Network and Communications Security
Layers, protocols and chokepoints
Map every control to an OSI layer. Data link: 802.1X, NAC, port security, VLANs. Network: IPsec, ACLs, routing security, segmentation. Transport: TLS, TCP/UDP behavior. Application: HTTPS, SSH, DNSSEC, WAF.
Know the insecure/secure pairs cold: Telnet to SSH (22), FTP/TFTP to SFTP/SCP, HTTP to HTTPS (443), SNMPv1/v2c to SNMPv3 (161), LDAP to LDAPS (636), and POP3/IMAP wrapped in TLS.
Perimeter design: firewall types (packet-filtering, stateful, application/proxy, NGFW), a DMZ for public-facing services, segmentation and microsegmentation to limit lateral movement, and defense in depth. An IDS is passive - it taps a mirror/SPAN port and alerts. An IPS sits inline and can block, at the cost of latency and a potential bottleneck. Encrypt traffic that crosses untrusted links.
VPNs: IPsec with AH (integrity and authentication, no encryption) or ESP (encryption), in tunnel or transport mode; TLS-based VPNs for remote access. Wireless: WPA2/WPA3 with AES-CCMP, 802.1X/EAP for enterprise, PSK risks, rogue AP and evil twin awareness, plus WIPS monitoring.
Attacks to recognize: sniffing, spoofing (IP/MAC/ARP), man-in-the-middle, DNS cache poisoning, DoS/DDoS (volumetric, protocol, application), SYN floods, smurf attacks, session hijacking and replay.
Trap: AH does not provide confidentiality - if the question asks about encryption over IPsec, the answer is ESP. Another: an IPS can drop traffic, an IDS cannot.
Rule of thumb: if the question says "public network" plus "confidentiality," think IPsec ESP or TLS, never AH.