Networking and Cloud Security Concepts · Topic 1 of 3
Network Security Fundamentals
OSI and TCP/IP models, IPv4 and IPv6, ports and secure protocols, VPNs, firewalls, IDS, wireless and Bluetooth, and securing IoT and industrial control systems.
- 3 min
- Know the OSI layers and the four TCP/IP layers.
- TCP is reliable; UDP is fast without guarantees.
- Use SSH, SFTP, HTTPS and SNMPv3 instead of insecure protocols.
What it is
Networks move data between devices using layers of protocols. Knowing those layers and the common protocols helps you see where attacks happen and which control fits. CC stays at the concept level: what each piece does and why it matters for security.
How it works
The OSI and TCP/IP models
| OSI layer | TCP/IP layer | Examples |
|---|---|---|
| 7 Application, 6 Presentation, 5 Session | Application | HTTP, HTTPS, DNS, email |
| 4 Transport | Transport | TCP (reliable), UDP (fast, no delivery guarantee) |
| 3 Network | Internet | IP addresses, routers |
| 2 Data link, 1 Physical | Network access | Ethernet, switches, Wi-Fi, cables |
IPv4 and IPv6
| IPv4 | IPv6 | |
|---|---|---|
| Address length | 32 bits, for example 192.168.1.10 | 128 bits, written in hexadecimal |
| Address supply | Limited; private ranges and NAT are common | Huge address space |
Network address translation (NAT) maps private internal addresses to a public address at the network border.
Ports and secure protocols
Services listen on ports: for example HTTPS on 443, SSH on 22 and DNS on 53. Prefer secure protocols:
| Insecure | Secure replacement |
|---|---|
| Telnet | SSH |
| FTP | SFTP |
| HTTP | HTTPS |
| SNMPv1 and v2c | SNMPv3 (adds authentication and encryption) |
VPNs
A virtual private network (VPN) creates an encrypted tunnel across an untrusted network such as the internet, for remote workers or between sites. Combine it with MFA for remote access.
Firewalls and detection
| Control | What it does |
|---|---|
| Firewall | Allows or blocks traffic by rules on addresses, ports and applications; default deny blocks anything not allowed |
| Web proxy / egress filtering | Controls outbound traffic, for example blocking unapproved AI chatbot sites |
| IDS | Detects suspicious traffic and alerts |
| IPS | Detects and blocks suspicious traffic inline |
| Data loss prevention (DLP) | Inspects outbound content for sensitive data such as card numbers |
Signature-based detection matches known attacks. Anomaly-based (often machine-learning) detection learns normal behaviour and flags differences, so it can catch new attacks without a known signature. If an attacker was already active while the tool learned what is "normal", that activity can become part of the baseline and go unnoticed.
Ingress filtering controls traffic coming in; egress filtering controls traffic going out. Stopping staff from reaching a website is an egress control.
Wireless security
Use WPA3 or WPA2, and for organizations Enterprise mode with an individual login per user, so departing staff can be removed individually. Hiding the network name (SSID) and MAC address filtering are weak. Bluetooth should be turned off when not needed and devices paired only with trusted equipment.
Embedded systems, ICS and IoT
Internet of Things (IoT) devices and industrial control systems (ICS) often have default passwords, rare updates and weak security. Change default credentials, put them on separate network segments and monitor them.
How the exam asks about this
- "Which protocol should replace FTP?" SFTP.
- "How can an IDS catch an attack with no known signature?" Anomaly-based detection against learned normal behaviour.
- "One shared Wi-Fi passphrase is known to former staff." Move to WPA2 or WPA3 Enterprise with individual credentials.
What to remember for the exam
- Know the OSI layers and the four TCP/IP layers.
- TCP is reliable; UDP is fast without guarantees.
- Use SSH, SFTP, HTTPS and SNMPv3 instead of insecure protocols.
- Firewalls filter; IDS detects; IPS blocks; DLP stops sensitive data leaving.
- Segment and harden IoT and ICS devices.
Hiding an SSID or filtering MAC addresses does not secure Wi-Fi. Both are easy to bypass.
Common mistakes
Confusing IDS (alerts) with IPS (blocks).
Thinking a VPN alone makes a device safe.
Leaving default passwords on IoT devices.
Check yourself
At which TCP/IP layer do IP addresses work?
The internet layer.
What does a VPN provide?
An encrypted tunnel across an untrusted network.
Which control stops card numbers from being pasted into an external AI service?
Data loss prevention (DLP).
Topic 1 of 3 in Networking and Cloud Security Concepts
Test yourself on Networking and Cloud Security Concepts
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.