Network and Service Security
Network and service security tests whether you can reduce attack surface and segment trust. Know TCP/IP basics-IP addresses, ports, the TCP handshake, UDP-and how firewalls filter by state, port, and address. A host firewall (nftables/iptables, ufw, firewalld) and a network firewall are complementary; NAT is not a security control.
Core rules
- Default deny inbound; allow only required services. Minimize exposed services and bind admin interfaces to localhost or a VPN.
- Segment: a DMZ for public services, VLANs/subnets for internal tiers, least-privilege firewall rules between them.
- Harden remote access: SSH key authentication, disable root login, no password auth, fail2ban or rate limits; prefer a VPN or bastion over exposing management ports.
- Wireless: WPA2/WPA3 with strong passphrases; avoid WEP and WPS; separate the guest SSID.
- Monitor with IDS/IPS, logs, and flow data. nmap (scanning), Wireshark (capture), and tcpdump are named in objectives.
- DNS and email: DNSSEC, SPF/DKIM/DMARC reduce spoofing; an open resolver invites abuse.
Worked example
You must administer a cloud VM over SSH. Opening 22/tcp to 0.0.0.0/0 with password auth invites brute force. Better: restrict the security group to your office or VPN CIDR, use ed25519 keys with a passphrase, disable root and password login in sshd_config, and run fail2ban. Reasoning: each layer reduces likelihood; port obfuscation alone only hides the service from casual scans.
Traps
Changing SSH to port 2222 is not security. Port forwarding on a home router can expose an internal service. Assuming internal means trusted fails against lateral movement. WEP is broken. A firewall does not stop phishing or malicious downloads.