L3 · Networking Technology
Hardware, operating systems, storage, the OSI model, network devices and network management — enough infrastructure to audit it. Maps mainly to Domain 4 (Operations & Business Resilience).
Exam relevance. D4 is 26% and assumes you can place a control at the right layer. You are not asked to configure a router; you are asked which layer, which device, and where the control sits.
Computer architecture in three parts
All computers are not equal — different purposes, performance and security. Three basic component groups:
| Component | What it does | Audit angle |
|---|---|---|
| CPU — ALU + cache | Processes instructions | Processing capacity, separation of privileged modes |
| RAM — volatile | Working memory; erased when power is off | Volatile evidence; memory-resident malware |
| I/O channels | Transmit data to/from the CPU | Physical ports are an access path |
| Data storage | Fixed or removable media | Removable media = data-loss vector |
The three buses
- Address bus — determines where in memory the processor reads or writes.
- Data bus — carries the contents read from or written to that location.
- Control bus — manages information flow between components, signalling read vs write and timing.
Single processor vs multiprocessor
| Single processor | Multiprocessor | |
|---|---|---|
| Behaviour | A system interrupt halts any security software running and lets the task run before security software resumes | Handles process-intensive applications and high-security environments |
| Weakness / strength | CPU bottleneck from database and graphics-rendering work | Performs time-sharing for multiple users |
Trap: the single-processor interrupt behaviour is a security window — a control that only runs on the CPU can be suspended by an interrupt. That is why monitoring is layered (logs shipped off-box, appliance-based detection).
The startup sequence
- Execution begins from internal programmable chips and data-storage disks.
- IPL — Initial Program Load.
- The operating system is loaded from storage via the MBR (Master Boot Record).
- Device-driver information comes from the BIOS (Basic Input/Output System).
Audit angle: boot order and BIOS/ firmware passwords are the control that stops booting from removable media. "Boot from USB" is the physical bypass of every logical control that follows.
What a commercial-grade OS must provide
- A user interface — the shell
- Security and event logging during interaction and transactions
- A common software platform to run applications
- A file system to store and retrieve data
- A method of input/output to devices
- Coordination of internal communication between programs and CPU task processing
The OS controls the hardware. Older machines needed a bespoke program per model; modern OS families — Unix→Linux, IBM OS/MVS, Microsoft Windows, Apple macOS — are produced with hardware vendors to provide specialised hardware support.
Machine roles
| Role | Function | Examples |
|---|---|---|
| Workstation | Runs applications to solve problems | Office, browser, email client |
| File server | Stores data files for shared access | Share drives, FTP server |
| Web server | Serves web content (same idea as file server) | Apache |
| DNS server | Converts domain names to IP addresses | google.com.hk → 74.125.206.94 |
| Database server | Stores raw data, organises it in tables for authorised users and applications | MySQL, Oracle |
| Appliance / special-purpose | Dedicated processing | Email server, router |
Computer types
| Type | Designed for |
|---|---|
| Supercomputer | Intense scientific calculation — e.g. nuclear reaction modelling, particle lifecycle tracing. Highly specialised for one mission |
| Mainframe | Large, scalable, general-purpose; enormous volumes processed in parallel with huge throughput |
| Midrange / minicomputer | Department or smaller organisation; Unix is a midrange OS |
| Microcomputer | PC, notebook, tablet |
Auditor's question: is the IT environment aligned to the business requirement? A mainframe for a ten-person firm is a control and cost finding, not a compliment.
Privilege states — the concept hackers exploit
| State | What is true |
|---|---|
| Supervisory state | The system security front-end is not loaded; all processing runs at the highest authority without security controls |
| Problem state | Security is active; the computer is solving the user's problem |
First-level vs common user
- Supervisory user — root/administrator/superuser. Controls change, configuration, maintenance and ongoing administration. Always exempt from internal controls, which is precisely the challenge to system control.
- Common user — limited access, subject to system controls (e.g. office workers).
The attacker's goal is to gain problem-state access and convert it into supervisory-state access. Methods named in the lecture: brute force with invalid parameters to make a supervisory-level program fail, and programs that default to a supervisory command prompt upon failure. CAPTCHA is cited as a barrier to automated brute force.
Storage media and RAID
| Medium | Notes |
|---|---|
| Magnetic disk / hard disk | Primary online storage; configured as RAID |
| Magnetic floppy / Zip | Legacy removable |
| Magnetic tape | Sequential; archival and backup |
| ROM / PROM | Needs special equipment to burn; chips are not portable between devices |
| Flash / EEPROM | Electronically erasable; cameras, USB sticks — lost or stolen easily |
| CD-ROM | ~700 MB read-only; good for archiving |
| CD-RW | Rewritable CD |
| DVD | Higher capacity, gigabytes; video and data |
| Blu-ray | Much higher — up to ~128 GB with triple layer |
RAID at exam level
| Level | Technique | Gives you | Does not give you |
|---|---|---|---|
| RAID 0 | Striping, no redundancy | Speed, full capacity | Any fault tolerance |
| RAID 1 | Mirroring | Redundancy; fast rebuild | Efficient capacity (50%) |
| RAID 5 | Striping with distributed parity | Redundancy with less overhead; survives one disk | Good write performance; protection from a second failure during rebuild |
Trap: RAID is availability, not backup. It does not protect against deletion, ransomware, corruption or site loss.
Port access control
- Physical access can bypass logical security controls.
- Physical I/O ports give a route to a higher degree of system access.
- A modem and network card connected simultaneously creates an unregulated pass-through that circumvents perimeter defences.
- The auditor examines what controls exist over physical access to I/O ports (drive locks, port blockers, BIOS restrictions, tamper seals).
The OSI model — the highest-yield table in this lecture
The four lower layers define how data crosses a physical wire through internetworking devices to the end station. The upper three (application, presentation, session) are concerned with application issues.
| # | Layer | Job | Device / address / protocol |
|---|---|---|---|
| 7 | Application | Software the user interacts with | DNS, FTP, HTTP |
| 6 | Presentation | Defines the data presentation format (WYSIWYG) | Encryption, compression, character encoding |
| 5 | Session | Controls between applications — connection setup and takedown | Session management |
| 4 | Transport | Specifies the transport delivery method | TCP (reliable), UDP (fast, unacknowledged) |
| 3 | Network | Divides computers into logical groups/segments | IP address, router |
| 2 | Data link | Data communications via hardware drivers, transmit/receive | MAC address, switch |
| 1 | Physical | Physical requirements — cables, voltages; creating, maintaining, deactivating the electrical link | Hub, cable, connector |
Memorise the mapping
- Hub — layer 1. Repeats to every port; no addressing, no segmentation.
- Switch — layer 2. Forwards by MAC address.
- Router — layer 3. Forwards by IP address and joins networks.
Trap: a switch is not a security boundary between IP subnets, and a hub gives every port the same traffic — which is why sniffing on a hub works so easily.
Core network services
| Service | Problem it solves | Risk |
|---|---|---|
| DNS | IP addresses are hard to remember; names are not | Poisoning/spoofing redirects users |
| DHCP | Configuring an IP on every machine is tedious; DHCP assigns automatically and dynamically | Rogue DHCP server hands out attacker-controlled gateway/DNS |
Wireless and long-range links
| Medium | Characteristics | Constraint |
|---|---|---|
| Wi-Fi radio | Layer 1 transmitter/receiver with a signal range | Range and interference; SSID exposure |
| Satellite | Low-orbit satellite, huge service area; used for remote sites and emergency response | Low speed; cost unless large airtime volume |
| Microwave | Short distance | Requires clear line of sight; fog and bad weather disrupt |
| Laser | Alternative to microwave — like fibre without the fibre | Same line-of-sight and weather limits |
| RFID | Tiny tag with silicon chip and antenna, read by scanners | Readability by unintended parties — hence RFID security focus |
Network management tooling
Syslog
- Centralised system logging — event logs and alerts to one place.
- Weaknesses named in the lecture: no message authentication, no message integrity.
- Therefore audit logs are usually transmitted to another server for safe storage.
- Syslog is important evidence for the auditor, and acts as a compensating control where logs on the source may be deleted.
Cable tester
Handheld scanner running electrical and transmission tests: signal strength, cross-talk, electrical noise interference, pin connections.
Protocol analyser / packet sniffer
Records and analyses network transmissions. Administrators use it for troubleshooting performance; attackers use it to capture credentials in clear text and map the network. Defence: encryption (TLS), switched networks instead of hubs, segmentation, and monitoring for rogue capture devices.
SNMP
- Monitors and controls network devices (e.g. HP OpenView monitoring servers and routers).
- Checks up/down status; notifies possible error conditions.
- Can reconfigure limited parameters and reboot or shut down a device.
- Trap: because it can reconfigure and reboot, SNMP community strings are effectively privileged credentials — default
public/privatestrings are a finding.
TRAPS
- Layer, not product. Learn the table; exam options swap switch/router/hub constantly.
- MAC = layer 2, IP = layer 3. Never the other way round.
- TCP vs UDP is transport (layer 4), not network.
- RAID ≠ backup. Availability only.
- Single-processor interrupts can suspend security software — a real control gap.
- Supervisory state has no security front-end loaded. That is why failure modes that drop to a privileged prompt are critical.
- Syslog has no authentication or integrity — off-box shipping is the compensating control.
- A modem plus a network card is the classic perimeter bypass.
- Satellite = wide area, low speed, high cost. Microwave/laser = line of sight, weather-sensitive.
60-second recall
- Three component groups: CPU (ALU + cache) · RAM (volatile) · I/O + storage.
- Buses: address (where) · data (what) · control (read/write and timing).
- Boot: chips → IPL → OS from MBR → BIOS device drivers.
- OS must give: shell · security/logging · app platform · file system · I/O · internal coordination.
- States: supervisory (no security loaded) vs problem (security active).
- Roles: workstation · file · web · DNS · database · appliance.
- RAID 0 striping · 1 mirroring · 5 striping + parity.
- OSI: Physical(hub) · Data link(MAC, switch) · Network(IP, router) · Transport(TCP/UDP) · Session · Presentation · Application.
- DNS name→IP · DHCP automatic IP assignment.
- Syslog central logging, no auth/integrity → ship off-box.
- Sniffer = troubleshooting tool and credential-theft tool.
- SNMP monitors, reconfigures and can reboot — treat as privileged.