Overview
free

Appendix A - Diagram Templates by Step
Appendix B - Mapping to Real-World Tech Stacks (Without Prescribing Products)
Appendix C - Readiness Checklists (Step N to Step N+1)
Appendix D - Glossary

Course Setup and the Incremental Ladder
Why "Packets to Exploits"
How to Use This Course
The Incremental Ladder (Step 0 -> Step 7)
The Course Lenses
Diagram Legend and Notation Types

Networks as Systems
Networks as Graphs
Data, Control, and Management Planes
Where Security Actually Lives

The OSI and TCP/IP Models
OSI vs TCP/IP
Mapping Real Protocols to Layers
Layer Models as Troubleshooting Tools

Packets, Frames, and Encapsulation
Encapsulation and Decapsulation
Ethernet, IP, TCP/UDP, Payloads
MTU, Fragmentation, Performance

The Security Mindset for Network Designers
Attack Surface and Risk
Defense-in-Depth
Balancing Usability, Performance, Security

Diagramming Network and Security Architectures
Physical vs Logical Topologies
Layered Diagrams and App Flows
Trust Boundaries and Data-Flow Diagrams

Layer 1–2: Links, MACs, and Local Networks
Media and Links (Conceptual)
MAC Addressing and ARP-Like Resolution
Broadcast Domains and Simple Switching

Layer 3–4: IP Addressing and Transport
IPv4 Subnets and Gateways
TCP vs UDP
Ports, Sockets, and the Connection Lifecycle (Conceptual)

Basic Connectivity Troubleshooting
Reachability Checking (High Level)
Common Failure Points
A Minimal Debugging Checklist

Switches, VLANs, and Layer 2 Design
VLAN Segmentation (Conceptual)
Loop Avoidance (High Level)
L2 Failure Domains

Routers, Routing Protocols, and Layer 3 Design
Static vs Dynamic Routing (High Level)
Default Gateways and Path Selection
WAN vs LAN Patterns

NAT, Firewalls (Basic), and Edge Connectivity
NAT/PAT Concepts
Basic Firewall Rules
Internet Edge Risk

Common Small Network Topologies
Small Office/Home Patterns
Branch/Campus Basics
DMZ-Style Intro Pattern

DNS and Naming
Resolution Flow
Internal vs External DNS
DNS as Attack Surface

Web and API Protocols
HTTP Request/Response
TLS (Conceptual)
Load Balancers and Proxies (Conceptual)

Email, Directory, and Remote Access Protocols
Email Flows
Directory and Identity Protocols (High Level)
Remote Access Models

Application Protocols as Security Boundaries
Secure Protocol vs Secure Deployment: How Good Protocols Fail Under Bad Placement
Where to Terminate TLS and Enforce Auth: Turning Boundaries into Concrete Enforcement Points
Mapping Services to Zones: Aligning App Surfaces with Segmentation Strategy

Logical Segmentation and Zoning
Zones by Function: User/Server/Management/External as Different Risk Profiles
Micro vs Macro Segmentation: Operational Cost Versus Blast-Radius Reduction
Business Domains to Network Domains: Mapping Organizational Boundaries into Network Boundaries

Perimeter, DMZ, and Hybrid Border Patterns
Perimeter Models: What They Assume About "Inside" and Why Those Assumptions Break
DMZ Placement: Controlling Exposure and Constraining Dependencies
Hybrid Borders: Remote Access, VPN-like Connectivity, and Policy Consistency Problems

Data Center, Campus, and Cloud Network Designs
Common Design Families (Conceptual): core-distribution-access and leaf-spine as failure-domain choices
Cloud VPC/VNet Concepts: virtual segmentation and routing as software-defined boundaries
Hybrid Connectivity: linking failure and trust domains across on-prem and cloud

Segmentation for Security and Containment
Limiting Lateral Movement: why segmentation is a primary defensive control
Least Privilege for Networks: making "who can talk to whom" explicit and reviewable
ACLs, Firewalls, Security Groups (Conceptual): choosing enforcement points and avoiding policy sprawl

Identity-Aware and Zero-Trust-Inspired Approaches
From Location Trust to Identity Decisions: what changes when "inside" is no longer trusted
Contextual Inputs: strong auth, device posture, and policy evaluation as architecture
Architectural Implications: where policy engines sit and how traffic is forced through them

Security Objectives and Policy
CIA and Beyond: confidentiality, integrity, availability, auditability as system properties
Policy and Classification: translating organizational intent into technical requirements
Policy to Controls: mapping words to enforcement points and measurable outcomes

Trust Boundaries and Threat Modeling Basics
Assets, Entry Points, Boundaries: defining what matters before choosing controls
STRIDE Categories (High Level): a vocabulary for "how this could fail"
Data-Flow Diagrams for Threat Modeling: tracing trust transitions and identifying control gaps

Authentication, Authorization, and Accounting
Identity Provider Patterns (Conceptual): centralizing identity and distributing enforcement
RBAC and ABAC: roles and attributes as different policy machines
Accounting and Audit: logging privileged actions as a control, not just telemetry

Security Controls Across Network Layers
L2-L3 Controls (Conceptual): port security and admission ideas as boundary enforcement
L4-L7 Controls: gateways, proxies, and inspection as policy execution
Endpoint and Network Controls Together: avoiding gaps caused by assuming one layer "covers" another

Resilience and Availability as Security Concerns
DoS and DDoS (Conceptual): availability failures as adversarial outcomes
Redundancy and Failover: designing continuity under partial compromise or partial failure
Graceful Degradation: keeping critical functions alive when the network is under stress

The Attack Lifecycle
Stages and Objectives: recon to impact as a planning model
Mapping Objectives to Paths: how attackers traverse network boundaries
Layered Defenses by Stage: designing controls that interrupt progress, not just block entry

Reconnaissance and Discovery (High-Level)
Discovery Categories: what can be learned from exposure and misconfiguration
Reducing exposed surface: minimizing what is discoverable by default
Monitoring and rate limiting: turning recon into detectable, bounded behavior

Initial Access and Perimeter Breaches
High-Level Entry Categories: misconfiguration, credential abuse, vulnerable services as architectural risks
Defensive Baselines: patching, hardening, and secure defaults as repeatable practice
Segmentation After Breach: assuming compromise and limiting blast radius

Lateral Movement and Internal Recon
Conceptual Movement Mechanics: how compromised identity or hosts become pivots
Flat Networks as Fuel: why implicit trust is the real exploit
Detecting and Limiting Movement: policy, logging, and anomaly detection tied to segmentation

Common Attack Categories and Mitigation Patterns
Broad Classes: spoofing, man-in-the-middle, protocol misuse, weak auth abuse
Defensive Building Blocks: encryption, mutual auth, integrity checks, secure configuration
Secure Defaults as Architecture: how platforms eliminate whole classes of operator mistakes

Security Testing and Validation (High-Level)
Scanning and Review Concepts: finding misconfigurations and exposure patterns
Red/Blue/Purple Team Models: aligning learning with operational readiness
Turning Findings into Design Changes: closing the loop from discovery to architecture

Network Telemetry and Observability
Device and Service Logs: what they reveal and what they omit
Flow Data (Conceptual): why flows scale better than packets for many questions
Packet Capture as Deep Diagnosis: when you need it and how to scope it responsibly

IDS/IPS and Network Security Sensors
Signature vs Anomaly (High Level): what each class can detect reliably
Placement Trade-offs: taps/SPAN, inline vs out-of-band and failure impacts
Tuning for Value: reducing noise and focusing on high-fidelity signals

Centralized Logging and Correlation
Aggregation and Normalization (Conceptual): why schema matters for security investigations
Correlation and Alerting: building detections that align with threat models
Retention and Forensics: designing logging for investigations, not just dashboards

Threat Hunting and Anomaly Detection
Hypothesis-Driven Hunting: searching with intent rather than reacting to alerts
Baselines and Deviations: how "normal" becomes an operational dependency
Using Hunts to Improve Architecture: hunting outcomes as feedback into segmentation and controls

Monitoring for Performance and Reliability
Health and Capacity Metrics: keeping networks stable so security signals remain meaningful
Security-Reliability Interactions: why outages can be incidents and incidents can be outages
Dashboards and Alerts for Two Audiences: aligning NOC and SOC needs without duplication

Incident Response Lifecycle
The IR Phases: preparation through lessons learned as a repeatable operating loop
Network-Specific IR Tasks: evidence capture, isolation, and indicator blocking as boundary operations
Coordination and Communication: aligning technical containment with stakeholder needs

Containment Strategies in Network Incidents
Quarantine and Blocking Patterns: isolating hosts and segments without collapsing the business
Continuity vs Containment: making trade-offs explicit and time-bounded
Playbooks and Decision Trees: reducing improvisation under pressure

Hardening Network Infrastructure
Secure Configuration Concepts: minimizing administrative exposure and unsafe defaults
Baselines and Golden Configs: making "known good" repeatable and reviewable
Patch and Lifecycle Planning: managing vendor and device lifecycles as security reality

Designing Secure and Resilient Architectures
Defense-in-Depth Across Layers: composing controls so single failures are survivable
Redundancy and Diversity: avoiding shared-mode failures that drop both security and availability
Recoverability by Design: building systems that can be restored quickly and safely

Governance, Compliance, and Continuous Improvement
Standards as Feedback: turning policy into design review, not paperwork
Audits as Signals: using findings to improve architecture and operations
Metrics and Maturity: measuring progress in visibility, containment, and reliability

Reference Architectures for Secure Networks
Organization Archetypes (High Level): small org, distributed org, cloud-heavy org, OT/IT boundary
Mapping the Ladder to Roadmaps: sequencing investments without skipping essential boundaries
Trade-off Narratives: when complexity pays off and when it becomes the risk

Network Design Patterns
Topology Patterns: hub-and-spoke, mesh, leaf-spine as reliability and blast-radius choices
Redundant Paths and HA Pairs: designing for failure without creating control-plane fragility
Management and Out-of-Band Access: separating operator paths from production flows

Security Architecture Patterns
DMZ and Tiered Applications: aligning exposure with controlled dependencies
Zero-Trust-Inspired Per-Request Checks (High Level): enforcing identity and context at the right boundary
Isolation for High-Risk Systems: patterns for constraining compromise and enabling recovery

Operational Patterns and Anti-Patterns
Change and Peer Review: preventing configuration drift from becoming vulnerability
Anti-Patterns: snowflake configs, flat networks, implicit trust as incident multipliers
Automation and IaC-Like Approaches: reducing operator error and improving auditability

Design Checklists for Secure Networked Systems
Connectivity and Boundary Review: ensuring the architecture matches intended trust
Auth, Logging, Monitoring Coverage: making detection and investigation feasible
Resilience and IR Readiness: ensuring recovery is planned, tested, and executable

/packets-to-exploits/packets-to-exploits

Threat Hunting and Anomaly Detection

Sign in to access this lesson.

Sign in Create account