6.1Network architectures and TCP/IP

For a Registered Information Security Specialist, network mechanics are not mere facts to memorize—they are the foundation for judging how much a given segmentation and addressing design shrinks the attack surface. Whether an internal network houses every device in one flat segment, or is split into subnets per department/criticality with ACLs and firewalls controlling traffic between them, dramatically changes the blast radius (room for lateral movement) once a breach occurs. This section covers OSI/TCP-IP fundamentals, routing, and TCP/UDP through the lens of design and security judgment.

6.1.1The OSI reference model and the TCP/IP four-layer model

• The OSI reference model divides communication functions into seven layers (physical, data link, network, transport, session, presentation, application). Separating responsibilities by layer makes interoperability between devices/protocols and fault isolation easier.
• The TCP/IP four-layer model is the simplified model widely used in practice: it merges OSI's session, presentation, and application layers into a single application layer, and combines the physical and data-link layers into the network interface layer. OSI's transport layer maps to the TCP/IP transport layer, and OSI's network layer maps to the TCP/IP internet layer.
• The practical value of understanding the layered structure is in identifying which layer an attack or countermeasure operates at. For example, firewall packet filtering operates at the network/transport layer while a WAF operates at the application layer—the scope of a countermeasure's effectiveness is determined by its layer.

6.1.2IP addressing and subnetting

• A subnet mask marks the boundary between an IP address's network portion and host portion. CIDR notation (e.g. /24) states the number of network bits; /24 leaves 8 host bits, i.e. up to 256 addresses (254 assignable once the network and broadcast addresses are excluded).
• Subnetting further divides the host bits of a single network into multiple smaller networks (subnets). Using VLSM (variable-length subnet masking), you can assign differently sized subnets per department according to the number of hosts actually needed, avoiding wasted IP address space.
• From a security-design standpoint, subnetting combined with authentication VLANs or a DMZ creates boundaries that keep damage from a compromised segment from spreading to others. Mixing assets of different criticality (general user devices, servers, admin workstations) in the same segment makes a single compromised host an easy springboard for lateral movement.

6.1.3Routing (static and dynamic)

• Static routing requires an administrator to manually configure route information. For simple, small networks it is easy to manage, and it has the benefit of not being exposed to route-advertisement hijacking via a dynamic protocol. On the other hand, every topology change requires manual updates and does not scale.
• Dynamic routing lets routers automatically exchange route information via a protocol. RIP (distance-vector, selects routes by hop count, suited to small networks), OSPF (link-state, computes shortest paths via cost values, suited to large internal networks), and BGP (path-vector, used for route exchange between autonomous systems (AS) such as between ISPs, the backbone of the Internet) each have distinct characteristics.
• For security judgment, BGP is at risk of route hijacking, and OSPF/RIP are at risk of traffic being misdirected via forged route advertisements, so a design that permits route exchange only with trusted neighboring routers, via route authentication and filtering, is important. Besides MD5 — the method the exam asks about — current practice uses HMAC-SHA (OSPFv2/BGP) or IPsec (OSPFv3), and validates the legitimacy of the routes themselves with RPKI origin validation (and BGPsec).

Consider a security officer redesigning the head-office network for 300 employees. Currently every device (general business PCs, accounting-department PCs, servers, and network admin workstations) sits in a single 192.168.1.0/24 segment, so if a general business PC is compromised via a targeted attack, there is a high risk of lateral movement to servers or admin workstations in the same segment. First, for address design, subnet 192.168.1.0/24 using VLSM by department and criticality. Rather than leaving the general-business group (about 250 devices) on 192.168.1.0/24 (254 assignable) as-is, put it behind an authentication VLAN on 192.168.10.0/25 (126 assignable: 8-1=7 bits, 2^7-2=126); give the accounting department (20 devices) 192.168.10.128/27 (2^5-2=30 assignable); give the server segment 192.168.20.0/28 (2^4-2=14 assignable); and give the admin-workstation segment 192.168.20.16/28—physically isolating assets of differing criticality into separate segments, with a firewall enforcing rules that permit only the traffic actually required between segments (principle of least privilege). For routing, given the internal scale and number of segments, adopt OSPF (link-state, cost-optimal routes, fast convergence on change), and enable route authentication between routers to prevent traffic misdirection via forged route advertisements. As a result, even if one general-business PC is compromised, an attacker cannot reach the server or admin segments without breaching the firewall's ACLs—substantially shrinking the blast radius (room for lateral movement).

6.1.4TCP, UDP, and port numbers

• TCP is a connection-oriented, reliable transport-layer protocol. It establishes a connection at the start of communication via the three-way handshake (SYN -> SYN/ACK -> ACK), and performs ordering and retransmission control. A SYN flood attack—a DoS technique that sends a mass of SYN packets alone to exhaust resources—abuses this establishment process.
• UDP is a connectionless, best-effort transport-layer protocol optimized for low latency. It suits use cases such as DNS queries, video streaming, and VoIP, where speed is prioritized over tolerating some packet loss. Because the source IP is easy to spoof in UDP, a key security consideration is its susceptibility to being used as a stepping stone for attacks such as DNS reflection/amplification attacks.
• A port number is a 16-bit number identifying which of multiple applications (processes) running on the same host a packet is destined for. 0-1023 are well-known ports (HTTP=80, HTTPS=443, SSH=22, etc.). In firewall design, closing unnecessary ports (least privilege) is a basic tenet of defense in depth.

6.1.5Section summary

• Subnetting should be designed not just for performance but as a security boundary that isolates assets of differing criticality and shrinks the blast radius of a compromise
• Dynamic routing (RIP/OSPF/BGP) carries a risk of spoofed or tampered route advertisements, so combine it with route authentication and filtering
• TCP's three-way handshake is the vector for SYN floods, and UDP's spoofable source makes it an easy DDoS stepping stone—factor these risks into protocol selection