2.2Network addresses and security

To discuss network security, the foundation is being able to read "with what address you are communicating with whom." A device has two kinds of address—the fixed L2 MAC address and the L3 IP address (IPv4/IPv6)—and a range of addresses is expressed with CIDR such as 192.168.1.0/24. NAT bridges the private addresses freely used inside an organization and the public addresses unique on the internet. Using these ideas of addressing, network segmentation—dividing a network into compartments to confine damage—is one of the most important defenses at the introductory stage. This section identifies the roles of addresses and understands why segmentation works.

2.2.1Two kinds of address and address notation

• An IPv4 address is a 32-bit L3 address (four numbers) like 192.168.1.10, changeable by configuration. Because the supply is running out, migration proceeds to the far larger 128-bit IPv6 (notation like 2001:db8::1). An IP is a logical address pointing to "somewhere on the network."
• A MAC address is a 48-bit L2 address like 00:1A:2B:3C:4D:5E, a device-specific identifier burned into the network card (in principle unchanging). It is used for frame delivery within one segment. Grasp the difference: IP is logical (changeable by configuration) while MAC is physical (device-specific).
• CIDR (classless notation) expresses a network range by appending /prefix length to an address, as in 192.168.1.0/24. A /24 means the first 24 bits are the network portion, covering 192.168.1.0 to 192.168.1.255. It is essential for reading a segment's size and membership.

2.2.2Public/private, NAT, and segmentation

• Private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are freely usable inside an organization and cannot reach the internet as-is. Public addresses are globally unique and valid on the internet. The convention is private inside and public facing outward.
• NAT (Network Address Translation) swaps internal private addresses for a shared public address at the exit. It lets many devices share a few global IPs and has the side effect of hiding the internal address layout from outside (note, though, that NAT is not encryption and is not a security feature on its own).
• Network segmentation divides a network into compartments (segments / VLANs, etc.) by purpose or trust level and controls traffic between them. Even if one compartment is compromised, it confines the damage to that island and curbs lateral spread (lateral movement). It is a basic defense applying least privilege to the network.

Suppose in a small company the office PCs, guest Wi-Fi, and factory control equipment are all connected to a single flat network (the same segment). One day a visitor's laptop is infected with malware and starts scanning device after device within that segment. The problem here is that with only one segment, the infection spreads to every device as one connected land. Had network segmentation been applied in advance to separate "office," "guest," and "control equipment" into distinct compartments with inter-compartment traffic pared to the minimum, the infection in the guest island could have been confined to that island, stopping lateral spread to the critical control equipment and servers. Address knowledge pays off here. Each compartment separates its range with CIDR, such as 192.168.10.0/24 (office) and 192.168.20.0/24 (guest), and controls traffic at the boundary router or firewall. Internally it assigns freely usable private addresses and, only when going out to the internet, translates them to a shared public address with NAT. Note carefully that NAT being present does not itself make it a security measure. NAT is mainly a mechanism to share and translate addresses; dividing compartments to confine damage is the job of segmentation and traffic control at its boundary (firewalls/ACLs in later sections). At the introductory stage, the goal is to correctly identify the basic defensive form: "design compartments by address (IP/CIDR) and confine damage to an island with segmentation."

2.2.3Section summary

• IPv4 (32-bit) / IPv6 (128-bit) are L3 logical addresses; a MAC address (48-bit) is an L2 device-specific physical address. A range is expressed with CIDR (/24, etc.)
• Private addresses are for internal use, public addresses are globally unique, and NAT translates between them—but NAT itself is not encryption or a security feature
• Network segmentation compartmentalizes to confine damage to an island and prevent lateral spread (lateral movement)—a basic defense