Securing Networks

What this unit covers

The topics below follow the published Cybersecurity course framework for Unit 3. Cybersecurity publishes no per-unit weighting, so there is no percentage to chase here.

Lessons in this unit

• Networks, Segmentation, and Firewalls20 min · 3 objectivesExplain how segmentation limits blast radius · Interpret firewall rules as allow or deny decisions · Use log evidence to identify suspicious network activity
• Protocols, Ports, and Secure Traffic18 min · 3 objectivesExplain protocol purpose, exposure, and encryption in transit · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact
• Network Evidence and Incident Triage18 min · 3 objectivesExplain baselines, logs, indicators, and containment · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact

Formulas in Unit 3

Every term in Unit 3

All 40 terms we publish for Securing Networks, with definitions. Reading them through is the fastest way to find the ones you cannot define — then drill those in cram mode until you can produce them without the prompt.

Network segmentation

Dividing a network so systems can only reach what they need, with default-deny between zones. Limits lateral movement after an initial foothold.

Denial-of-service attack

Overwhelming a system so legitimate users cannot reach it. Attacks availability specifically, and does not require any access to data.

Distributed denial-of-service (DDoS)

A denial-of-service run from many compromised hosts at once. Blocking one source address does nothing, which is the whole point of distributing it.

Botnet

A network of compromised machines under one attacker's control, rented out or used for DDoS, spam and credential stuffing. The owners usually do not know.

On-path (man-in-the-middle) attack

The attacker positions between two parties, reading or altering traffic while both believe they are talking directly. Defeated by authenticated encryption, not by encryption alone.

ARP poisoning

Sending forged ARP replies so a victim associates the attacker's MAC address with another host's IP. The usual way an on-path attack is established on a local network.

DNS poisoning

Corrupting DNS records or cache so a name resolves to an attacker-controlled address. The user types the right name and arrives somewhere else.

IP spoofing

Forging the source address of packets to impersonate a trusted host or hide the origin. Ingress and egress filtering are the standard countermeasures.

MAC spoofing

Changing a device's hardware address to bypass filtering or impersonate another device. The reason MAC filtering is a weak control on its own.

Replay attack

Capturing valid traffic and re-sending it to repeat an action. Timestamps, sequence numbers and nonces defeat it.

Session hijacking

Stealing a valid session token to continue an authenticated session without knowing the password. Secure cookie flags and short session lifetimes limit it.

Packet sniffing

Capturing traffic passing a network interface. Trivial on unencrypted protocols, which is why HTTP, Telnet and FTP are unacceptable for anything sensitive.

Port scanning

Probing which ports respond on a host to map its services. Reconnaissance rather than attack, and normally the first observable step.

Evil twin

A rogue access point broadcasting a legitimate network's SSID so victims connect to the attacker instead. The defense is verifying the network, not the name.

Rogue access point

An unauthorized wireless access point on a network — sometimes malicious, often installed by an employee for convenience. Both create an unmonitored way in.

Deauthentication attack

Forcing wireless clients to disconnect, usually so they reconnect to an evil twin or so their handshake can be captured.

WEP

The original Wi-Fi encryption, cryptographically broken and recoverable in minutes. Its presence on a network is itself a finding.

WPA2

Long the standard for wireless security, using AES-CCMP. Still widespread, and vulnerable to offline attack on weak pre-shared keys.

WPA3

The current standard, adding Simultaneous Authentication of Equals to resist offline password guessing and providing forward secrecy.

Pre-shared key vs enterprise wireless

A PSK is one password everyone shares, so revoking one user means changing it for all. Enterprise mode authenticates each user individually against a server.

802.1X

Port-based network access control: a device must authenticate before the switch port or wireless network carries its traffic. The basis of enterprise wireless and wired NAC.

SSID broadcast

Whether the network name is advertised. Hiding it is not a security control — the name appears in client traffic anyway — though it does reduce accidental connections.

VLAN

A logical segment on shared switching hardware, separating traffic without separate cabling. Devices on different VLANs need a router to communicate.

DMZ (screened subnet)

A segment holding public-facing servers, reachable from the internet but restricted from the internal network. Compromising a web server should not hand over the file server.

Lateral movement

An attacker expanding from an initial foothold to other systems. Segmentation, least privilege and unique local credentials are what slow it.

Firewall

Enforces rules about which traffic may pass between networks. The rules are the control; the appliance is just where they run.

Packet-filtering firewall

Decides per packet using addresses, ports and protocol, with no memory of prior packets. Fast, and blind to context.

Stateful firewall

Tracks active connections and allows return traffic belonging to a session it saw start. Why an outbound request receives its reply without an explicit inbound rule.

Next-generation firewall

Adds application awareness, user identity and intrusion prevention to stateful filtering. Inspects what the traffic IS, not only where it is going.

Web application firewall

Filters HTTP traffic specifically, targeting injection and scripting attacks a network firewall cannot see inside encrypted, well-formed web requests.

Access control list (ACL)

An ordered list of permit and deny rules. Order matters and most implementations end in an implicit deny — traffic matching nothing is dropped.

Implicit deny

The default of blocking anything not explicitly permitted. The correct posture, and the reason a new service does not work until a rule is added.

IDS vs IPS

An intrusion detection system alerts on suspicious traffic; an intrusion prevention system sits inline and blocks it. Detection cannot stop an attack; prevention can stop legitimate traffic.

Signature-based vs anomaly-based detection

Signatures match known patterns and miss novel attacks; anomaly detection flags deviation from a baseline and produces more false positives. Real systems use both.

False positive vs false negative

A false positive alerts on benign activity; a false negative misses a real attack. Tuning trades one for the other, and alert fatigue from false positives is itself a security failure.

Network logs

Records of connections, denials and errors. Their value depends entirely on being collected centrally, retained long enough, and actually read.

SIEM

Security Information and Event Management — aggregates logs from many sources, correlates them and raises alerts. Turns scattered records into a picture.

Log correlation

Linking events across systems into one story — a failed login here, a successful one there, an outbound transfer after. Single log lines rarely reveal an intrusion.

Honeypot

A deliberately exposed decoy system, valuable because any interaction with it is suspicious by definition.

Network baseline

A record of normal traffic volume, protocols and timing. Anomaly detection is impossible without one, and "unusual" has no meaning until it exists.

What examiners penalize here

• For a scenario about **protocol purpose, exposure, and encryption in transit**, identify the decisive evidence before naming a response. A defensible conclusion here is: Require HTTPS end to end and remove the unencrypted service rather than relying on users to notice the risk.
• For a scenario about **baselines, logs, indicators, and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: The combined indicators justify containment and investigation; a single blocked request alone would be weaker evidence.

Practice Cybersecurity

Our practice bank is drawn from across the whole course rather than filtered to one unit, which is closer to how the exam asks anyway — it will not tell you which unit a question is testing.

Questions about this unit

All 5 units of AP Cybersecurity

1. Unit 1 · Introduction to Security
2. Unit 2 · Securing Physical Spaces
3. Unit 3 · Securing Networks
4. Unit 4 · Securing Devices
5. Unit 5 · Securing Applications and Data