Networking Basics &
Security Infrastructure

Network Design and Configuration

The OSI Model — 7 Layers of Network Communication

The OSI (Open Systems Interconnection) Model is a conceptual framework that describes how data travels from one computer to another across a network. Every layer has a specific job. Understanding OSI is critical because attacks happen at specific layers, and defences are designed per layer.

Network Topologies

A topology is the arrangement of devices in a network — how they are physically or logically connected. The choice of topology affects performance, cost, security, and fault tolerance.

Network Types by Scale

Key Network Configuration Concepts

IP Addressing and Subnetting

Every device on a network needs a unique IP (Internet Protocol) address. IPv4 addresses are 32-bit numbers (e.g., 192.168.1.1). Subnetting divides a large network into smaller sub-networks, improving performance and security by limiting broadcast traffic and isolating segments.

VLAN (Virtual Local Area Network)

A VLAN allows you to logically segment a physical network into separate virtual networks. Devices on different VLANs cannot communicate directly — even if they are connected to the same physical switch. This is a key security tool for network segmentation.

DMZ (Demilitarized Zone)

A DMZ is a separate, isolated network segment that sits between the internet (untrusted) and the internal corporate network (trusted). Public-facing servers (web server, email server) are placed in the DMZ. If a web server is compromised, the attacker only reaches the DMZ — not the internal network.

Network Protocols Important for Security

Essential Components of Data Transfer Governance in Cyber Space

Why Data Transfer Governance Matters

Every day, organizations transfer massive amounts of data — customer records, financial transactions, health reports, intellectual property. Without governance:

• Sensitive data can be intercepted during transmission (confidentiality breach)
• Data can be modified in transit without detection (integrity breach)
• Unauthorized parties can receive data they should never see (privacy violation)
• Organizations can face fines for violating data protection laws (legal/compliance risk)

Essential Components of Data Transfer Governance

1. Data Classification

Before transferring data, you must know what kind of data it is. Organizations classify data into levels and apply different transfer rules to each level.

2. Encryption in Transit

All sensitive data must be encrypted before it travels across any network. Encryption makes the data unreadable to anyone who intercepts it — only the intended recipient with the correct key can decode it.

• TLS 1.3 — Standard for encrypting web traffic (HTTPS). All banking, government, and healthcare websites must use TLS 1.3.
• SFTP / FTPS — Encrypted file transfer protocols replacing insecure FTP
• VPN (IPSec / SSL) — Creates an encrypted tunnel for all data between two endpoints
• S/MIME or PGP — Email encryption standards for sensitive communications
• AES-256 — The encryption algorithm standard for data at rest (stored data)

3. Access Authorization and Authentication

Only verified, authorized users or systems should be allowed to send or receive sensitive data. This requires:

• Digital Certificates (PKI): Cryptographically verify the identity of the sender and receiver before any data transfer begins
• API Keys / OAuth Tokens: For system-to-system data transfers, each system must authenticate using a secure token
• Role-Based Access Control (RBAC): Only users whose job requires accessing specific data can receive it in transfers

4. Data Integrity Verification

After data is transferred, the receiver must be able to confirm that the data arrived exactly as sent — not modified or corrupted in transit.

• Hashing (SHA-256): A unique fingerprint is calculated before sending. The receiver calculates it again after receiving. If both hashes match — data is intact. If they differ — data was tampered with or corrupted.
• Digital Signatures: The sender signs the data with their private key. The receiver verifies with the sender's public key — confirming both identity and integrity.
• Checksums and CRC: Simpler integrity checks used in network protocols

5. Data Loss Prevention (DLP)

DLP tools monitor all outgoing data transfers — email, USB uploads, cloud storage, web forms — and automatically block any transfer that violates data policies. For example, a DLP system can detect if someone is emailing a file containing 1,000 credit card numbers and block it before it leaves.

6. Audit Logs and Traceability

Every data transfer must be logged with: who sent it, what was sent, to whom, when, from which device, and using which protocol. These logs serve as:

• Evidence in security incident investigations
• Compliance proof for regulators (GDPR audit requirements)
• Detection of unusual patterns (an employee suddenly transferring 50GB at midnight)

7. Legal and Jurisdictional Compliance

Data cannot always be transferred freely across international borders. Laws restrict cross-border data flows:

• GDPR (EU): EU personal data can only be transferred to countries with adequate data protection laws. Transferring EU data to a non-compliant country without safeguards is illegal.
• India's DPDP Act 2023: The government can restrict transfer of certain categories of personal data to foreign countries.
• RBI Guidelines: Indian banking and payment data must be stored and processed within India (data localization).

8. Data Retention and Disposal Policy

Data that is no longer needed must be securely deleted — not just regular "delete" which can be recovered, but cryptographic erasure or physical destruction for storage media. Data must not be kept longer than legally required (to limit breach exposure) and must be kept at least as long as legally required (for audit purposes).

Security Infrastructure

Core Components of Security Infrastructure

1. Firewall

A firewall is the first line of defense at the network boundary. It inspects incoming and outgoing network traffic and blocks anything that violates defined rules.

• Packet Filtering Firewall: Checks packet header data (source IP, destination IP, port, protocol). Fast but basic — cannot inspect packet content.
• Stateful Inspection Firewall: Tracks the state of network connections. Knows whether an incoming packet belongs to an already-established connection or is suspicious.
• Next-Generation Firewall (NGFW): Combines traditional firewall features with application awareness, user identity tracking, SSL inspection, and IPS. Palo Alto, Fortinet, and Check Point are popular NGFW vendors.
• Web Application Firewall (WAF): Specifically protects web applications from attacks like SQL injection, XSS, and CSRF by inspecting HTTP/HTTPS traffic.

2. Intrusion Detection and Prevention Systems (IDS/IPS)

These systems watch network traffic for signs of attacks and either alert security teams (IDS) or automatically block the attack (IPS).

3. SIEM (Security Information and Event Management)

A SIEM is like a central command center for security. It collects logs and security events from every system across the organization (firewalls, servers, applications, endpoints) and correlates them to detect attack patterns that no single system would notice alone.

Popular SIEM tools: Splunk, IBM QRadar, Microsoft Sentinel, ArcSight.

4. Antivirus and Endpoint Detection & Response (EDR)

Traditional antivirus software detects known malware using signature databases. Modern EDR tools go further — they monitor endpoint behavior in real time, detect novel threats (zero-days) that have no known signature, and allow remote investigation and containment of compromised devices.

5. Identity and Access Management (IAM)

IAM systems manage who can access which resources. Key components:

• Single Sign-On (SSO): One login gives access to all authorized systems
• Multi-Factor Authentication (MFA): Requires two or more verification methods
• Privileged Access Management (PAM): Extra controls for administrator accounts — the most powerful and dangerous accounts
• Directory Services (LDAP / Active Directory): Central database of all users, groups, and permissions

6. VPN (Virtual Private Network)

A VPN creates an encrypted tunnel between a user's device and the corporate network over the public internet. Essential for remote workers — without a VPN, their traffic travels unencrypted over potentially hostile public networks.

7. PKI (Public Key Infrastructure)

PKI is the system that manages digital certificates — used to verify identities online. When you see the padlock icon in your browser, PKI is behind it. It uses a pair of keys: a public key (shared openly) and a private key (kept secret by the owner).

8. Honeypots

Deliberately vulnerable fake systems designed to attract attackers. When an attacker interacts with a honeypot, security teams learn about their tools, techniques, and entry methods — without any real systems being harmed.

Zero Trust Architecture (Modern Approach)

Traditional security assumed: "everything inside the network is trusted." Zero Trust flips this: "Trust no one — verify everything, every time."

Zero Trust principles:

• Verify identity for every user, every access request — no exceptions, even for internal users
• Apply least privilege — give minimum access needed for each task
• Assume breach — act as if attackers are already inside; monitor continuously
• Micro-segmentation — divide the network into tiny zones so a breach in one area cannot spread

Contingency Planning — Incident Response, Disaster Recovery & BCP

The Three Pillars Explained

Part A — Incident Response (IR)

An Incident Response Plan (IRP) is a documented, pre-planned procedure for detecting, responding to, containing, and recovering from cybersecurity incidents. Having a plan before an attack happens means you respond systematically rather than in panic.

NIST defines 4 phases of Incident Response (NIST SP 800-61):

Key Incident Response Roles

• Incident Response Manager: Leads the entire response; makes decisions under pressure
• Security Analyst: Investigates the attack technically; traces what happened
• Forensic Investigator: Collects and preserves digital evidence
• Communications Officer: Manages internal and external communication during the incident
• Legal/Compliance Team: Advises on legal obligations (notification requirements, law enforcement)

Incident Classification Levels

Part B — Disaster Recovery (DR)

Disaster Recovery focuses specifically on restoring IT infrastructure and data after a major disruption — whether from a cyberattack, natural disaster (flood, earthquake), fire, or major hardware failure.

Key DR Metrics

• RPO (Recovery Point Objective): How much data can we afford to lose? If RPO = 4 hours, we back up every 4 hours. If a disaster strikes, we lose at most 4 hours of data.
• RTO (Recovery Time Objective): How quickly must systems be back online? If RTO = 2 hours, all critical systems must be restored within 2 hours of a disaster.

Types of Recovery Sites

Part C — Business Continuity Plan (BCP)

A BCP is broader than DR. While DR focuses on IT recovery, BCP covers the entire organization — every department, every process, every resource needed to keep the business operating during and after any type of crisis.

BCP Development Process

Business Impact Analysis (BIA)

BIA is the most critical step in BCP development. It identifies:

• Which business functions are mission-critical (cannot stop without severe consequences)
• The maximum tolerable downtime (MTD) for each function
• The financial, reputational, legal, and safety impact of disruption
• Dependencies — which processes depend on which systems, people, and vendors

Cyber Security Policy — EISP, ISSP and SysSP

The Three Levels of Security Policy

EISP — Enterprise Information Security Policy

The EISP is the organization's security constitution. It does not tell employees which passwords to use — it tells them that protecting information is everyone's responsibility and defines what happens if they fail to do so.

Components of a Good EISP

• Statement of Purpose: Why does this policy exist? What is it trying to protect?
• Information Security Goals: Alignment with CIA Triad; specific organizational security objectives
• Scope: Who does this apply to? (All employees, contractors, vendors, visitors)
• Roles and Responsibilities: CISO, department heads, all employees — who is accountable for what
• Risk Management Framework: How the organization identifies and manages security risks
• Compliance Requirements: Which laws and regulations must be followed (IT Act, GDPR, HIPAA)
• Enforcement and Penalties: Consequences for policy violations — from warnings to termination to legal action
• Policy Review Schedule: When and how this policy will be reviewed and updated

ISSP — Issue-Specific Security Policy

Each ISSP document tackles one specific technology or security issue in detail. Common ISSPs include:

• Email Use Policy — What can and cannot be sent via corporate email
• Internet & Social Media Policy — Acceptable use of internet and social platforms on company devices
• Remote Access / VPN Policy — Rules for accessing corporate systems from outside the office
• BYOD Policy (Bring Your Own Device) — Security requirements for personal devices used for work
• Cloud Storage Policy — What data can be uploaded to cloud services
• ERP Security Policy — Access controls, authorized use, and monitoring of ERP systems

Standard Structure of an ISSP Document

1. Statement of Purpose — Why this ISSP exists
2. Authorized Access and Usage — Who may use this technology, for what purposes
3. Prohibited Actions — Clear list of what is NOT allowed
4. Systems Management — Who manages and maintains this technology securely
5. Violations and Penalties — What happens when the policy is broken
6. Policy Review — When and how this specific ISSP will be updated

SysSP — System-Specific Security Policy

SysSP documents are the most technical. They contain the exact configuration rules for a specific system. Two types:

Type 1 — Managerial Guidance SysSP

Written guidance for how a system should be configured and managed — in plain language for IT managers. Example: "The web server must use TLS 1.3 or higher. TLS 1.0 and 1.1 must be disabled. HTTP-only access must be redirected to HTTPS."

Type 2 — Technical Specification SysSP (Access Control Lists)

The actual technical rules programmed into the system. Example — Firewall ACL rules:

ALLOW   TCP  192.168.1.0/24  ANY   PORT 443  (HTTPS inbound from internal)
ALLOW   TCP  ANY  192.168.10.5  PORT 25   (SMTP from mail server only)
DENY    TCP  ANY  ANY   PORT 23   (Block all Telnet - unencrypted)
DENY    TCP  ANY  ANY   PORT 21   (Block all FTP - use SFTP instead)
DENY    ALL  ANY  ANY   (Default deny - block everything else)

Policy Hierarchy Summary

Case Studies of Cyber Security Policy

Summary: Lessons Learned from All Case Studies