Network Security Basics

A network connects devices so they can talk to each other. Network security keeps attackers out of that conversation.

A Few Network Words

Common ports you will hear about:

Every open port is a possible way in, so close the ones you do not need.

Seeing Your Own Network Details

On Windows:

ipconfig

Wireless LAN adapter Wi-Fi:

   IPv4 Address. . . . . . . . . . . : 192.168.1.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

The default gateway is usually your router. You can open its settings page by typing that address in a browser.

Firewalls

A firewall checks each connection and decides to allow or block it. Windows and macOS have one built in; keep it on.

On Windows, check that the firewall is turned on for every network type:

Get-NetFirewallProfile | Select-Object Name, Enabled

Name    Enabled
----    -------
Domain     True
Private    True
Public     True

On an Ubuntu server, the ufw firewall makes simple rules. This example allows only SSH and HTTPS:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere

Securing Your Home or Office Wi-Fi

Many routers installed by internet providers keep their default settings for years. Fix these:

1. Change the router admin password (often admin/admin by default)
2. Use WPA2 or, better, WPA3 encryption; never "Open" or WEP
3. Choose a long Wi-Fi password, and do not write it on the wall of the shop
4. Turn off WPS, which has known weaknesses
5. Update the router firmware from its settings page
6. Create a separate guest network for customers and visitors

Public Wi-Fi

Free Wi-Fi at airports, restaurants and malls is convenient but risky:

• Anyone can create a hotspot named "Free_Airport_WiFi"
• Other people on the same network may try to see your traffic

Stay safer by:

• Using only websites with HTTPS (a padlock in the address bar)
• Avoiding banking on public Wi-Fi; use mobile data instead
• Turning off automatic connection to open networks
• Using a trusted VPN

HTTPS and VPNs

HTTPS encrypts the connection between your browser and one website. Nobody in the middle can read your password or messages.

A VPN (Virtual Private Network) encrypts all your internet traffic and sends it through the VPN company's server. It protects you on public Wi-Fi, but you are trusting the VPN company with your traffic, so choose a well-known paid or reputable provider. Free VPN apps sometimes sell user data.

Checking a Website's Certificate

You can see the HTTPS certificate of a site from the command line:

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -subject -enddate

subject=CN = *.example.com
notAfter=Jan 15 23:59:59 2027 GMT

The certificate shows who it belongs to and when it expires (your dates will be different). Browsers check this for you automatically and show a warning if something is wrong. Never ignore those warnings on a login page.

Exercise