Internet, Networking and Security Foundations

Introduction

Cybersecurity begins with an understanding of how digital communication works. Security controls cannot be selected intelligently unless a practitioner can identify the devices, protocols, addresses, services and trust boundaries involved in a data flow. The Internet is not a single network owned by one organisation; it is an interconnected system of independently administered networks that exchange traffic using common standards.

A security analyst therefore needs two complementary perspectives. The first is the architectural perspective: how applications, hosts, local networks, service providers and global routing systems fit together. The second is the operational perspective: how a message is encapsulated, addressed, forwarded, delivered and interpreted. Each stage creates possible exposure, including interception, impersonation, unauthorised access, disruption and information leakage.

This chapter introduces the foundations required for later study of firewalls, intrusion detection, secure protocols, vulnerability assessment and incident response.

Learning Objectives

By the end of this chapter, a learner should be able to:

• describe the major components and administrative structure of the Internet;
• explain the purpose of the OSI and TCP/IP networking models;
• distinguish frames, packets, segments and application data;
• interpret IPv4 and IPv6 addresses and perform basic IPv4 subnetting;
• explain ports, sockets and common protocols;
• distinguish switching from routing and describe the role of DNS;
• relate normal data flows to confidentiality, integrity, availability and other security risks;
• apply foundational security terminology to a practical network scenario.

1. The Internet as an Interconnected System

A network is a collection of devices connected so that they can exchange data. A computer network commonly includes end systems such as laptops, servers, phones and sensors; intermediate systems such as switches and routers; transmission media; addressing systems; and communication protocols.

The Internet is a network of networks. Home networks, enterprise networks, mobile networks, cloud networks and Internet service-provider networks are interconnected. Each organisation administers its own network, but interoperability is achieved through standard protocols, principally the Internet Protocol (IP) suite.

A user’s request for a web page may cross a wireless access point, an Ethernet switch, a home router, an ISP network, several autonomous systems and a cloud-hosted server. The route can change from one session to another. No single device normally has a complete view of the Internet.

An autonomous system (AS) is a collection of IP networks and routers under one administrative authority that presents a consistent routing policy to other networks. Large service providers, universities and cloud providers may operate autonomous systems. The Border Gateway Protocol (BGP) exchanges reachability information between autonomous systems. BGP is essential to Internet-scale connectivity, but incorrect or malicious route advertisements can redirect or blackhole traffic.

A typical communication path

Consider a student opening a secure website:

1. The client device associates with a wireless access point or connects through Ethernet.
2. A local switch forwards the frame toward the default gateway.
3. The gateway routes the packet to the ISP.
4. DNS may resolve the website name to an IP address.
5. Routers forward packets across multiple networks.
6. The destination server receives the traffic and returns responses.
7. Transport and application protocols reassemble and interpret the data.

At each boundary, administrators may enforce policy, log activity, translate addresses, filter traffic or terminate encryption. Consequently, a security assessment must consider both endpoints and the intermediate infrastructure.

Figure: A simplified communication path across local and Internet networks.

2. Layered Networking Models

Networking is complex because it combines electrical transmission, addressing, reliability, naming, security and application behaviour. Layered models divide this complexity into related functions. A layer provides services to the layer above and uses services from the layer below.

The OSI reference model

The seven-layer Open Systems Interconnection (OSI) model is a conceptual framework:

The OSI model is useful for analysis and troubleshooting, but real protocols do not always fit neatly into one layer. For example, TLS operates between application protocols and the transport service, while ARP connects network-layer addressing with local-link operation.

The TCP/IP model

The TCP/IP model more closely reflects deployed Internet protocols. A common four-layer representation is:

• Application: HTTP, DNS, SSH, DHCP and other application protocols;
• Transport: TCP and UDP;
• Internet: IP, ICMP and routing functions;
• Link: Ethernet, Wi-Fi and the physical transmission system.

Some texts separate the physical layer or divide the application layer into OSI-like session and presentation functions. These are differences in teaching models, not contradictions in network operation.

Encapsulation and decapsulation

When an application sends data, each lower layer adds control information. Application data becomes a transport segment when TCP is used or a datagram when UDP is used. The Internet layer adds an IP header, producing a packet. The link layer adds a frame header and usually a trailer, producing a frame. At the receiver, these headers are removed in reverse order.

This process explains why a firewall can make decisions at several levels. A layer-2 control may use a MAC address, a layer-3 rule may use source and destination IP addresses, and a layer-4 rule may use TCP or UDP ports. An application-aware firewall may inspect protocol commands or content, although encrypted traffic limits what it can see.

3. Addressing and Identification

Different identifiers serve different scopes. Confusing them is a frequent cause of configuration and security errors.

• A MAC address identifies a network interface on a local link. It is used by switches and is not a universal Internet identity.
• An IP address identifies a logical interface or endpoint for routing between networks.
• A port number identifies a transport-layer service endpoint on a host.
• A domain name provides a human-oriented name that DNS maps to resource records.
• A URL identifies a resource and may include a scheme, host, port and path.

IPv4

IPv4 uses 32-bit addresses, normally written as four decimal octets, such as 192.0.2.25. The address contains a network prefix and a host portion. A subnet mask or prefix length indicates which bits form the prefix. For example, /24 means that 24 of 32 bits are the network prefix.

The number of addresses in a subnet with prefix length p is:

Here N is the total number of IPv4 addresses and p is an integer from 0 to 32. In a conventional subnet, two addresses are reserved: the network address, in which all host bits are zero, and the directed broadcast address, in which all host bits are one. Thus, for many /p subnets:

H is the number of traditionally assignable host addresses. The subtraction is not applied universally: /31 point-to-point links and /32 host routes are special cases, and modern network designs may use different conventions.

#### Worked subnetting example

A network administrator has 192.168.10.0/24 and needs four equal-sized subnets. Four subnets require 2² = 4, so two host bits are borrowed. The new prefix is /26. Each subnet contains 2^(32−26) = 64 total addresses, with 62 conventional host addresses.

The ranges follow increments of 64 in the final octet. Subnetting limits broadcast domains, supports policy separation and reduces accidental exposure, but it does not itself provide confidentiality or strong access control.

Important IPv4 categories include private addresses (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16), loopback (127.0.0.0/8), link-local addresses (169.254.0.0/16) and documentation ranges such as 192.0.2.0/24. Private addresses are not globally routable and often use Network Address Translation (NAT) at a gateway. NAT can conserve addresses and obscure internal addressing, but it is not a substitute for a firewall.

IPv6

IPv6 uses 128-bit addresses, written in hexadecimal groups, for example 2001:db8:1::25. It provides a vastly larger address space, supports hierarchical allocation and uses Neighbor Discovery rather than ARP. IPv6 commonly uses /64 prefixes for local subnets, although other prefix lengths exist for specific purposes. Security practitioners must not assume that IPv6 is absent merely because an organisation has planned primarily for IPv4; unintended IPv6 paths can bypass IPv4-only controls.

4. Ports, Sockets and Protocols

A port is a 16-bit transport identifier, ranging from 0 to 65,535. Ports 0–1,023 are traditionally called well-known ports; 1,024–49,151 are registered ports; and 49,152–65,535 are commonly used as dynamic or ephemeral ports. These ranges describe conventions, not proof of application identity. Malware can listen on a familiar port, and legitimate services can use nonstandard ports.

A socket is commonly described by an IP address, transport protocol and port. A TCP connection is identified by a four-tuple: source IP, source port, destination IP and destination port, together with the protocol. A browser might use an ephemeral source port to connect to destination TCP port 443.

Port numbers should be treated as clues for monitoring and policy, not as reliable authentication of a service.

TCP is connection-oriented and provides ordered, reliable byte delivery using sequence numbers, acknowledgements, retransmission and flow control. Its connection establishment commonly uses a three-way handshake: SYN, SYN-ACK and ACK. TCP reliability does not mean that the data is confidential or that the endpoint is trustworthy.

UDP is connectionless and provides a datagram service without TCP’s built-in reliability and ordering. It is useful for DNS, streaming, voice and protocols that implement their own reliability. UDP’s lower overhead does not make it inherently insecure; security depends on the application and controls around it.

Other important protocols include ICMP for diagnostic and error messaging, DHCP for automatic configuration, ARP for IPv4 address-to-MAC resolution on a local link, and TLS for authenticated and encrypted communication. Protocol names and port numbers should always be interpreted in context.

5. Switching and Routing

A switch primarily forwards frames within a local network. It learns which MAC addresses are reachable through which ports by examining source addresses. It then forwards a frame toward the appropriate destination port or floods it when the destination is unknown, subject to its design and configuration.

A router forwards packets between different IP networks. It examines the destination IP address, consults a routing table and selects a next hop. A default route is used when no more specific route matches. Routing tables may be populated manually, through dynamic protocols or by a combination of both.

Switches can create VLANs, which logically separate layer-2 broadcast domains on shared infrastructure. A router or layer-3 switch is required for communication between VLANs. Segmentation can reduce the spread of attacks, but it must be supported by access-control rules, secure trunk configuration, monitoring and correct device management. A VLAN is not automatically a security boundary against a determined attacker.

Routing and switching create different security concerns. ARP spoofing, rogue access points and MAC flooding target local-link behaviour. Route hijacking, misconfiguration and unauthorised route advertisements affect inter-network forwarding. Management interfaces for switches and routers are high-value targets and should be restricted, authenticated strongly and monitored.

6. DNS and Naming

People use names such as www.example.org, while networks route using IP addresses. The Domain Name System (DNS) is a distributed, hierarchical naming system. A resolver asks authoritative servers for records, often caching answers for the period specified by the record’s time to live (TTL).

The hierarchy includes the root, top-level domains such as .org and authoritative name servers for specific domains. Common records include:

• A: maps a name to an IPv4 address;
• AAAA: maps a name to an IPv6 address;
• CNAME: provides an alias to another name;
• MX: identifies mail servers;
• NS: identifies authoritative name servers;
• TXT: stores text used for several purposes, including email policy;
• PTR: supports reverse lookup.

DNS is essential but was not originally designed to provide confidentiality or strong authenticity. Risks include cache poisoning, domain hijacking, unauthorised zone transfers, DNS tunnelling and manipulation of local resolver settings. DNS Security Extensions (DNSSEC) add origin authentication and integrity for signed DNS data, but DNSSEC does not encrypt ordinary DNS queries. Encrypted transports such as DNS over TLS and DNS over HTTPS can reduce observation or manipulation of queries, although they introduce operational and governance considerations.

A secure organisation should control recursive resolvers, restrict zone transfers, monitor unusual query volumes and validate domain-registration and DNS-management access.

7. Core Security Terminology

The CIA triad describes three primary security objectives:

• Confidentiality: preventing unauthorised disclosure;
• Integrity: preventing unauthorised or improper alteration;
• Availability: ensuring authorised access when needed.

Related properties include authenticity, accountability, non-repudiation and privacy. A control may support several objectives. TLS, for example, can provide confidentiality and integrity in transit and can authenticate a server through certificates; it does not guarantee that the server’s application is safe.

A threat is a potential cause of harm. A vulnerability is a weakness that can be exploited. Risk combines the possibility of an adverse event with its consequences. A simplified qualitative model is often expressed as likelihood and impact, but risk is not always reducible to a precise multiplication because evidence and consequences may be uncertain.

An asset is something valuable, such as information, a service, device or reputation. An attack surface is the set of reachable points through which an attacker might attempt access or influence. An exploit is a technique or code that takes advantage of a vulnerability. A control is a safeguard that reduces likelihood, impact or both.

A threat actor may be an insider, criminal group, hacktivist, competitor or state-sponsored organisation. Authentication verifies identity; authorisation determines permitted actions; and accounting or auditing records relevant activity. These functions are often represented as AAA.

A security incident is an event that may compromise confidentiality, integrity or availability. A data breach is a form of incident involving unauthorised access to or disclosure of protected information. Terminology may have specific legal definitions in different jurisdictions, so organisations must align operational language with applicable law and policy.

8. Relating Data Flows to Security Exposure

A data-flow analysis asks four questions: What asset is moving? Between which identities and systems? Across which trust boundaries? Under which protocol and controls?

For example, an employee laptop may resolve a name using a DNS resolver, establish a TCP connection to a web server and negotiate TLS. The local wireless link exposes traffic to nearby devices unless protected by appropriate wireless security. DNS metadata may reveal destinations even when the web content is encrypted. The server may be exposed to scanning and exploitation on its public port. The endpoint may be compromised before encryption is applied, allowing an attacker to observe data at the source.

Security analysis should therefore examine:

• endpoint security and identity assurance;
• wireless and local-link protections;
• segmentation and least-privilege routing;
• firewall rules and exposed services;
• certificate validation and encryption scope;
• DNS integrity and resolver governance;
• logging, time synchronisation and detection capability;
• resilience, redundancy and recovery procedures.

Encryption in transit protects a communication channel, not necessarily data at rest, memory, backups or a compromised endpoint. Likewise, segmentation limits paths but does not remove the need for authentication and secure configuration.

Illustrative Case: A Small College Network

Background

A college operates student wireless access, staff systems, an online learning platform and a small administration network. Initially, all devices share one flat address range. The web administration panel for a network appliance is reachable from the student network, and DNS is provided by an unmanaged consumer router.

Problem

A student installs malware that scans local addresses. The scan identifies the appliance’s management interface and several printers. The malware also changes the student laptop’s DNS settings, causing users to receive misleading addresses for a commonly used service.

Analysis

The flat network creates excessive reachability. Management services are exposed to untrusted clients, and DNS configuration lacks central control. The incident affects confidentiality through scanning, integrity through altered name resolution and availability if the appliance is overwhelmed. The underlying weaknesses are poor segmentation, excessive administrative exposure and insufficient monitoring.

Approach and solution

The college creates separate VLANs for students, staff, administration, servers and IoT devices. Inter-VLAN routing is permitted only through an explicit firewall policy. Management interfaces accept connections only from an administrator network using SSH or HTTPS with multi-factor authentication. The college deploys centrally managed recursive DNS, restricts outbound DNS to approved resolvers, logs DNS activity and uses protective filtering. Wireless networks use individual credentials or enterprise authentication, and network devices receive secure configuration baselines and timely updates.

Outcome

Students can reach approved learning services but cannot directly access administrative interfaces. DNS changes are detected centrally, and scans across VLAN boundaries generate alerts. The controls do not eliminate malware, but they reduce lateral movement and improve detection and response.

Learning points

The case demonstrates that security depends on the relationship between addressing, switching, routing, naming and access control. A port being closed is useful, but the broader design question is whether an untrusted device should have a route to the service at all.

9. Professional Practice, Governance and Contemporary Developments

Network security is both technical and organisational. Administrators should document address spaces, owners, approved services, trust zones and data flows. Changes should be reviewed, tested and recorded. Logs should be protected from unauthorised alteration and retained according to operational, legal and privacy requirements.

Privacy principles require data minimisation, purpose limitation and appropriate protection of traffic metadata. Monitoring should be authorised, proportionate and communicated through policy. Packet inspection can improve detection but may expose personal or sensitive information. Organisations must reconcile security monitoring with employment law, data-protection obligations and legitimate user expectations.

Current environments increasingly use cloud services, software-defined networking, zero-trust architectures, IPv6, encrypted DNS and containerised workloads. These developments do not invalidate foundational concepts. They change where the control plane, identity boundary and enforcement point are located. Zero trust, for example, does not mean that networks are irrelevant; it means that location alone is insufficient evidence of trust, so identity, device posture, context and continuous policy evaluation become more important.

Artificial intelligence can assist with anomaly detection, classification and prioritisation, but network data may be incomplete or biased. Automated decisions can produce false positives, conceal novel attacks or expose sensitive telemetry. Human review, explainability, access controls and validation remain necessary.

Best-Practice Foundations

A diploma-level practitioner should adopt the following habits:

1. Maintain an accurate inventory of devices, services, owners and addresses.
2. Use segmentation and least-privilege routing to limit unnecessary reachability.
3. Disable unused services and restrict management planes to trusted administration paths.
4. Prefer secure protocols and validate certificates and identities.
5. Centralise and protect DNS, authentication and logging where practical.
6. Patch network devices and endpoints according to risk and tested procedures.
7. Monitor normal traffic patterns so that anomalies can be recognised.
8. Test firewall, routing, IPv6 and recovery configurations rather than assuming they work.
9. Protect sensitive data in transit, at rest and during processing.
10. Record decisions and assess legal, privacy and ethical consequences.

Challenges and Limitations

Layered models simplify reality and can encourage an overly rigid view of protocols. NAT can obscure accountability and complicate inbound services. Encryption may prevent inspection that defenders would otherwise use, while decryption proxies create their own privacy and key-management risks. Segmentation can be weakened by misconfigured trunks, shared credentials or insecure application dependencies. DNSSEC authenticates signed DNS data but does not make a destination application trustworthy. Finally, technical controls cannot compensate for unsupported software, poor governance or untrained personnel.

Chapter Summary

The Internet is a network of independently administered networks connected through common protocols and routing policies. Communication involves end systems, switches, routers, service providers, naming systems and application servers. The OSI and TCP/IP models provide useful ways to separate functions, while encapsulation explains how application data becomes transport units, IP packets and link-layer frames.

IPv4 and IPv6 provide logical addressing; subnetting divides address space and supports organisation and segmentation. Ports identify transport-layer service endpoints, but port numbers alone do not prove application identity. Switches forward local frames, routers forward packets between networks, and DNS maps human-readable names to network information.

Security analysis must connect these technical mechanisms to confidentiality, integrity, availability, authenticity, accountability and privacy. Threats arise at endpoints, links, routing boundaries, services, naming infrastructure and management interfaces. Effective protection combines secure protocols, identity, segmentation, least privilege, monitoring, sound governance and tested recovery.

Key Terms

Network: Connected devices and systems capable of exchanging data.

Internet: A global interconnection of independently administered networks.

Autonomous system: A network or group of networks under one routing authority.

Protocol: Agreed rules governing communication between systems.

OSI model: Seven-layer conceptual model for network functions.

TCP/IP model: Practical layered model used to describe Internet protocols.

Encapsulation: Addition of protocol information as data moves down a stack.

MAC address: Link-layer identifier for a network interface.

IP address: Logical address used for communication and routing.

Subnet: A logical division of an IP address space.

Port: Transport-layer number identifying a service endpoint.

Socket: An endpoint identified by address, transport protocol and port.

Switch: Device that primarily forwards frames within a local network.

Router: Device that forwards packets between IP networks.

DNS: Distributed system that resolves domain names and related records.

Firewall: Control that permits, denies or inspects traffic according to policy.

Confidentiality: Protection against unauthorised disclosure.

Integrity: Protection against unauthorised or improper alteration.

Availability: Assurance that authorised users can access resources when needed.

Vulnerability: A weakness that may be exploited.

Review Questions

Short Answer Questions

1. What is meant by the statement that the Internet is a network of networks?
2. Distinguish a MAC address, an IP address and a port number.
3. What is the primary difference between switching and routing?
4. Why is DNS important, and name one DNS-related security risk.
5. Define confidentiality, integrity and availability.

Long Answer Questions

1. Explain the OSI model and compare it with the TCP/IP model.
2. Describe the process of encapsulation from application data to a transmitted frame.
3. Explain IPv4 subnetting and discuss how subnetting can support security without replacing access control.
4. Compare TCP and UDP, including appropriate uses and security implications.
5. Describe how a DNS request and subsequent web connection may expose information or create attack surfaces.

Analytical / Application Questions

1. A college places students, staff and servers in one subnet. Analyse the likely security consequences and propose a segmented design.
2. An organisation blocks inbound TCP port 22 but permits all outbound traffic. Explain what this does and does not protect against.
3. A user reaches the wrong server after an unauthorised DNS change. Trace the possible data flow and identify controls that could detect or prevent the incident.

Multiple Choice Questions with Answers

Question 1

Which device primarily forwards packets between different IP networks?

A. Ethernet switch

B. Router

C. Wireless mouse

D. Patch panel

Correct Answer: B. Router

Question 2

How many total IPv4 addresses are present in a /26 subnet?

A. 32

B. 64

C. 128

D. 256

Correct Answer: B. 64

Question 3

Which protocol commonly resolves domain names to IP addresses?

A. DNS

B. DHCP

C. SMTP

D. ARP

Correct Answer: A. DNS

Question 4

Which property of the CIA triad concerns preventing unauthorised modification?

A. Confidentiality

B. Availability

C. Integrity

D. Anonymity

Correct Answer: C. Integrity

Question 5

At which layer are TCP and UDP normally placed in the TCP/IP model?

A. Application

B. Transport

C. Internet

D. Link

Correct Answer: B. Transport

Question 6

Which statement about a port number is most accurate?

A. It uniquely identifies a person worldwide

B. It identifies a transport-layer service endpoint on a host

C. It replaces an IP address for routing

D. It proves that a service is legitimate

Correct Answer: B. It identifies a transport-layer service endpoint on a host

Question 7

What is a principal function of a switch?

A. Forwarding local frames using link-layer information

B. Signing DNS zones

C. Assigning public domain names

D. Encrypting every application

Correct Answer: A. Forwarding local frames using link-layer information

Question 8

What is the conventional number of usable host addresses in a normal IPv4 /24 subnet?

A. 24

B. 126

C. 254

D. 256

Correct Answer: C. 254

Question 9

Which statement about DNSSEC is correct?

A. It guarantees that every website is safe

B. It provides origin authentication and integrity for signed DNS data

C. It replaces all firewall functions

D. It necessarily encrypts every DNS query

Correct Answer: B. It provides origin authentication and integrity for signed DNS data

Question 10

Why is network segmentation useful in security design?

A. It makes passwords unnecessary

B. It guarantees confidentiality without encryption

C. It can limit reachability and reduce lateral movement

D. It prevents all attacks on endpoints

Correct Answer: C. It can limit reachability and reduce lateral movement