Course 3 - Connect and Protect: Networks and Network Security

Comprehensive vocabulary flashcards generated directly from the lecture notes covering network architecture, models, protocols, wireless security, attacks, and hardening tools.

Home Network Architecture

A typical small network layout where an ISP modem connects to a firewall and router to direct traffic across home devices, switches, servers, and wireless access points.

Client-Server Model

A network architecture model in which client devices send requests for information and services to a server, which performs the requests for the clients.

Modem and Router Network Setup

A basic setup connecting the internet to a modem to decode signals, which is then connected to a router to route wireless and wired connections locally.

Wireless Access Point (WAP) Topology

A network setup where a central Wireless Access Point connects wireless devices (laptops, printers, servers) to a modem and the internet.

Dual Firewall Subnet Diagram

A network architecture that deploys separate firewalls and routers to isolate subnets and protect internal host devices.

Cloud Service Models (IaaS, PaaS, SaaS)

The three main service categories offered by Cloud Service Providers: Infrastructure as a Service, Platform as a Service, and Software as a Service.

TCP/IP Model

A four-layer framework (Application, Transport, Internet, Network Access) used to visualize how data is organized and transmitted across a network.

TCP/IP vs. OSI Model Mapping

A comparative mapping showing how the four layers of the TCP/IP model correspond to the seven layers of the OSI model.

OSI Model

A standardized seven-layer framework (Application, Presentation, Session, Transport, Network, Data Link, Physical) that describes how computers communicate over a network.

IPv4 Data Packet Structure

The structure of an IPv4 packet, consisting of a Header ranging from $20\text{ to }60\text{ bytes}$ and a Data section, with a total maximum packet size of $65{,}535\text{ bytes}$.

IPv4 Packet Header Fields

The 13 specific fields defined within an IPv4 header that contain routing, identification, and control information.

IPv4 vs. IPv6 Packet Header Comparison

A comparative overview highlighting fields retained, modified, removed, or newly introduced (such as Flow Label) when transitioning from IPv4 to IPv6 headers.

Private IP vs. Public IP Addresses

A comparison distinguishing router-assigned internal addresses from ISP-assigned unique global internet addresses.

Common Protocol Port Numbers

A reference guide listing standardized network protocols alongside their corresponding assigned port numbers.

Evolution of Wireless Security Protocols

The chronological progression of Wi-Fi security standards from WEP to WPA, WPA2, and WPA3.

Email Protocols and Ports

A standard table detailing email retrieval and transmission protocols (IMAP, SMTP, SMTPS) and their assigned encrypted and unencrypted ports.

Subnetting

The process of dividing a single large network address range into smaller, organized sub-networks called subnets.

tcpdump Log Output

A breakdown of raw packet capture output from tcpdump showing the timestamp, source IP and port, and destination IP and port.

Firewall Network Placement

A network security placement where a firewall sits between the modem and the internal network router to filter traffic.

IDS Network Architecture

A network security setup where an Intrusion Detection System is deployed behind the router and switch to passively monitor internal traffic.

IPS Network Architecture

A network security layout where an Intrusion Prevention System is placed inline between the local network and the router to actively block threats.

Firewall, IDS, and IPS Placement

A combined diagram illustrating the relative network positions of Firewalls, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS).

Security Information and Event Management (SIEM) Dashboard

A centralized monitoring dashboard (such as Google Cloud's Chronicle) that aggregates and analyzes log data and alerts from across the network.

Firewall

A network security device that monitors incoming and outgoing network traffic and permits or restricts specific traffic based on predefined security rules.

Hub

A physical network device that provides a common point of connection for all directly connected devices and repeats all incoming information out to all ports.

Switch

A data link layer device that forwards packets between directly connected devices by analyzing destination addresses and maintaining a MAC address table.

Router

A network layer device that connects multiple networks and directs traffic between them based on the destination IP address in the packet header.

Modem

A device that connects a local network to an internet service provider (ISP) by converting internet signals into digital formats compatible with physical connections.

Cloud Computing

The practice of using remote servers, applications, and network services hosted on the internet instead of at a physical location owned by the company.

Software as a Service (SaaS)

A cloud service category referring to software suites operated remotely by a cloud service provider without local hosting by the user.

Infrastructure as a Service (IaaS)

A cloud service category referring to the use of virtual computer components, such as virtual containers and storage, offered by a cloud service provider.

Platform as a Service (PaaS)

A cloud service category providing tools that application developers use to design, host, and access custom applications in the cloud.

Hybrid Cloud Environment

An IT infrastructure that combines an organization's on-premise computers, networks, and storage with a cloud service provider's remote services.

Software-Defined Networks (SDNs)

An approach to network management made up of virtual network devices and services hosted in cloud data centers that enable dynamic, programmatic configurations.

Address Resolution Protocol (ARP)

A protocol at the network access layer of the TCP/IP model used to map IP addresses to physical MAC addresses for local network communication.

Transmission Control Protocol (TCP)

A connection-oriented transport layer protocol that forms a reliable connection between devices using a three-way handshake and retransmits lost data.

User Datagram Protocol (UDP)

A connectionless transport layer protocol that transmits data quickly without establishing a pre-connection or extensive tracking, making it ideal for real-time applications.

Presentation Layer

Layer 6 of the OSI model responsible for data translation, standardization, compression, and encryption/decryption functions like SSL.

Session Layer

Layer 5 of the OSI model responsible for establishing, maintaining, authenticating, setting checkpoints for, and terminating sessions between communicating applications.

Time to Live (TTL)

An 8-bit IPv4 header field containing a counter that decrements at each router to prevent packets from endlessly circulating; packets reaching a counter of zero are discarded.

IPv6 Address

A 128-bit ($16\text{-byte}$) network address format composed of eight hexadecimal numbers separated by colons, providing up to 340 undecillion addresses.

Domain Name System (DNS)

An application layer protocol operating primarily on UDP port 53 that translates human-readable domain names into numerical IP addresses.

Hypertext Transfer Protocol (HTTP)

An unencrypted application layer communication protocol operating on TCP port 80 used for exchanging web data between clients and servers.

Hypertext Transfer Protocol Secure (HTTPS)

An application layer protocol operating on TCP port 443 that uses SSL/TLS encryption to provide secure communication between web browsers and servers.

Simple Network Management Protocol (SNMP)

An application layer management protocol used for monitoring, managing, resetting configurations of, and measuring bandwidth usage on network devices.

Internet Control Message Protocol (ICMP)

An internet layer protocol used by network devices to report data transmission errors, dropped packets, and connectivity status, commonly tested via the ping command.

Secure File Transfer Protocol (SFTP)

An application layer security protocol that uses Secure Shell (SSH) encryption over TCP port 22 to securely transfer files across a network.

Network Address Translation (NAT)

A process performed by routers or firewalls that translates private local IP addresses into a single public IP address for outgoing internet communications.

Dynamic Host Configuration Protocol (DHCP)

An application layer management protocol operating on UDP ports 67 (server) and 68 (client) that automatically assigns unique IP addresses and network configurations to devices.

Telnet

An unencrypted application layer protocol operating on TCP port 23 that transmits cleartext command-line data to control remote systems.

Secure Shell (SSH)

An application layer security protocol operating over TCP port 22 that uses strong encryption to provide secure remote system authentication and shell access.

Post Office Protocol (POP3)

An application layer email protocol operating on TCP/UDP port 110 (unencrypted) or port 995 (encrypted) used to download emails from a server to a local device.

Internet Message Access Protocol (IMAP)

An application layer email protocol operating on TCP port 143 (unencrypted) or port 993 (encrypted) that downloads email content while retaining copies on the mail server.

Simple Mail Transfer Protocol (SMTP)

An application layer protocol operating on TCP/UDP port 25 (unencrypted) or port 587 (encrypted TLS) used to transmit and route emails across servers.

Wired Equivalent Privacy (WEP)

The earliest wireless security standard developed in 1999, now considered high-risk due to major cryptographic vulnerabilities in its design.

Wi-Fi Protected Access (WPA)

A 2003 wireless security protocol created as a transitional standard to fix WEP vulnerabilities by introducing Temporal Key Integrity Protocol (TKIP).

WPA2

A wireless security protocol released in 2004 that introduced Advanced Encryption Standard (AES) encryption and CCMP for message integrity.

WPA3

A wireless security standard released in 2018 using Simultaneous Authentication of Equals (SAE) to protect against KRACK attacks and offering optional $192\text{-bit}$ encryption.

Classless Inter-Domain Routing (CIDR)

A method of assigning subnets using an IP network prefix (e.g., /24) appended to an IP address, expanding available addresses and reducing routing table sizes.

Stateless Firewall

A firewall category that filters traffic purely based on predefined rules without tracking active session states or prior packet history.

Stateful Firewall

A firewall category that maintains a state table to track active network connections, allowing automatically matched return traffic without needing rules in both directions.

Next-Generation Firewall (NGFW)

An advanced firewall featuring deep packet inspection, intrusion prevention, application-aware filtering, and malware sandboxing capabilities.

Forward Proxy Server

A proxy server that intercepts, regulates, and restricts requests from internal client devices seeking resources external to the network.

Reverse Proxy Server

A proxy server that intercepts and regulates requests coming from external systems directed toward internal network resources.

Virtual Private Network (VPN)

A security service that encrypts data in transit and masks a device's public IP address by encapsulating data packets through a virtual network tunnel.

WireGuard VPN

A modern, open-source VPN protocol designed with high-speed performance, simplified setup, and advanced encryption using fewer lines of code.

IPSec VPN

A legacy VPN protocol suite commonly used for site-to-site connections to authenticate and encrypt IP packets across untrusted networks.

Packet Sniffing

The practice of capturing and inspecting data packets as they travel across a network using software or hardware tools.

Backdoor Attack

An attack exploiting intentionally left developer access paths or unauthorized persistent access points installed by malicious actors to bypass standard authentication controls.

Denial of Service (DoS) Attack

A network attack that floods a target server or system with excessive traffic to crash it or make it unavailable to authorized users.

Distributed Denial of Service (DDoS) Attack

A volumetric DoS attack utilizing multiple distributed devices or a botnet to flood a target system with high volumes of unwanted traffic simultaneously.

Botnet

A network of malware-infected computers under the central control of a single threat actor known as a bot-herder.

Promiscuous Mode

A configuration setting for a Network Interface Card (NIC) that allows it to capture and inspect all data packets passing through the network, regardless of destination address.

IP Spoofing

An attack technique where a threat actor modifies the source IP address of a data packet to impersonate an authorized or trusted system.

On-Path Attack

An interception attack where a malicious actor places themselves between two communicating, trusted systems to secretly collect or modify transmitted data.

Smurf Attack

A denial-of-service attack combining IP spoofing with ICMP echo requests to flood a network broadcast address, overwhelming targets with echo responses.

tcpdump

A lightweight, command-line network protocol analyzer preinstalled on many Unix-like operating systems that captures and prints network traffic logs.

Brute Force Attack

A trial-and-error method of discovering credentials by systematically guessing combinations of usernames and passwords manually or via automated tools.

Dictionary Attack

A targeted brute force attack technique that uses lists of common words, dictionary terms, or stolen password databases to compromise user accounts.

Sandbox

An isolated physical, virtual, or cloud testing environment separate from the network used to safely execute and evaluate suspicious software and malicious files.

Intrusion Detection System (IDS)

A passive security application that monitors network streams for known attack signatures or anomalies and alerts administrators to potential intrusions.

Intrusion Prevention System (IPS)

An inline network security application that actively monitors network activity for suspicious behavior and automatically drops packets or blocks senders.

Security Information and Event Management (SIEM)

An application that aggregates, correlates, and analyzes real-time log data from firewalls, IDSs, IPSs, and proxies into a central dashboard.

Zero-Day Attack

A cyber attack that exploits a previously unknown software or system vulnerability before the vendor or developers have created a security patch.

Hypervisor

A layer of hardware or software that abstracts physical hardware to host and run virtual machines, divided into Type 1 (bare-metal) and Type 2 (hosted).

Virtual Machine Escape (VM Escape)

An exploit where a malicious actor bypasses guest VM isolation to gain control over the underlying host hypervisor and host system.

Cryptographic Erasure (Crypto-shredding)

A data destruction method that permanently deletes the decryption keys for encrypted data, rendering the stored data unreadable and irrecoverable.

Trusted Platform Module (TPM)

A dedicated hardware computer microchip used to securely store cryptographic keys, certificates, and authentication passwords.