CYBOK 19.1-3 Network Security: Goals, Attacker Models, Applications, Layers & Protocols

Relevant learning outcomes

Analysing • Advising • Designing

Possible products

Network Security Analysis
Protocol and Layer Analysis
Network Threat Model
Secure Network Architecture
Security Requirements
Packet Capture Analysis
Attack and Control Matrix

These products can also be used as portfolio evidence.

1. Introduction

A network is not secure simply because it has a firewall or uses encryption. Communication depends on multiple devices, trust boundaries, protocols and layers. A weakness in any of these can undermine the security of the entire communication flow.

To analyse network security, you need to connect four perspectives:

the security goals you want to achieve;
the capabilities and position of a possible attacker;
the network context in which communication takes place; and
the layers and protocols that make the communication possible.

This approach helps you move from a general statement such as "the network must be secure" to a supported explanation of what must be protected, against whom, at which layer and with which controls.

2. Security Goals

Security goals describe what secure communication should achieve. The three most common goals form the CIA triad.

Security goal	Question you ask
Confidentiality	Can an unauthorised party read or infer the information?
Integrity	Can information be changed without being detected?
Availability	Can authorised users reach the data or service when needed?

Depending on the situation, you may also need to consider:

Authenticity: can you verify who sent a message or operates a service?
Non-repudiation: can the origin of a message or action be proven to another party?
Anonymity: can the sender or recipient of a communication be identified?
Privacy and unlinkability: can separate communications or actions be linked to the same person, device or behaviour?

These goals are separate. Encryption can protect confidentiality, for example, but it does not automatically make a service available or a user anonymous.

Before selecting controls, state which goals matter for your case and why. A public information website and the control network of a hospital do not have the same priorities.

3. Attacker Models

An attacker model describes what you assume an attacker can and cannot do. Without these assumptions, a statement that a network is "secure" is too vague to test or defend.

Consider at least the following dimensions:

Dimension	Examples
Behaviour	Passive observation or active manipulation
Position	On-path or off-path
Access	Insider or outsider
Resources	One device, a botnet, a service provider or a state actor
Knowledge	Public information, internal documentation or stolen keys
Limits	Traffic the attacker cannot observe or alter, cryptographic keys they do not possess, systems outside their reach

A passive attacker may capture traffic but not change it. An active attacker may inject, modify, delay, replay or block messages. An on-path attacker can observe the communication path directly, while an off-path attacker may have to rely on spoofing, guessing or indirect influence.

Do not begin an analysis by naming an attack tool. Begin by explaining the attacker's position, access, capabilities and limits. You can then determine which attacks are realistic within the chosen scenario.

4. Network Applications and Contexts

In this CyBOK section, networking applications means the contexts and architectures in which networks are used. It does not refer only to software at the application layer.

Network context	Typical security question
Local Area Network (LAN)	Which devices and users should be trusted inside the network?
Connected networks and the Internet	How is communication protected across infrastructure you do not control?
Bus network	How do you protect shared, resource-constrained or real-time communication?
Wireless network	How do you control access and prevent eavesdropping over a broadcast medium?
Distributed or peer-to-peer network	How do you establish trust without one central authority?
SDN and NFV environment	How do you protect programmable control and virtualised network functions?

The same protocol can have a different risk depending on its context. A legacy protocol on an isolated test network is not equivalent to the same protocol connecting production equipment to the Internet.

When documenting a context, include:

important devices, services and data;
users and administrators;
trust boundaries;
external networks and suppliers;
wireless, physical or shared communication media; and
dependencies on DNS, time, identity, cloud or routing services.

5. Layers and Protocols

Layered models divide communication into responsibilities. They help you identify where an attack takes place and where a control can be applied. CyBOK mainly uses the four-layer TCP/IP model. The seven-layer OSI model offers a more detailed conceptual view.

TCP/IP layer	Main responsibility	Protocols and technologies discussed at this layer	Example security concerns
Application	Meaning and use of data	HTTP(S), DNS, SMTP, IMAP, NTP	Spoofing, phishing, insecure protocol behaviour, malicious content
Transport	Communication between processes	TCP, UDP, QUIC; TLS protects many application flows	SYN flooding, reset attacks, session injection, UDP reflection
Network	Addressing and routing between networks	IPv4, IPv6, ICMP, IPsec, BGP	IP spoofing, route hijacking, fragmentation abuse, reconnaissance
Link	Communication across a local link	Ethernet, Wi-Fi, ARP, NDP, 802.1X, VLAN	Eavesdropping, MAC or ARP spoofing, unauthorised access, VLAN hopping

This is a functional grouping. For example, BGP runs over TCP but controls Internet routing, while NDP uses ICMPv6 to perform local-link neighbour discovery.

The models are aids, not physical laws. Some technologies sit between layers or combine responsibilities. For example, TLS is often described between the application and transport layers, while QUIC combines secure transport functions over UDP.

Do not only memorise protocol names. For each relevant protocol, explain:

what responsibility it has;
which data or header fields it exposes;
which security properties it provides by itself;
which properties require an additional protocol or control; and
what happens when the protocol is misconfigured, outdated or abused.

6. Connecting Goals, Attacks, Layers and Controls

One communication flow uses several layers at the same time. When you open an HTTPS website, for example:

Ethernet or Wi-Fi provides access to the local link.
DNS helps resolve the domain name.
IP carries packets between networks.
For HTTP/1.1 or HTTP/2, TCP transports the connection and TLS protects it.
For HTTP/3, QUIC runs over UDP and integrates TLS 1.3 into the connection.
HTTP expresses the web request and response.

An attacker can target every step. ARP spoofing targets local address resolution, BGP hijacking targets routing, a SYN flood targets TCP resources, DNS spoofing targets name resolution and phishing targets the user at the application level.

This also shows why one control is rarely sufficient. HTTPS protects the contents and integrity of web communication in transit, but it does not by itself:

prevent every denial-of-service attack;
secure a compromised endpoint;
guarantee that the application is free of vulnerabilities;
hide all traffic metadata; or
make every DNS or routing decision trustworthy.

Use controls at multiple layers and explain how they complement each other. This is defence in depth.

Starting points

When analysing a network security case:

Select one important service or communication flow.
Draw the endpoints, network devices, external services and trust boundaries.
Describe the network context and relevant dependencies.
State the required security goals and their priority.
Define the attacker's position, access, capabilities and explicit limits.
Map each relevant protocol to its TCP/IP or OSI layer.
Identify realistic attacks against those protocols or dependencies.
Collect authorised evidence from diagrams, configurations, logs or packet captures.
Link each proposed control to a specific attack or security goal.
Explain assumptions, limitations and remaining risk.

Advanced (Level 3)

For a more complex environment, you may investigate:

formal attacker models such as Dolev-Yao;
BGP hijacking, RPKI and inter-domain routing trust;
IPv6 dual-stack exposure and NDP security;
QUIC, HTTP/3 and the limits of encrypted traffic inspection;
traffic analysis and anonymity networks;
SDN controller and NFV isolation risks;
CAN, Modbus and other cyber-physical or real-time protocols;
downgrade behaviour, legacy compatibility and protocol migration; and
how security guarantees change when a router, certificate authority, cloud provider or endpoint is compromised.

CYBOK 19.1-3 Network Security: Goals, Attacker Models, Applications, Layers & Protocols

CYBOK 19.1-3 Network Security: Goals, Attacker Models, Applications, Layers & Protocols

Relevant learning outcomes

Possible products

1. Introduction

2. Security Goals

3. Attacker Models

4. Network Applications and Contexts

5. Layers and Protocols

6. Connecting Goals, Attacks, Layers and Controls

Starting points

Further reading

Advanced (Level 3)