Week 04 Quiz

Test your understanding of the weekly concepts.

Format: 10 multiple-choice questions. Passing score: 70%. Time: Untimed.

Take Quiz
CSY101 Week 04 Beginner

Practice how network traffic flows, how packets are inspected, and where trust breaks down. Complete these labs before moving to reading resources.

Cybersecurity Essentials

Track your progress through this week's content

Week Introduction

💡 Mental Model

Networks are highways for data — and attackers. Every connection expands attack surface. Every packet is an opportunity to intercept, modify, or inject malicious content.

This week explains how networks work at a security-relevant level: why data flows in packets, what trust boundaries exist, and why "network security" is fundamentally about controlling where data can flow and who can observe it.

Learning Outcomes (Week 4 Focus)

By the end of this week, you should be able to:

  • LO2 - Technical Foundations: Explain how networks transmit data and why packet-based communication creates security challenges
  • LO3 - Threat Landscape: Identify network-based attack patterns (interception, modification, spoofing)
  • LO4 - Risk Reasoning: Analyze trust boundaries in network architectures and their security implications

Lesson 4.1 · Networks as Attack Surface Multipliers

Core principle: Networks enable collaboration and resource sharing — but every connection is a potential attack vector. The moment a system joins a network, it becomes accessible to anyone else on that network (and potentially the entire internet).

What networks provide:

  • Communication: Email, messaging, video calls
  • Resource sharing: File servers, printers, databases
  • Remote access: Cloud services, remote desktop, SSH
  • Distributed computing: Load balancing, distributed databases

Security trade-off: Standalone (air-gapped) systems are highly secure but useless for modern work. Networked systems are productive but exposed. Organizations must balance connectivity with protection.

Diagram showing concentric circles of exposure: Local System (Green/Safe) -> LAN (Yellow) -> Internet (Red/Danger)
Connecting to a network expands the attack surface significantly.

Attack surface expansion:

  • Local system: Attacker needs physical access (very limited threat)
  • Internal network: Anyone on LAN can attack (insiders, lateral movement)
  • Internet-facing: Entire world can probe for vulnerabilities (maximum exposure)

Defender assumption: Treat all network traffic as potentially hostile. Never trust data simply because it arrived over a network connection.

Lesson 4.2 · Packets: The Fundamental Unit of Network Communication

💡 Mental model

Imagine sending a book by tearing out pages, putting each in an envelope with addressing info, and mailing them separately. That's how networks send data — in small chunks called packets.

Why packets?

Packet structure (simplified):

Comparison of physical envelope vs digital packet structure (Header, Payload, Trailer)
Packets are like digital envelopes — anyone handling them can potentially read the contents if not sealed (encrypted).

Security implications:

Defender principle: Assume network is hostile. Use encryption (TLS/HTTPS) to protect confidentiality and integrity. Use authentication to prevent spoofing.

Lesson 4.3 · TCP/IP Model: Security at Every Layer

Why layering matters: Networks are complex. Layering breaks the problem into manageable pieces — each layer provides services to the layer above and uses services from the layer below. Each layer is also a potential attack target.

The four layers (bottom to top):

Security insight: Attacks can target any layer. A firewall (layer 3/4) won't stop XSS attacks (layer 7). TLS encryption (layer 4/7) won't stop ARP spoofing (layer 2). Defense-in-depth means controls at multiple layers.

Example multi-layer attack: Attacker ARP spoofs (layer 2) to intercept traffic, downgrades HTTPS to HTTP (layer 7), then steals credentials (application vulnerability).

Lesson 4.4 · Network Segmentation and Trust Boundaries

Core principle: Not all parts of a network should trust each other equally. Segmentation creates zones with different security policies, limiting blast radius when compromise occurs.

Common network zones:

Network diagram showing Internet, DMZ, and Internal zones separated by firewalls
Proper segmentation ensures that compromising a web server in the DMZ doesn't grant direct access to internal databases.

Trust boundary violations (how breaches spread):

Defender principle: Zero Trust Architecture

Modern approach: "Never trust, always verify." Even internal network traffic should be authenticated and authorized. Don't assume "inside the firewall = safe."

Lesson 4.5 · Why Networks Are Prime Attack Targets

Strategic reality: Networks are attractive because they enable remote access — attackers don't need physical presence. Most modern attacks begin with network reconnaissance and exploitation.

Why attackers love networks:

Common network attack patterns:

Defense-in-depth for networks:

Self-Check Questions (Test Your Understanding)

Answer these in your own words (2-3 sentences each):

  1. Why does connecting a system to a network increase attack surface? What changes from a security perspective?
  2. Explain how packet-based communication enables interception attacks. Why aren't packets encrypted by default?
  3. What is a DMZ in network architecture? Why would you put a web server there instead of on the internal network?
  4. Give one example of an attack that targets each TCP/IP layer (link, network, transport, application).
  5. What is the difference between "trust by network location" and "zero trust" architecture?

Lab 4 · Network Trust Boundaries and Attack Paths

Time estimate: 30-45 minutes

Objective: Map network zones, identify trust boundaries, and trace how an attacker could move laterally through a network. You will analyze data flows and propose segmentation controls.

Step 1: Choose Your Network Context (5 minutes)

Select one scenario (or propose your own):

Why it matters: Different contexts have different trust requirements and attack patterns.

Step 2: Map Network Zones (10 minutes)

Identify at least 3 network zones in your chosen environment:

Example for e-commerce:

Step 3: Map Data Flows Between Zones (10 minutes)

For each zone boundary, identify what traffic flows across it:

Example flows:

Step 4: Identify Attack Path (Lateral Movement) (10 minutes)

Trace a realistic attack scenario showing how an attacker moves between zones:

Example attack:

Step 5: Propose Segmentation Controls (5 minutes)

Identify at least two controls that would block or detect the attack path:

Example defenses:

Step 6: Synthesis (5 minutes)

Write a short paragraph (3-5 sentences) answering:

"Why is network segmentation a critical security control? How does it limit blast radius when a breach occurs?"

Example answer:

Network segmentation is critical because it assumes breach is inevitable and limits how far attackers can move. By dividing the network into zones with enforced boundaries (firewalls, access controls), compromise of one zone doesn't automatically grant access to all others. In our e-commerce example, proper segmentation means even if the DMZ web server is compromised, the attacker cannot directly reach the database — they must first breach the internal application tier, which has additional defenses and monitoring. This defense-in-depth approach multiplies the attacker's effort while giving defenders multiple opportunities to detect and respond.

Success Criteria (What "Good" Looks Like)

Your lab is successful if you:

Extension (For Advanced Students)

If you finish early, explore these questions:

🎯 Hands-On Labs (Free & Essential)

Practice how network traffic flows, how packets are inspected, and where trust breaks down. Complete these labs before moving to reading resources.

🎮 TryHackMe: Intro to Networking

What you'll do: Learn IP addressing, routing basics, ports, and protocols through guided exercises.
Why it matters: Security teams reason about trust boundaries at the network layer. You need to understand how data actually moves.
Time estimate: 1.5-2 hours

Start TryHackMe Networking →

🎮 TryHackMe: Wireshark 101

What you'll do: Capture and analyze packets, filter traffic, and identify key protocol fields in real network traces.
Why it matters: Packet inspection reveals how attackers intercept or modify data in transit.
Time estimate: 1.5-2 hours

Start TryHackMe Wireshark →

🏁 PicoCTF Practice: Forensics (Packet Challenges)

What you'll do: Solve beginner packet challenges using pcap files and basic filtering.
Why it matters: Network forensics teaches you to spot suspicious traffic and understand attacker behaviors.
Time estimate: 1-2 hours

Start PicoCTF Forensics →

💡 Lab Tip: When analyzing packets, always identify the protocol first (DNS, HTTP, TLS). The protocol tells you what "normal" should look like.

Resources (Free + Authoritative)

Work through these in order. Focus on security implications of network design.

📘 Cloudflare Learning - How the Internet Works

What to read: Full article on internet architecture, IP addressing, and routing.
Why it matters: Clear explanation of how packets move across networks — foundational for understanding network attacks.
Time estimate: 20 minutes

Open Resource

🎥 Computerphile - TCP/IP Explained (Video)

What to watch: Full video on TCP/IP model and how layers interact.
Why it matters: Visual explanation of why layered architecture matters for security.
Time estimate: 15 minutes

Open Resource

📘 NIST SP 800-41 - Guidelines on Firewalls and Firewall Policy

What to read: Section 2 on "Firewall Technologies" (pages 2-1 to 2-15).
Why it matters: Explains how network segmentation is enforced in practice.
Time estimate: 25 minutes

Open Resource

📘 Cloudflare Learning - What is a DMZ?

What to read: Entire article on DMZ architecture and purpose.
Why it matters: Practical example of trust boundary implementation.
Time estimate: 10 minutes

Open Resource

Tip: Completion and XP persist via localStorage. If progress doesn't update immediately, refresh once.

Weekly Reflection Prompt

Aligned to LO3 (Threat Landscape) and LO4 (Risk Reasoning)

Write 200-300 words answering this prompt:

Explain how network segmentation reduces risk when a breach occurs. Use the lateral movement attack scenario from your Lab 4 work as an example.

In your answer, include:

What good looks like: You explain the attack chain and how breaking one link stops the entire attack. You show understanding that networks aren't "trusted inside, untrusted outside" — they're collections of zones with enforced boundaries. You connect segmentation to the principle of limiting blast radius.