4.1Network and Database Fundamentals

SG is not a technical-depth qualification, but understanding controls against unauthorized access and information leakage correctly requires a foundation in networking and data basics. Here we avoid going too deep and focus only on the TCP/IP, DNS, and database points directly relevant to security decisions.

4.1.1TCP/IP and IP addresses

• TCP/IP is the standard protocol suite used on the internet and in-house LANs. It divides roles across four layers—application, transport, internet, and network interface—and each layer faces different threats (eavesdropping, tampering, spoofing) requiring different countermeasures. TCP is connection-oriented, providing reliable communication via a three-way handshake, while UDP is connectionless, faster but without delivery guarantees.
• An IP address identifies a device on a network. Distinguish a global IP address (unique across the internet) from a private IP address (valid only within an organization, not directly reachable from outside). A subnet mask separates the network and host portions, and segmenting a network by department or site is a basic control that limits the blast radius when a device is compromised.

4.1.2DNS and key protocols

• DNS (Domain Name System) is the mechanism for name resolution, mapping domain names (e.g., example.co.jp) to IP addresses. DNS itself is a frequent target of tampering and spoofing (such as DNS cache poisoning), creating the risk of being directed to a fake site while believing it is legitimate—SG requires understanding this as an attack that abuses trust in DNS.
• HTTP/HTTPS is the Web communication protocol; HTTPS encrypts communication with TLS to prevent eavesdropping and tampering. SMTP (Simple Mail Transfer Protocol), used for sending email, has a structural weakness that makes the sender easy to spoof, making it prerequisite knowledge for countermeasures against spoofed email (BEC, phishing) such as SPF/DKIM/DMARC. DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices; because it can also make it easier for unauthorized devices to join a network, it should be managed together with connection controls.

4.1.3Database fundamentals and access control

• A transaction treats a series of database operations as an indivisible unit. Its ACID properties (atomicity, consistency, isolation, durability) prevent an incomplete, inconsistent update even if a failure occurs partway through. For databases handling personal data, log management that preserves update history is also important as an audit trail.
• Database access control means restricting what each user or application can read/update to the minimum necessary (least privilege). Abuse of administrator privileges and failing to remove departed employees' accounts are typical causes of information leakage, and SG tests whether you know that periodic access reviews are a required control. Attacks like SQL injection fall under Chapter 3's controls, but restricting privileges on the database side is also effective as defense in depth.

Consider an incident at mid-size trading company C to see how networking and database fundamentals connect to controls. One day, C's accounting staff received a fake email impersonating a business partner, claiming the "bank account for payment has changed" and urging a transfer. This was a classic business email compromise (BEC) exploiting how easily SMTP lets a sender be spoofed; fortunately staff confirmed by phone with the actual partner and avoided loss, but C decided to introduce SPF/DKIM/DMARC and, as part of employee training, explain the technical background that "SMTP makes sender spoofing easy." Around the same time, C found another issue involving its core system's database: a former employee's account had not been deleted and remained active, revealing that its access control review had been insufficient. The IT department carried out a privilege review of all accounts, removed unnecessary access following least privilege, and reconfirmed that update operations on tables holding important customer data were always handled as transactions, so that no partial, inconsistent update could remain even after a failure. C also separated the accounting department from general business units using subnets and restricted the DHCP address range issued to the accounting segment, so that an unauthorized device could not directly reach the accounting system. This sequence is a typical case where, without understanding networking and database fundamentals, one cannot explain why each control is effective.

4.1.4Section summary

• Global IP = externally reachable, private IP = confined to the organization. DNS carries the risk of redirection to a fake site via cache poisoning and similar attacks
• SMTP makes sender spoofing easy, the premise for BEC/phishing countermeasures. A transaction's ACID properties prevent inconsistency on failure
• Database access control follows least privilege plus periodic access reviews as the basic control