IT Security: Defense Against the Digital Dark Arts

Core Concepts & CIA Triad

• CIA Triad — guiding model for information security policies: Confidentiality, Integrity, Availability
• Confidentiality — keeping information hidden from unauthorized parties
• Integrity — keeping data accurate and untampered with
• Availability — information is readily accessible to those who should have it

Malware Types

Network Attacks

Other Attacks

• Injection Attack — inserts malicious code into a legitimate website or input field; mitigated by sanitizing inputs
• XSS (Cross-Site Scripting) — injection attack targeting users of a service by inserting malicious scripts
• SQL Injection — sends SQL commands as input to a site using a SQL database to manipulate or dump data
• Brute Force — tries every possible password combination; CAPTCHA helps prevent this
• Dictionary Attack — tries commonly used words and phrases rather than all combinations

Social Engineering

Core Concepts & Principles

• Encryption — taking plaintext, applying a cipher (algorithm), and producing unreadable ciphertext; decryption is the inverse
• Key — determines the specific output of an encryption algorithm; key length defines maximum potential strength (longer = harder to brute force)
• Security Through Obscurity — flawed assumption that secrecy of the algorithm itself provides security
• Kerckhoffs's Principle — a cryptographic system should remain secure even if everything about the system is public knowledge, except the key
• Cryptanalysis — the practice of breaking/analyzing cryptographic systems (opposite of cryptography)
• Frequency Analysis — studying how often letters appear in ciphertext to deduce the key or plaintext
• Steganography — hiding information inside other data without encrypting it (security by obscurity at the data level)

Symmetric Encryption

• Symmetric key algorithms use the same key to encrypt and decrypt
• Stream cipher — encrypts data one character/digit at a time; faster and simpler, but vulnerable to key-reuse attacks
• Block cipher — divides data into fixed-size blocks and encrypts each block as a unit; generally more secure
• Initialization Vector (IV) — random value combined with the key to produce a unique encryption key per message, preventing key-reuse vulnerabilities; sent in plaintext alongside ciphertext

Asymmetric / Public Key Encryption

• Asymmetric cryptography uses a key pair: a public key (shared freely) to encrypt and a private key (kept secret) to decrypt
• Provides Confidentiality, Authenticity, and Non-repudiation
• More computationally expensive than symmetric — in practice, asymmetric is used to securely exchange a symmetric key, then symmetric takes over (TLS does exactly this)

Message Authentication Codes (MACs)

Hashing

• Hash function — takes arbitrary input and produces a fixed-size output (digest/hash); designed to be one-way and deterministic
• Ideal hash properties: deterministic, fast to compute, one-way (pre-image resistant), avalanche effect (small input change → drastically different hash), collision resistant
• Hash collision — two different inputs producing the same hash digest; a serious flaw in any hash function
• MIC (Message Integrity Check) — a hash digest of a message used as a checksum to verify it hasn't been altered in transit
• Never store passwords in plaintext — always store the hash; but running hash thousands of times (key stretching) makes brute-force slower
• Rainbow table — precomputed table mapping passwords to their hashes; renders basic hashing of common passwords trivial to crack
• Password Salt — random data added to the password before hashing, making the output unique even for identical passwords, rendering rainbow tables useless

PKI & Digital Certificates

• PKI (Public Key Infrastructure) — system defining the creation, storage, and distribution of digital certificates
• Digital Certificate — file proving an entity owns a certain public key; contains: public key, registered owner info, digital signature from a CA
• CA (Certificate Authority) — trusted entity that signs certificates, vouching for the identity of the certificate holder
• RA (Registration Authority) — verifies the identity of entities requesting certificates from the CA
• Root CA — top of the CA hierarchy; its certificate is self-signed and trusted by operating systems/browsers
• End-entity / Leaf certificate — a certificate with no authority to sign other certificates (e.g., a web server certificate)
• Web of Trust — alternative to CA hierarchy where individuals sign each other's keys (used in PGP)

Cryptographic Protocols & Applications

Hardware Security

Authentication — Core Concepts

• Identification — uniquely describing an entity (e.g., a username)
• Authentication (authn) — verifying identity: proving you are who you claim to be
• Authorization (authz) — controlling what an authenticated identity can access or do; always follows authentication
• Security vs. Usability trade-off — stronger security (longer passwords, MFA) reduces convenience; policies must balance both
• Password policies — enforce minimum length, complexity, rotation schedules, and history to prevent reuse; incorporating good password policies is key for safety

MFA — Multi-Factor Authentication

• MFA requires two or more verification factors from different categories, significantly reducing risk of compromise
• SMS-based OTPs are not recommended — SMS is unencrypted, not private, and susceptible to SIM-swapping; prefer authenticator apps or hardware tokens

Biometric Authentication

• Uses unique physiological characteristics (fingerprint, retina, voice, face) to verify identity
• Biometric data should never be stored directly — a mathematical template is stored, not a raw image
• More critical to protect than passwords: if compromised, biometrics cannot be changed

Certificate-Based Authentication

• Uses digital certificates (X.509) to authenticate clients or devices instead of passwords
• Common in VPNs, enterprise Wi-Fi (802.1X / EAP-TLS), and mutual TLS (mTLS)
• Certificate validity is checked against Not Before / Not After dates and the CA's CRL (Certificate Revocation List)
• The seed value for token-based auth is registered with the authentication server; NTP must be synchronized for TOTP to work

AAA Protocols — RADIUS & TACACS+

Kerberos

• Authentication protocol using tickets to prove identity over potentially insecure channels
• Uses symmetric encryption; supports AES with checksums
• Tickets expire but support renewal; requires NTP — timestamps prevent replay attacks
• One login → ticket granting → access to multiple services without re-entering credentials

SSO & Identity Federation

Authorization

• Describes what an authenticated account has access to — permissions, resources, and allowed actions

Access Control Models

Accounting & Auditing

• Accounting — tracking what resources and services users access, and what actions they perform on your systems
• Auditing — reviewing accounting records to ensure compliance, detect anomalies, and investigate incidents; a key component of the accounting pillar
• Audit logs should record: who, what action, when, and from where
• Protect logs from tampering — attackers often attempt to clear logs after a breach to cover their tracks

Secure Network Architecture

• Network hardening — reducing a network's attack surface through configuration changes and deliberate security steps
• Implicit deny — anything not explicitly permitted is denied; the safest default stance for firewall and ACL rules
• ACLs on firewalls — used to implement implicit deny; supports both whitelisting (allow specific traffic) and blacklisting (block known-bad traffic)
• Traffic monitoring & log analysis — collecting logs from network and client devices and performing automated analysis against user-defined rules; establishes a baseline to detect anomalies
• Normalizing log data — standardizing logs from different devices/systems so they can be compared; critical because formats vary widely
• Correlation analysis — matching events across different systems/logs to identify attack patterns that span multiple sources
• Post-fail analysis — investigating how a compromise happened after the fact; informs future hardening
• Splunk — popular enterprise log analysis and SIEM platform
• Flood guards — detect common DoS/DDoS flood patterns and trigger blocking actions; fail2ban is a popular open-source tool that blocks IPs after repeated failures

Network Hardware Hardening

802.1X & EAP — Port-Based Network Access Control

• IEEE 802.1X — standard for port-based network access control; allows clients to connect using modern authentication methods before gaining network access
• EAP (Extensible Authentication Protocol) — authentication framework used by 802.1X; encapsulated in 802.1X as EAPoL (EAP over LAN)
• EAP-TLS — the most secure EAP type; provides mutual authentication of both client and authentication server using digital certificates; considered the gold standard for wireless security

Firewalls & Proxies

Wireless Security — WEP → WPA → WPA2

• WPA2 4-Way Handshake — establishes a Pairwise Transient Key (PTK): AP sends a nonce → client sends a nonce → AP sends the Group Transient Key (GTK) → client ACKs. The PTK (5 sub-keys for encryption, integrity, and data) is derived from these nonces + the pre-shared key
• Nonce — a unique, one-time-use random value generated for a specific cryptographic purpose
• WPS (Wi-Fi Protected Setup) — simplifies joining networks via PIN, NFC, or push-button; consumer feature with known vulnerabilities; disable in enterprise environments; use Wash to verify WPS is off

Network Monitoring & Packet Analysis

• Packet sniffing (capture) — capturing and inspecting network packets; requires root privileges
• Promiscuous mode — NIC mode where the interface captures all packets on the segment, not just those addressed to it
• Port mirroring — switch feature that copies all traffic from a port or VLAN to a designated monitoring port
• Monitor mode (wireless) — allows scanning across channels to capture all wireless frames from any AP or client
• tcpdump — powerful CLI packet capture tool; can write captures to file for later analysis; uses libpcap
• Wireshark — GUI packet analyzer built on libpcap; more powerful filtering and protocol dissection than tcpdump

IDS & IPS

• Signatures — unique characteristics of known malicious traffic used by IDS/IPS to identify threats
• NIDS must be positioned in the network topology where it can see all traffic (e.g., after the router/firewall or on a mirrored port)

UTM — Unified Threat Management

tcpdump — Command Reference

BPF Filter Expressions

NIDS in Production — Deployment & Placement

• Two-NIC rule — a NIDS host needs a dedicated monitoring NIC (no IP address, passively captures traffic) and a separate management NIC (for alerts, config, and SIEM forwarding); mixing them on one interface limits visibility and exposes the sensor
• Network TAP (Test Access Point) — a passive hardware device inserted inline between two network points; copies all traffic to the monitoring port without introducing latency or a failure point; preferred over SPAN in high-security environments because it cannot be disabled by a switch misconfiguration
• SPAN / Mirror port — cheaper alternative to a TAP; configured on a managed switch to copy traffic to the sensor port; may drop packets under high load and can be accidentally cleared during switch changes
• Placement matters — position the NIDS where it sees the traffic you care about: outside the firewall to see all inbound attempts, or inside to catch lateral movement once an attacker is in. Many deployments use both
• Common NIDS software — Snort (signature-based, widely used), Suricata (multi-threaded, IDS+IPS capable), Zeek/Bro (protocol analysis and logging focused)
• Signature tuning — out-of-the-box rule sets produce many false positives; tuning rules for your environment's traffic baseline is essential before trusting alerts
• SIEM integration — NIDS alerts should feed into a centralized SIEM (e.g., Splunk, Elastic SIEM) so events can be correlated with logs from other sources (firewall, auth, endpoint)

Firewall Types

Network Segmentation & DMZ

• Network segmentation — dividing a network into isolated segments so a breach in one zone cannot freely spread to others; limits the blast radius of an attack
• VLAN (Virtual LAN) — logical segmentation within a switch; traffic between VLANs must pass through a router or firewall, enforcing access control even on shared physical infrastructure
• DMZ (Demilitarized Zone) — a separate network segment between the internet and the internal LAN that hosts public-facing services (web servers, mail servers, DNS). Traffic from the DMZ to the internal network is tightly restricted — if a DMZ host is compromised, the attacker cannot freely reach internal systems

Defense in Depth — The Concept

• Defense in depth — a layered security strategy where multiple overlapping systems of defense protect IT infrastructure; if one layer is bypassed, the next layer contains the damage
• No single control is perfect — the goal is to make a successful attack require defeating multiple independent layers
• Layers typically span: physical security → network perimeter → network internal → host → application → data

System Hardening — OS Level

• Attack surface reduction — every running service, open port, and installed application is a potential entry point; remove or disable anything not needed
• Disable unnecessary services — stop and prevent startup of any service not required for the system's function (e.g., disable Telnet, FTP, unused scheduled tasks)
• Remove default accounts & credentials — default usernames/passwords are publicly known; rename or delete default admin accounts and change all default passwords immediately
• Apply the principle of least privilege — every user account and process should have only the minimum permissions required to perform its function
• Patch management — keep the OS and all software up to date; unpatched vulnerabilities are one of the most common attack vectors; establish a regular patch cadence (e.g., test within 30 days of release, deploy within 60)
• Baselines & configuration management — define a known-good, hardened configuration (baseline image) and enforce it; deviation from the baseline indicates potential compromise or misconfiguration
• Disable unnecessary hardware features — e.g., disable USB ports on machines that don't need them to prevent baiting/removable media attacks
• Bastion Host — a deliberately hardened host with minimal software and only essential services enabled; commonly used as a jump server / controlled gateway to internal systems, avoiding direct exposure of internal hosts; must be heavily monitored and logged

Application Hardening

• Keep applications patched — applications are a top attack vector; browser plugins (especially Flash, Java), office suites, and web servers must be kept current
• Disable unneeded features and plugins — every enabled feature is additional attack surface; disable browser extensions, unnecessary server modules, and unused APIs

SIEM & Log Management

• SIEM (Security Information and Event Management) — centralized platform that collects, stores, and analyzes log data from across the environment; combines logging with real-time correlation, alerting, and dashboards
• Centralized logging — aggregating logs from all hosts, network devices, and applications into one place; makes investigation and correlation possible and keeps logs out of reach of an attacker who has compromised a single host
• Log normalization — standardizing log format from diverse sources (firewalls, servers, endpoints) so events can be meaningfully compared; usually configured in the SIEM ingestion pipeline
• Automated alerting — write rules (e.g., >5 failed logins in 60 seconds from one IP, or any access to a production DB outside business hours) to trigger real-time alerts; reduces dependence on manual log review
• Traffic pattern analysis — establish a baseline of normal behavior (top talkers, request volumes, access patterns); deviations from baseline are high-value signals for detecting compromise
• Log retention — define how long logs must be kept; driven by compliance requirements (e.g., PCI-DSS: 1 year, HIPAA: 6 years) and operational needs; balance storage cost against investigation depth
• Protect the logs — attackers routinely target logs to cover their tracks; ship logs to a remote, append-only store immediately; restrict write/delete access to log storage

Host-Based Security Controls

Vulnerability Management

• Vulnerability scanning — automated tools (e.g., Nessus, OpenVAS) probe systems for known CVEs, misconfigurations, and weak settings without exploiting them; should be run regularly
• Penetration testing — authorized simulated attack that actively exploits vulnerabilities to demonstrate real-world impact; goes beyond scanning to verify whether a flaw is actually exploitable
• CVE (Common Vulnerabilities and Exposures) — public database of known vulnerabilities; each entry has a CVE ID and a CVSS severity score (0–10)
• Patch prioritization — not all patches can be applied instantly; triage by CVSS score, exposure (internet-facing vs internal), and whether a working exploit exists in the wild

Risk, Objectives & Compliance

• Security is a delicate balance between security and productivity — before designing controls, define what the security architecture is actually meant to accomplish
• Legal requirements shape the objective too — e.g. accepting credit card payments means PCI DSS (Payment Card Industry Data Security Standard) applies
• Security work is fundamentally about determining risk/exposure, understanding the likelihood of attacks, and designing defenses that minimize impact
• Threat modeling is the starting point: identify likely threats and assign priorities. High-value data (user data, especially payment data) gets prioritized first
• Vulnerability scanner — a service that runs against your systems, discovers hosts on the network, probes what's listening, and compares findings against known/disclosed vulnerabilities in a report. Examples: Nessus, OpenVAS, Qualys
• Penetration testing should happen regularly alongside scanning — actively trying to break into the system or network to surface vulnerabilities a passive scan would miss

Privacy, Data Handling & Destruction

• Privacy policies oversee access to and use of sensitive data — the default should be no access, and people must justify access specifically, within a limited timeframe
• Data handling policies define details of the data itself and set guidelines for how each type should be handled

Users — The Weakest Link

• You can build the best security system in the world, but it won't protect you if users are unsafe
• Never upload confidential information to a third-party service
• Users are generally lazy about security — an overly complex password policy backfires: people write passwords down, which is less safe than a simpler but well-designed policy
• Phishing emails are effective — they remain one of the most successful attack vectors precisely because they target human behavior, not technical flaws
• Third-party vendor security — any vendor you use is trusted with your data by extension. Run a vendor security questionnaire and test their services for vulnerabilities before onboarding
• A working environment where people speak up matters — a mailing list, a security risk form, an open channel for concerns
• Reinforce and reward good behaviors, and always justify why a behavior is good so it sticks instead of being ignored as red tape

Incident Handling

• Detection is the first step of handling any incident — you can't respond to what you haven't noticed
• Analysis comes next: determine the effects and extent of the damage
• Once scope is determined, containment is the next step — and it's time-sensitive
• Severity depends on what and how many systems were compromised, and how the breach affects company functions
• Impact and recoverability (how complicated and time-consuming recovery will be) both factor into the response plan
• Data exfiltration — the unauthorized transfer of data off a compromised computer
• The type of data involved changes how much care is required — government-regulated data (HIPAA/health, PCI/payment card, PII, FISMA, export administration regulations) needs extra handling

Mobile Devices & BYOD

• All mobile devices should have screen locks and storage encryption enabled
• BYOD (Bring Your Own Device) saves companies money on hardware but introduces new categories of threat

How to use this case study

• Read the company snapshot and the requirements list below — then try to sketch your own security design before revealing mine.
• The write-up under each "My take" toggle is my own submission, written during the course. It isn't a model answer — your design will most likely differ, and that's fine. Lots of different approaches work.
• Below each write-up is a Feedback note — gaps and specifics I missed the first time around, worth remembering for next time.

The Org — Widget Co.

Requirements to incorporate

• Authentication system
• External website security
• Internal website security
• Remote access solution (engineers need CLI access to their workstations)
• Firewall and basic rules recommendations
• Wireless security
• VLAN configuration recommendations
• Laptop security configuration
• Application policy recommendations
• Security and privacy policy recommendations
• Intrusion detection or prevention for systems containing customer data

Executive Summary

As a growing company that sells widgets directly to consumers, there are a few key assets we need to protect from both the consumer and the business perspective. Users enter confidential payment information for us to process, and our engineers work hard on proprietary widget designs we don't want to leak. We have an external website where purchases are processed, an internal intranet for employees, wireless coverage throughout the office, and company laptops issued to employees — all of which represent potential attack targets. Our engineers also require remote access to their workstations with command-line access. With these challenges in mind, here is what I'd recommend, in order of requested implementation.

Authentication System

External Website Security

Internal Website Security

Remote Access Solution

Firewall & Basic Rules Recommendations

Wireless Security

VLAN Configuration Recommendations

Laptop Security Configuration

Application Policy Recommendations

Security & Privacy Policy Recommendations

Intrusion Detection / Prevention for Customer Data Systems

Conclusion

To layer our security strategy using the defense-in-depth concept, there's a lot of ground to cover. This overview walked through the main defense areas, what they do, and how to implement them at Widget Co. to keep our data safe. There's always more to add, but this is a strong starting point.

Overall feedback received

• Google grader: didn't mention specifics enough (e.g. HTTPS, LDAP) — didn't need to over-explain, just needed to name the specific mechanism.
• General theme: the concepts were right throughout, but naming the exact protocol/standard (TLS, WPA3, bastion host, PCI-DSS segmentation) rather than describing it in generic terms is what separates a good design doc from a great one.

Threats — know what you're actually defending against

• Humans are the weakest link, not the algorithms. Phishing works because it targets behavior, not encryption strength. A company can have flawless crypto and still get breached by one clicked link. Technical controls matter, but user education and a culture where people report suspicious activity matter just as much.
• Know your malware vocabulary — it drives your response. A worm spreading network-wide calls for network segmentation and containment; a rootkit hiding at the admin level means you can't trust the compromised host's own tools to detect or remove it — you rebuild from a known-good image instead.
• Implicit deny beats reactive blacklisting. Whether it's a firewall ACL, application whitelisting, or an access control list — deciding what's explicitly allowed and denying everything else is consistently the stronger default than trying to enumerate every bad actor.

Cryptography — the trust machinery underneath everything

• Symmetric for speed, asymmetric for trust — and real systems use both. TLS is the textbook case: asymmetric encryption (RSA/ECDH) authenticates the server and exchanges a session key during the handshake, then fast symmetric encryption (AES-GCM) carries the actual data. Understanding this hybrid pattern explains most of modern secure communication.
• Never store a password — store a salted hash of it. Salting defeats rainbow tables by making every hash unique even for identical passwords. Key stretching (hashing thousands of times) slows brute force. If you ever see plaintext passwords in a database, that's the finding that matters most.
• Kerckhoffs's Principle: the algorithm can be public, only the key is secret. "Security through obscurity" — hiding how a system works instead of relying on a real secret — is a design smell, not a defense.
• PKI is how the internet knows who it's talking to. A certificate binds a public key to an identity and is vouched for by a CA. Check validity dates and the CRL before trusting one — an expired or revoked cert is a red flag, not a formality.

AAA — authenticate, authorize, then account for everything

• MFA means factors from different categories, not two passwords. Something you know + something you have (or are) is what actually reduces risk. SMS OTPs are the weakest "something you have" — SIM-swapping defeats them; prefer authenticator apps or hardware keys (U2F).
• RADIUS for network access, TACACS+ for device administration. RADIUS only encrypts the password field and is used for Wi-Fi/VPN clients through a NAS. TACACS+ encrypts the whole packet and is the stronger choice for admins managing routers and switches.
• Kerberos means a password is never sent over the wire more than once. One login gets a Ticket-Granting Ticket; every subsequent service request trades that ticket for access — no repeated credential transmission, and NTP-synced timestamps stop replay attacks.
• Principle of Least Privilege is the throughline of authorization. RBAC, DAC, and MAC are just different ways of answering "how little access can this account have and still do its job?" — the smaller the blast radius, the smaller the incident.

Securing networks — layers of control, not one big wall

• Host-based and network-based firewalls are both required, not either/or. The network firewall stops what's coming from outside; the host firewall is the last line of defense once something is already inside the perimeter.
• IDS alerts, IPS blocks. An IDS needs a copy of traffic (via a TAP or SPAN port) and can only tell you something happened. An IPS sits inline and can actually stop it — at the cost of becoming a potential single point of failure if it goes down.
• Segmentation contains a breach instead of letting it spread. VLANs, a DMZ for public-facing services, and isolating anything that touches regulated data (PCI/HIPAA) into its own segment are the same idea applied at different scopes.
• 802.1X + EAP-TLS is the gold standard for wireless; WPA2/WPA3-AES/CCMP is the practical minimum. Disable WPS everywhere, and always separate guest Wi-Fi from the corporate network.

Defense in depth — no single control is enough

• Hardening is subtraction, not addition. Disable unused services, remove default accounts, shrink the attack surface — every open port or installed app you don't need is one more thing an attacker can try.
• Patch management is the highest-leverage recurring task in security. The majority of real-world breaches exploit known, already-patched vulnerabilities — the failure is operational (patching cadence), not a lack of available fixes.
• Centralized logging protects the evidence, not just the analysis. Ship logs off the host immediately — attackers routinely try to clear local logs to cover their tracks. A SIEM's real value is correlating events across sources, which requires normalized, centralized data in the first place.
• Vulnerability scanning finds the door; penetration testing proves it opens. Run both regularly — a scan tells you a flaw might exist, a pen test tells you whether it's actually exploitable.

Culture & policy — the layer that makes all the above stick

• Define what the security architecture is for before designing controls. Threat modeling — what's the high-value data, who wants it, how likely is an attack — decides where you spend your limited security budget.
• Compliance requirements (PCI-DSS, HIPAA, FISMA) aren't paperwork — they're a pre-built threat model. If you handle a regulated data type, the standard has already done a lot of the "what do I need to protect against" thinking for you.
• Incident response is a sequence: detect → analyze → contain → recover → post-mortem. Chain of custody matters the moment you suspect a breach, not after — evidence collected sloppily is evidence you can't use.
• BYOD and mobile devices need policy before hardware. Write the AUP and MDM/EMM plan before employees start bringing devices, not after the first lost phone.

The bigger picture