Network Architectures

Technology is filled with acronyms, and network architecture is no exception. The following acronyms are commonly associated with network architectures (see Figure 2-1):

Network Topology

Now that you’ve learned how a network topology describes how a network is physically arranged, it’s important to understand that you can use the same terms to describe the logical topology, the way in which data are transmitted between network nodes. To make matters a little more confusing, a network’s logical topology does not necessarily match its physical topology.

Network Protocol

Network protocols are the rules and conventions used for communication. A protocol is a format for exchanging information that all agree on. Parameters include data compression method, type of error checking, and the signal when data is finished receiving or transmitting (see Figure 2-2):

• Ethernet : The IEEE 802.3 standard specifies all forms of Ethernet media and interfaces. Ethernet is the most widely implemented LAN standard.

• TCP/IP : If you browse the Web, then you are using the Transmission Control Protocol/Internet Protocol more commonly referred to as TCP/IP. TCP/IP is a suite of specialized protocols and has become the standard because it is open; rather than proprietary, it is flexible, and it is routable.

• Sub-protocols : When you surf the Web, you will be using a few of the sub-protocols including dynamic host control protocol (DHCP), hypertext transfer protocol (HTTP), file transfer protocol (FTP), and domain name system (DNS). When you turned on your computer, the computer requested an IP address from the DHCP server. All devices that want to use the Internet require an IP address. After opening your browser, you type in the name of the website that you wish to visit, for example, www.cssia.org/. A server running the domain name system (DNS) translates the easily remembered domain names that we use into its IP address equivalent. The home page from the CSSIA site is then displayed in your browser.

• Protocols are used throughout networking to provide communication standards. The Institute of Electrical and Electronics Engineers (IEEE) is a professional association and is one of the leading networking standards organizations.

• IEEE 802.11 : IEEE 802.11 is the standard for wireless networking. Communication protocols that define how wireless LANs operate.

The OSI Model

In the 1980s, a universal set of specifications were developed that would enable any computer platform to communicate openly. The result was the Open Systems Interconnection (OSI) model. The OSI model is useful for understanding computer-to-computer communications over a network.

The model is divided into seven layers. At each layer, protocols perform services that are unique to that layer. The protocols for that service also interact with protocols in the layers directly above and below. At the bottom, you have the Physical layer services that act on the network cables and connectors to issue and receive signals. At the top, you have the Application layer protocols that interact with the software that you use such as an email program or a web browser.

The OSI model is a theoretical representation of what happens between two nodes communicating on a network. For specific details regarding each layer and a graphic representation read “'How OSI Works” (https://electricalacademia.com/computer/osi-model-layers-functions/).

IP Packet

In order for networks to share information and resources, rules must be followed for effective communication. A large amount of data must be broken into smaller, more manageable chunks called packets before transmission can occur from one computer to another. Each protocol has its own definition of a packet.

Figure 2-3 breaks down an IP packet into two main sections: the header and the data (also referred to as the payload). The header section contains all of the information required to describe the packet, such as where the packet is going (the IP address of the destination) or where the packet is coming from (the source IP address). Of course, the data itself is contained in the payload.

TCP vs. UDP

It is important to understand the differences between a Transmission Control Protocol (TCP ) and a User Datagram Protocol (UDP). A UDP is a connectionless, unreliable protocol, while Transmission Control Protocol (TCP) is connection-oriented and ensures that packets are processed in the same order in which they were sent.

When you send a package with FedEx, you have a tracking number that you can use to make sure that the package was received by the intended party, very similar to TCP. Contrast this scenario with that of sending mail by depositing it in a mailbox. You hope that the other party receives it, but you cannot track it. You do not receive a confirmation that it arrived. This second scenario is much like UDP.

Three-Way Handshake

One of the characteristics of the TCP protocol is that it is reliable and guaranteed. Therefore, systems must follow a specific pattern when TCP is used to establish communication (see Figure 2-4).

This pattern is referred to as the three-way handshake. To illustrate this pattern, let’s use a phone call. You call your friend—that is the SYN. When your friend answers the phone and says “hello”—that is the SYN/ACK. When you respond, that is the ACK. Now, the conversation is ready to go forward. Because TCP is guaranteed and reliable, it is popular for many network applications and services such as HTTP, FTP, and Telnet.

Packet Delivery

To deliver a packet, you have to know where it is going. Packet delivery can be either local, which applies to packets being delivered on a local network, or remote, which are packets being delivered outside your local network (see Figure 2-5).

Local Packet Delivery

Local packet delivery uses the system’s hardware address or Media Access Control (MAC) address. Each network device has a unique hardware address assigned to it by the manufacturer. A MAC address is made up of six pairs of hexadecimal digits. For example, I can use the command ipconfig/all to locate the physical address of my Ethernet card which is 08:00:27:00:10:9D. The first three sets of digits are unique to a manufacturer, and the remaining three sets are unique to the card itself. Figure 2-6 provides an example of a local packet delivery process using images, directional arrows, and numbers identifying what occurs at each step.

Remote Packet Delivery

Remote packet delivery uses the IP address. IP addresses are 32-bit numbers that are usually referred to in their decimal equivalent, like 192.168.1.100. Before sending a packet, the system will first determine if the destination IP address is on a local or remote network. After determining that the packet is indeed destined for a remote network, it forwards the packet to the network gateway, the router.

Routers are used to interconnect networks, and the process of moving packets from one network to another is called routing. If a router does not know where the destination network is, it forwards the packet to its defined gateway. This process is repeated until the packet arrives at the router serving the destination network. At this point, the router will use local packet delivery to forward the packet to the appropriate MAC address of the destination system.

Domain Name System (DNS)

The domain name system (DNS) is a hierarchical naming system for any resources connected to the Internet or a private network. DNS translates the domain name, cssia.org, to its IP address, 67.179.77.158. Most of us cannot remember a bunch of IP addresses for the websites that we visit. Domain names are much easier for us to remember. Review Figure 2-6, which provides an example of a local packet delivery process using images, directional arrows, and numbers identifying what occurs at each step.

Network Address Translation (NAT)

To understand network address translation (NAT), we first need to understand the difference between a private IP address which is non-routable and a public IP address which is routable (see Figure 2-7). The previous slide defined three address ranges that are used for private IP addresses. When a server using the dynamic host control protocol (DHCP) is used to automatically assign IP addresses to network nodes, private IP addresses are assigned. Because private IP addresses are non-routable, there needs to be an “interpreter” in place to substitute a routable address. Without a routable IP address, a user would be confined to his network and would not be able to surf the Web, for example. NAT is the process of modifying IP address information in the IP packet header so that the packet can be transmitted across a traffic routing device.

Many home networks use NAT, a feature found in routers, so that multiple hosts on the home network can access the Internet using a single public IP address.

Security Zones

Because the first aspect of security is a layered defense, different zones are designed to provide layers of defense (see Figure 2-8). For example, a company would locate its production network in a restricted zone and use controls such as a firewall to protect it. A web server or email server, on the other hand, would be located in a less controlled zone like a demilitarized zone (DMZ) since users need to access this resource from both inside and outside the organization. The Internet is located in an uncontrolled zone—a company does not have the ability to control the Internet.

Demilitarized Zone

The demilitarized zone, or DMZ, acts as a buffer zone between unprotected areas of a network such as the Internet and protected areas like sensitive company data stores (see Figure 2-9). Traffic between these two zones can be monitored and regulated.

Virtual LAN (VLAN)

Computers connected to different physical networks can act and communicate as if they were on the same physical network (see Figure 2-10). For example, you may have a large sales department located on a number of floors through the building. Rather than move all of the sales people on one floor, you can create a VLAN so that they can communicate and share resources. VLANs are implemented by using switches and software. Systems on separate VLANs cannot directly communicate with each other, and you can use trunking to span a single VLAN across multiple switches.

Tunneling

Tunneling encapsulates packets so that different protocols can coexist in a single communication stream. Encryption can be used to provide confidentiality and security. Internet Protocol Security (IPsec) is an open source protocol for securing communications across any IP network such as the Internet (see Figure 2-11). If your branch office is located in a different geographic region than headquarters, you can use IPsec to tunnel your communications securely.

Infrastructure Security: Securing a Workstation

Virtualization

Virtualization technologies have become very prevalent in many organizational networks. Replacing traditional, stand-alone pairing of hardware and operating systems, today’s virtualization enables us to access virtual machines, desktops, and applications on any host device anywhere on the network. This technology offers several improvements in network security but also comes with its share of potential vulnerabilities (see Figure 2-12).

Bridges

Bridges are devices that allow us to interconnect two LAN segments or collision domains. Network switches are actually multiport bridges. Wireless access points would also be considered bridging devices (see Figure 2-13).

Bridges operate at the data link layer, filter traffic based on MAC addresses, and they reduce collisions by creating two separate collision domains. Bridges, however, have been replaced by switches.

Modems

Modems, or modulator–demodulators, are devices that connect two network segments using different media types and communication protocols. Asynchronous modems, or phone modems, were used in the early days to connect SOHO networks to the Internet via a phone line. Synchronous modems now connect SOHO networks to the Internet via phone services (DSL), cable services, and even satellite services. Cell phones are often used today as a type of modem making the connection to the Internet through the cell phone network. Modems have several security features including MAC filtering and encryption.

Virtual Private Networks

Virtual private networks (VPNs) are the most common type of technology used today to establish secure communications.

Intrusion Detection System

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) are designed to detect signs of attacks or unusual traffic on a network. IDS and IPS systems come in different forms including network appliances, modules within network switches and routers, and as an advanced feature on network devices and different operating systems. An intrusion detection system will send an alert when it detects patterns such as a signature indicating an attack or unusual traffic also known as an anomaly. IPS systems not only generate an alert, but they can take corrective actions as well.

Mobile Devices

Security Concerns for Transmission Media

Network media pose several different types of vulnerabilities. These vulnerabilities include disconnection, packet sniffing, and unauthorized access to rogue devices. It is important to address physical security concerns. Network connections should be labeled and monitored in order to control unauthorized access. All unused media ports should be disabled.

Network-Attached Storage

Most modern networks now include mass storage devices which include NAS (network-attached storage), SAN (storage area network), and iSCSI. These technologies are devices that contain multiple hard drives and are used to store and share data with multiple devices on the network. Mass storage devices require high-speed connections, access control, and, in some cases, encryption technology.

Summary

It is important to have an understanding of network fundamentals needed to build network security. Be familiar with the basic network architectures and protocols which will help you to implement secure network administration principles. It will be important to use common protocols discussed in this lesson as needed to employ infrastructure security. Keep in mind the importance of what you learned about routing, and address translation which will help you further understand the vulnerabilities and threats that can be exploited.

Resources