Networking Security

Network security is all about protecting your data and systems from bad actors who want to steal, change, or destroy them. It is a huge topic, but we will cover the most important basics here.

Why Does Network Security Matter?

Think about it this way. If there was no security at all, anyone could read your messages, steal your passwords, take your money, or stop a service from working.

Every single device connected to a network (your phone, laptop, server, smart TV, anything) is a possible target for attackers. That is why security is so important.

The CIA Triad: The Three Goals of Security

When people talk about security, they usually mean these three goals. Together, they are called the CIA Triad.

Confidentiality

Only the people who are allowed to see the data can see it. Encryption helps make this happen.

Integrity

The data does not get changed or messed with while it is being sent. Hashing and digital signatures help make this happen.

Availability

The system stays up and working whenever people need it. Backup systems and DDoS protection help make this happen.

Common Types of Attacks

Here are the most common ways attackers try to cause damage. Each one works differently, so each one needs a different way to stop it.

DDoS (Distributed Denial of Service)

An attacker sends a massive flood of fake traffic to your server. This traffic comes from thousands of infected computers all working together. This group of infected computers is called a botnet.

Because of this flood, your server gets overloaded and cannot answer real users anymore.

Think of it like thousands of fake customers blocking the entrance of a store, so real customers cannot get in.

This kind of attack is hard to stop completely. To reduce the damage, people use a CDN, rate limiting, and traffic filtering tools like Cloudflare or AWS Shield.
Man in the Middle (MITM) Attack

An attacker secretly sits between two people who are talking to each other online. Both people think they are talking directly to each other, but the attacker is actually in the middle, reading or changing everything.

To stop this, always use HTTPS. TLS encryption scrambles the data, so even if someone catches it in the middle, they cannot read it.
Phishing

This is a fake email or website made to look real, just to trick you into giving away your password or other personal information.

A common example is an email saying “Click here to verify your bank account,” which actually takes you to a fake bank website.

To protect yourself, always check the website address carefully, turn on 2FA, and never click on links that look suspicious.
SQL Injection

Here, an attacker types harmful SQL code into a normal input box, like a login form, to mess with your database.

For example, if someone types '; DROP TABLE users; -- into a username field, it could end up deleting the entire users table from the database.

To prevent this, always use parameterized queries or prepared statements. Never build SQL queries directly using raw user input.
XSS (Cross Site Scripting)

An attacker sneaks harmful JavaScript code into a webpage. When other people visit that page, the malicious script runs in their browser.

This script can steal their cookies (which hold their login session) or redirect them to another site.

To prevent this, always clean and escape any user input before showing it on a page.
CSRF (Cross Site Request Forgery)

This attack tricks a browser into sending a request to a website without the user even knowing it happened.

For example, say you are logged into your bank account. If you visit a malicious website, that site could secretly make your browser send a “transfer money” request to your bank, all without you noticing.

To prevent this, websites use CSRF tokens. These are secret, unique values that must be included with a form for the request to be accepted as real.
Brute Force Attack

This is when someone tries every possible password combination until one of them finally works.

To prevent this, use account lockouts after a few failed attempts, rate limiting, CAPTCHAs, and strong passwords.
ARP Poisoning / Spoofing

The attacker sends fake ARP messages that link their own MAC address to a real IP address that belongs to someone else.

This causes network traffic meant for that other person to instead be sent to the attacker. This is basically a Man in the Middle attack, but happening at a lower network layer (Layer 2).

To prevent this, use Dynamic ARP Inspection (DAI) on network switches.
DNS Spoofing / DNS Cache Poisoning

This means putting fake information into a DNS cache so that a website address points to the attacker’s server instead of the real one.

For example, you type yourbank.com into your browser, but the DNS gives you the attacker’s IP address instead, so you end up on a fake bank website without realizing it.

To prevent this, use DNSSEC (DNS Security Extensions), which digitally signs DNS records so they cannot be faked easily.

Firewalls

A firewall is a security system that watches and controls the traffic coming in and going out of a network, based on a set of rules you decide.

This is the simplest type of firewall. It checks the source and destination IP address and port number of each packet.

Based on the rules you set, it either allows the packet or blocks it. It does not look inside the packet to check what is actually in it.

It works like a bouncer who only checks your ID (your IP and port), but never checks what is inside your bag.

Example of Firewall Rules:

Allow TCP from any to 0.0.0.0:443   (allow HTTPS traffic)
Allow TCP from any to 0.0.0.0:80    (allow HTTP traffic)
Allow TCP from 192.168.1.0/24 to any:22  (allow SSH only from local network)
Deny all                             (block everything else)

Encryption

Encryption scrambles up data so that only someone who has the correct key can actually read it.

Symmetric Encryption

In symmetric encryption, the same key is used both to lock (encrypt) and unlock (decrypt) the data.

It is fast and works efficiently. The tricky part is, how do you safely share that one key with the other person without anyone else getting it?

This type is mainly used for encrypting data that is stored somewhere (data at rest) and for encrypting large amounts of data being transferred.

Common algorithms include AES (very common and secure today), DES (old and now considered broken), and 3DES.

Asymmetric Encryption (Public Key Cryptography)

This method uses two different keys, a public key and a private key.

Whatever the public key locks (encrypts), only the matching private key can unlock (decrypt) it, and this also works the other way around.

You can freely share your public key with anyone. But your private key must always stay secret and only with you.

This method is slower than symmetric encryption, but it solves the problem of safely sharing keys.

It is used for things like the HTTPS handshake, digital signatures, and SSH connections.

Common algorithms include RSA and ECC (Elliptic Curve Cryptography).

How HTTPS Uses Both Types Together

First, asymmetric encryption is used just to safely share a symmetric key between the two sides.
After that, all the actual data is encrypted using symmetric encryption, because it is much faster.

graph LR A[Browser] -- 1. Asymmetric encryption used to exchange key --- B[Server] B -- 2. Shared symmetric key agreed --- A A -- 3. All data now sent using fast symmetric encryption --- B

A hash function takes any kind of input and turns it into a fixed size output. This output is called a hash, or a digest.

Hashing only works in one direction. This means you cannot reverse a hash to get back the original input.

It is used for storing passwords safely (you store the hash of the password, never the actual password) and for checking that a file has not been changed or tampered with.

Common algorithms include SHA-256, SHA-512, bcrypt (specifically made for passwords), and MD5 (old, weak, and should not be used for security anymore).

# SHA-256 hash example
echo "hello" | sha256sum
# Output: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

# Even a tiny change produces completely different hash
echo "hello!" | sha256sum
# Output: 9fbc4b5d8ee3689b7f51fbf6e0474e5c0b8124c4c9e89ee2b93a3d6ef5d2b0c7

Key Security Best Practices

Here are some simple habits that go a long way in keeping your data and systems safe.

Use HTTPS Everywhere

Never send sensitive information over plain HTTP. Always use HTTPS.

Use Strong, Unique Passwords

Use a different, strong password for each account. A password manager makes this easy.

Enable 2FA

Two-Factor Authentication means even if your password gets stolen, the attacker still needs a second factor to get in.

Keep Software Updated

Updates and patches fix security holes that attackers could otherwise use against you.

Use a Firewall

Protect both your network and your server with a properly configured firewall.

Principle of Least Privilege

Only give users and services the exact permissions they truly need, nothing more.

Encrypt Sensitive Data

Encrypt data both while it travels (HTTPS/TLS) and while it sits in storage (database encryption).

Validate and Sanitize Input

Always check and clean user input. This helps prevent SQL injection and XSS attacks.

Monitor Logs

Keep logs of activity and review them regularly to catch anything suspicious early.

Backup Regularly

If ransomware ever hits your system, a recent backup means you can restore your data without paying anyone.

These notes cover everything in the networking mindmap, from the absolute basics all the way to system design and security. Go through each section step by step, and you will build a solid foundation in computer networking.