Unit 3: Securing Networks

In ARP poisoning, an attacker fakes address-table entries so a victim's traffic flows to them, an on-path (man-in-the-middle) attack. MAC flooding overloads a switch so it broadcasts everything, letting the attacker eavesdrop, and DNS poisoning plants fake records that send users to a fake login site. A smurf attack floods a victim with ICMP replies, a denial of service (DoS). Open switch ports, Wi-Fi that leaks outside the building, rogue access points and missing firewalls all raise the risk.

Network policies set minimum rules for routers, switches, VPNs and Wi-Fi, such as banning local accounts, turning off unneeded services like Telnet, requiring port security and MAC filtering, and forbidding split tunneling. For Wi-Fi, you can turn off beacon frames, limit the signal's strength and direction, require users to sign in, and use strong encryption. WEP, WPS and the original WPA are insecure; the course framework (fall 2026) names WPA3 as the strongest option.

Segmentation splits a network into smaller, isolated pieces so an attack on one part can't easily spread. You can segment with subnets (based on IP addresses), with VLANs set up on switches, and with a screened subnet, or DMZ, that holds public-facing servers between the internet and the private network. Each segment can then get its own security level.

A stateless firewall filters on packet details like IP addresses, ports and protocols. A stateful firewall also tracks connections, and a next-generation firewall (NGFW) adds deep packet inspection, intrusion prevention and filtering by application. A firewall follows an access control list (ACL) read from the top, and the first matching rule wins, so rule order matters. You want a firewall on each segment and on every connection to the internet.

A network intrusion detection system (NIDS) raises alerts, and an intrusion prevention system (NIPS) can also block traffic. A SIEM pulls logs from many sources together to spot patterns, with AI helping sort them. Signature-based detection is fast with almost no false positives but misses brand-new attacks; anomaly-based detection compares traffic to a normal baseline and can catch new attacks, but it costs more and raises more false alarms, and hybrid detection combines both. In logs, watch for known-bad IP addresses, scans, traffic spikes or a port used by the wrong application.