Cyber Wiki Topic 02
Networks & Protocols
How systems communicate, where trust boundaries form, and how networks are protected and monitored.
Topic Directory
68 entries
Address Resolution Protocol (ARP)
Address Resolution Protocol (ARP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Routing security · AdvancedBGP Route Security
BGP route security applies policy, filtering, validation, monitoring, and operational discipline to reduce accidental or malicious route announcements.
Availability control · IntermediateCloud DDoS Protection
Cloud distributed-denial-of-service protection combines provider-scale network defenses, traffic filtering, rate controls, resilient architecture, and response procedures.
Cloud service concept · IntermediateCloud Edge Services and Content Delivery
Cloud edge services place content, acceleration, routing, filtering, or application functions closer to users and devices.
Network architecture · AdvancedCloud Hybrid Connectivity
Hybrid connectivity joins cloud environments with data centers, offices, edge locations, or other providers through VPNs, dedicated links, and routing services.
Hybrid connectivity · AdvancedCloud Interconnect Security
Cloud interconnect security protects dedicated and virtual connectivity between enterprise networks, cloud providers, exchanges, and software-defined interconnection services.
Network architecture · IntermediateCloud Networking with VPCs and VNets
Virtual private clouds and virtual networks create logically isolated address spaces, subnets, routes, interfaces, and gateways inside cloud environments.
Network control · IntermediateCloud Security Groups and Network ACLs
Security groups, firewall rules, and network access-control lists restrict traffic at resource, subnet, or network boundaries.
Network concept · IntermediateCloud Subnets, Routes, and Gateways
Cloud subnets divide address space, route tables determine forwarding, and gateways connect workloads to other networks or provider services.
Network security concept · BeginnerDHCP Security
DHCP Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network service · BeginnerDHCP and IP Address Management
DHCP automates network configuration for clients, while IP address management tracks address plans, allocations, reservations, and ownership.
DNS security · AdvancedDNS Encryption and Resolution Security
DNS encryption and resolution security protect name-resolution traffic and resolver behavior while preserving authentication, policy, observability, and operational reliability.
Network security concept · BeginnerDNS Resolution Process
DNS Resolution Process describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network security concept · IntermediateDNS Security
Domain Name System security protects the naming process that maps human-readable names to network information and directs clients toward services.
Network security concept · BeginnerDNS Security Extensions (DNSSEC)
DNS Security Extensions (DNSSEC) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Networking concept · FoundationalDNS and DHCP
DNS maps names to network resources, while DHCP supplies devices with addressing and configuration information needed to participate on a network.
Network security concept · BeginnerDemilitarized Zones
Demilitarized Zones is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Messaging security concept · AdvancedEmail Authentication and DNS Security
Email authentication and DNS security combine DNSSEC, SPF, DKIM, DMARC, TLS, certificate validation, and resolver protections to reduce spoofing, tampering, and delivery abuse.
ATT&CK mitigation profile · IntermediateFilter Network Traffic (M1037)
Permit only necessary network communication and inspect, block, or constrain traffic that violates approved flows and trust boundaries. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Network control · BeginnerFirewalls
Firewalls enforce network communication policy by allowing, denying, inspecting, or recording traffic between defined security zones and endpoints.
Network security concept · BeginnerForward Proxies
Forward Proxies is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerHTTP and HTTPS
HTTP and HTTPS describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network security · IntermediateHost Firewall Policy
Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
Networking concept · FoundationalIP Addressing and Routing
IP addressing and routing explain how hosts identify network locations and how routers select paths that move packets between local and remote networks.
Network security concept · BeginnerIPv6 Neighbor Discovery
IPv6 Neighbor Discovery is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Protocol security · AdvancedIPv6 Security
IPv6 security applies secure architecture, filtering, neighbor-discovery protections, address management, monitoring, and transition controls to IPv6 traffic.
Network security concept · BeginnerInternet Control Message Protocol (ICMP)
Internet Control Message Protocol (ICMP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Detection control · IntermediateIntrusion Detection and Prevention
Intrusion detection systems identify suspicious activity, while intrusion prevention systems can also block or disrupt traffic that matches defined conditions.
Connected-device network control · IntermediateIoT Network Segmentation
IoT network segmentation places connected devices into controlled zones and communication paths according to function, trust, ownership, and consequence so compromise of one device does not provide unrestricted access to users, servers, management systems, or other devices.
ATT&CK mitigation profile · IntermediateLimit Access to Resource Over Network (M1035)
Reduce remote attack paths by limiting which identities, systems, zones, and protocols can reach sensitive resources. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Networking foundation · FoundationalMAC Addresses
A media access control address is a link-layer identifier used by network interfaces and local network technologies to deliver frames within a broadcast domain.
Administrative access control · AdvancedManagement Plane Security
Management plane security protects the interfaces, protocols, identities, networks, and workflows used to configure infrastructure and security systems.
Access control · IntermediateNetwork Access Control
Network access control evaluates who or what is connecting and applies an access decision based on identity, device posture, location, role, and policy.
Network design · IntermediateNetwork Address Planning
Network address planning allocates IPv4 and IPv6 space so networks can scale, summarize routes, isolate environments, avoid overlap, and support operations.
Network security concept · BeginnerNetwork Address Translation (NAT)
Network Address Translation (NAT) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
ATT&CK mitigation profile · IntermediateNetwork Intrusion Prevention (M1031)
Detect and block malicious or policy-violating network activity in line before it reaches its intended target. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Routing architecture · AdvancedNetwork Route Resilience
Network route resilience ensures that routing converges safely through link, device, provider, and policy failures without creating loops, blackholes, or uncontrolled paths.
Architecture control · IntermediateNetwork Segmentation
Network segmentation separates systems and traffic into controlled zones so access can be constrained, monitored, and aligned with risk.
ATT&CK mitigation profile · IntermediateNetwork Segmentation (M1030)
Divide networks and trust zones so compromise in one area does not provide unrestricted access to users, services, management paths, or critical assets. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Network security concept · BeginnerNetwork Segmentation and Microsegmentation
Network Segmentation and Microsegmentation is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerNetwork Time Protocol Security
Network Time Protocol Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Infrastructure security · IntermediateNetwork Time Security
Network time security ensures systems receive accurate, resilient, and authenticated time appropriate to their operational and security requirements.
Operational technology architecture · AdvancedOPC UA Trust Management
OPC UA trust management governs application identities, certificates, trust lists, security policies, endpoint configuration, and lifecycle actions for industrial data exchange.
Network model · BeginnerOSI Model
The OSI model organizes network communication into seven conceptual layers, from physical transmission through user-facing application services.
Operational technology architecture · AdvancedOT Network Zones and Conduits
OT zones group assets with similar function, trust, criticality, and security requirements, while conduits define and control the communications allowed between them.
Operational technology security · AdvancedOT Wireless Security
OT wireless security controls radio-based monitoring, control, maintenance, telemetry, and backhaul across technologies with different range, bandwidth, reliability, and security properties.
Network security concept · BeginnerPort Address Translation (PAT)
Port Address Translation (PAT) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network reference · BeginnerPorts and Protocols
Ports help identify application services at transport endpoints, while protocols define the rules systems use to exchange information.
ATT&CK mitigation profile · IntermediateRestrict Web-Based Content (M1021)
Reduce exposure to malicious web content by controlling destinations, downloads, active content, browser behavior, and risky categories. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Network security concept · BeginnerReverse Proxies
Reverse Proxies is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network architecture concept · AdvancedSASE, SD-WAN, and Software-Defined Networking
SASE, SD-WAN, and software-defined networking separate policy and control from traditional appliances, enabling distributed connectivity and security while increasing dependence on identity, orchestration, and provider controls.
ATT&CK mitigation profile · IntermediateSSL/TLS Inspection (M1020)
Inspect appropriately authorized encrypted traffic where risk, privacy, architecture, and legal requirements justify visibility into protected sessions. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Network security concept · BeginnerSecure Shell (SSH)
Secure Shell (SSH) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerSecure and Insecure Protocols
Secure and Insecure Protocols describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Operational technology security · AdvancedSerial Industrial Protocol Security
Serial industrial protocol security manages physical access, converters, gateways, command authority, monitoring, and compensating controls for communications that often lack modern authentication or encryption.
Network security concept · BeginnerSimple Network Management Protocol Security
Simple Network Management Protocol Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network security concept · BeginnerSoftware-Defined Networking Security
Software-Defined Networking Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerStateful and Stateless Firewalls
Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Networking foundation · FoundationalSubnet Masks and CIDR
Subnet masks and classless inter-domain routing notation identify the network prefix of an IP address and define the size and boundaries of address ranges.
Network security concept · BeginnerTCP Three-Way Handshake
TCP Three-Way Handshake describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Networking concept · FoundationalTCP and UDP Communication
TCP and UDP provide different transport behaviors: TCP emphasizes connection state and reliable delivery, while UDP favors low overhead and application-managed reliability.
Network model · BeginnerTCP/IP Model
The TCP/IP model groups the protocols that support modern internetworking into practical layers for link access, internet routing, transport, and applications.
Network security concept · BeginnerVirtual LANs (VLANs)
Virtual LANs (VLANs) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Virtualization security · IntermediateVirtual Network Security
Virtual network security applies segmentation, traffic policy, monitoring, address controls, and management separation to software-defined switches, interfaces, overlays, and workload networks.
Network security concept · BeginnerVirtual Private Network Protocols
Virtual Private Network Protocols describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Secure connectivity · BeginnerVirtual Private Networks
A virtual private network creates a protected communication path across an untrusted or shared network for users, sites, or systems.
Network security concept · BeginnerWireless Authentication and Encryption
Wireless Authentication and Encryption is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Network security concept · BeginnerWireless Network Security
Wireless security protects radio-based network access through strong authentication, encryption, secure configuration, monitoring, and controlled coverage.