Networking, Protocols, and Attack Surface Basics
How Data Moves
OSI and TCP/IP Perspective
Security analysis is easier when you understand where data lives in the stack. Some issues exist at the link layer, some at the transport layer, and others at the application layer. A weakness in any layer can expose the whole system.
Core Concepts
Think in Paths
When analyzing an environment, ask: where does traffic originate, where does it terminate, and what intermediaries can observe or modify it?
Attack Surface at the Network Level
Exposed services, misconfigured firewalls, weak remote access settings, outdated protocols, and unnecessary open ports all increase the attack surface. Good defenders reduce exposure by limiting what must be reachable.
What does a port represent in networking?
Ports allow multiple services to be distinguished on the same system.
Correct answer: A way to identify a service on a host
Why does DNS matter in security assessments?
DNS is often a source of reconnaissance data and operational dependencies.
Correct answer: Because it maps domain names to IP addresses and can reveal infrastructure details.
Common Protocols and Their Security Implications
Protocol Focus
| Protocol | Why It Matters |
|---|---|
| HTTP/HTTPS | Web application exposure and session security |
| SSH | Secure remote administration |
| SMB | File sharing and lateral movement risk |
| SMTP | Email routing and phishing infrastructure |
| RDP | Remote access and brute-force exposure |
Which protocol is most associated with secure remote administration?
SSH is commonly used for encrypted remote shell access.
Correct answer: SSH
Give one example of how unnecessary open ports increase risk.
Any answer that links exposure to increased attack opportunities is acceptable.
Correct answer: They expose additional services that attackers can scan and exploit.