Networking Fundamentals

A cybersecurity analyst should be familiar with various network features and principles for gathering, analysing, and interpreting threat data. These features and principles are crucial for understanding the network environment and identifying security threats effectively. This topic will introduce some of these key network features and principles.

In this topic, you will learn about:

• Network classifications
• The OSI model
• Demilitarised Zone (DMZ)
• Simulating networks with Cisco Packet Tracer.

Let us begin

The following video overviews the fundamental networking concepts.

The following video discusses various network types and the functions that they perform.

The OSI model helps in understanding network communication and protocol layers. Each layer represents a specific functionality, and together, they facilitate interoperability between different systems. It's important for network analysts to pinpoint where issues or threats may occur in the network stack, aiding in the interpretation of threat data.

Network Layer Protocols

The following video outlines various network layer protocols and their functionality.

Transport Layer Protocols

The following video outlines transport layer protocols and their functionality.

Application Layer Protocols

The following video outlines various application layer protocols and their functionality.

The Importance of Network Fundamental Knowledge for a Threat Data Analyst

• Knowing the standard ports and protocols used in the network is essential for recognising unusual or unauthorised network traffic.
• Knowledge of common network protocols and attack techniques is essential for recognising potential threats in network traffic.
• Analysing normal traffic patterns helps detect anomalies that may indicate security threats, such as unusual spikes in data transfer or communication patterns.
• Familiarity with network devices like routers, switches, firewalls, and load balancers is essential for understanding how traffic flows through the network and where to collect relevant data.
• Network devices generate logs that contain valuable information about network activities. Analysing these logs is a fundamental part of threat detection and analysis.
• Deep packet inspection and analysis of network traffic helps in identifying anomalies, security breaches, and unusual communication patterns.
• Data flow patterns provide a high-level view of network traffic and is valuable for recognising anomalies and potential threats.
• Understanding network segmentation and access control mechanisms is crucial for preventing lateral movement by attackers within the network.
• Knowledge of encryption protocols and techniques is essential for recognising encrypted traffic and assessing its security.
• Familiarity with VPNs and their configurations is crucial for understanding encrypted tunnels and the potential bypassing of security controls.
• DNS is often used in attack scenarios. Analysing DNS data can reveal malicious domains and activities.

Familiarity with these network features and principles is essential for cybersecurity analysts to effectively gather, analyse, and interpret threat data and protect the organisation's network and data assets.

A DMZ (Demilitarized Zone) is a network segment that acts as a buffer between an internal network and external, untrusted networks like the Internet. It enhances security by isolating and inspecting incoming and outgoing traffic. A DMZ plays a crucial role in threat data analysis by hosting services accessible from internal and external networks. Security devices, such as firewalls and intrusion detection systems, monitor and analyse traffic in the DMZ, allowing organizations to detect and mitigate potential threats before they reach critical internal systems. The DMZ's segregated environment is pivotal for examining and filtering threat data safeguarding the internal network.

The following video explains the functionality of a DMZ

How Did You Go?

Congratulations on completing the topic Networking fundamentals.

In this topic, you learnt about:

• Network classifications
• The OSI model
• Demilitarised Zone (DMZ)
• Simulating networks with Cisco Packet Tracer

Knowledge Check

Complete the following eight (8) activities to check your ability understand the key concepts discussed in this topic. You may repeat this activity as often as you like. Use the arrows to move between the different activities.

Assessments

Now that you have learnt the basic knowledge and skills for this module, you are ready to complete the following assessment event.

Assessment 1 (Short Answer Questions)