verify it under the default configuration.
  3. 03 Rogue Access Points Six of the eight signals a client looks at when choosing a network are seen before the connection is made, and none of them carry proof. Across eight registered profiles, four paths to the evil twin are open and three are partially open; trust-root pinning, deleting unused profiles, and turning off automatic connection bring the open path to zero, while the two partial paths close only with a generation mandate that leaves four thousand two hundred ninety-two devices out.
  4. 04 Deauthentication Attacks Of twelve frame types, only one carries integrity proof at baseline; protected management frames bring this count to four and tie three of eight management frames to proof, leaving five unprotected because they are pre-connection. Three of the eight mechanisms that disconnect a connection close; the record the defense sees moves from the disconnect counter to the rejected-frame counter, and the catch rate rises from three sixths to six sixths.
  5. 05 Wireless Network Auditing A fictional branch building's coverage map is calculated on a one-meter grid: the portion of the connectable area that spills outside the building is one thousand eight hundred thirty-eight square meters, the area where frames can only be heard is twenty-nine thousand six hundred twenty-two square meters, twelve times the inside area. Lowering transmit power zeroes the outside connectable area but does not close the audible area; an unauthorized-device scan finds three of six out-of-inventory sources in two hours, one of which is not found even with continuous monitoring.

Final exam

Network Security — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close