I85PREP
⌘ K
DSST MIS study materials
DSST MIS study resources

DSST MIS: Network Security: CIA, Cryptography and Perimeter Controls

DSST MIS · Work through your exam, one topic at a time.

All guide sections

Network Security: CIA, Cryptography and Perimeter Controls

Network Security

This domain tests the CIA triad, authentication and access control, cryptography, and the defensive architecture items the exam loves: firewalls, IDS/IPS, VPNs and secure protocols. Questions are often scenario-based - which control best mitigates a given risk - so map every control to the property it protects.

Core concepts

  • CIA triad. Confidentiality (encryption, access control), integrity (hashing, checksums, signatures), availability (redundancy, DDoS mitigation).
  • Authentication vs authorization. Authentication proves identity; authorization decides what that identity may do. MFA combines something you know, have or are.
  • Encryption. Symmetric (AES) is fast but needs key distribution; asymmetric (RSA, ECC) solves key exchange and enables signatures but is slow, so hybrid protocols such as TLS use asymmetric methods to exchange a symmetric session key.
  • Hashing. One-way, keyless, fixed-length digest used for integrity checks and salted password storage.
  • Digital signature. Hash the message, encrypt the hash with the sender's private key; the receiver decrypts with the sender's public key and compares hashes. This gives integrity, authentication and non-repudiation - not confidentiality.
  • Access control models. DAC (owner discretion), MAC (labels and clearance), RBAC (roles). Least privilege and separation of duties are design principles.
  • Perimeter. Packet-filtering firewalls inspect headers; stateful firewalls track connections; application proxies inspect payload. IDS detects and alerts; IPS blocks inline.

Worked example

A firewall evaluates rules top-down, first match wins: (1) deny 10.0.5.0/24 any to any port 443; (2) allow any any to port 443; (3) deny any any. Is a packet from 10.0.5.7 to 203.0.113.9:443 allowed?

Rule 1 matches: the /24 covers 10.0.5.0 through 10.0.5.255, and port 443 matches, so the packet is denied even though rule 2 would have permitted it. The lesson is that rule order is the policy: specific denies must precede general permits, and the terminal deny-all must not be shadowed by an overly broad permit above it.

Traps

  • Claiming a digital signature provides confidentiality.
  • Confusing hashing with encryption; hashes are not reversible.
  • Treating IDS and IPS as interchangeable - one alerts, the other acts.
  • Ignoring that firewall rule sets are order-dependent, not set-based.