Packets To Exploits

How to Design and Secure Computer Networks

49 modules

198 lessons

—

Part 1

Appendices

Appendix A - Diagram Templates by StepSign in
Appendix B - Mapping to Real-World Tech Stacks (Without Prescribing Products)Sign in
Appendix C - Readiness Checklists (Step N to Step N+1)Sign in
Appendix D - GlossarySign in

Part 2

Course Setup and the Incremental Ladder

Course Setup and the Incremental LadderSign in
Why "Packets to Exploits"Sign in
How to Use This CourseSign in
The Incremental Ladder (Step 0 -> Step 7)Sign in
The Course LensesSign in
Diagram Legend and Notation TypesSign in

Part 3

Networks as Systems

Networks as SystemsSign in
Networks as GraphsSign in
Data, Control, and Management PlanesSign in
Where Security Actually LivesSign in

Part 4

The OSI and TCP/IP Models

The OSI and TCP/IP ModelsSign in
OSI vs TCP/IPSign in
Mapping Real Protocols to LayersSign in
Layer Models as Troubleshooting ToolsSign in

Part 5

Packets, Frames, and Encapsulation

Packets, Frames, and EncapsulationSign in
Encapsulation and DecapsulationSign in
Ethernet, IP, TCP/UDP, PayloadsSign in
MTU, Fragmentation, PerformanceSign in

Part 6

The Security Mindset for Network Designers

The Security Mindset for Network DesignersSign in
Attack Surface and RiskSign in
Defense-in-DepthSign in
Balancing Usability, Performance, SecuritySign in

Part 7

Diagramming Network and Security Architectures

Diagramming Network and Security ArchitecturesSign in
Physical vs Logical TopologiesSign in
Layered Diagrams and App FlowsSign in
Trust Boundaries and Data-Flow DiagramsSign in

Part 8

Layer 1–2: Links, MACs, and Local Networks

Layer 1–2: Links, MACs, and Local NetworksSign in
Media and Links (Conceptual)Sign in
MAC Addressing and ARP-Like ResolutionSign in
Broadcast Domains and Simple SwitchingSign in

Part 9

Layer 3–4: IP Addressing and Transport

Layer 3–4: IP Addressing and TransportSign in
IPv4 Subnets and GatewaysSign in
TCP vs UDPSign in
Ports, Sockets, and the Connection Lifecycle (Conceptual)Sign in

Part 10

Basic Connectivity Troubleshooting

Basic Connectivity TroubleshootingSign in
Reachability Checking (High Level)Sign in
Common Failure PointsSign in
A Minimal Debugging ChecklistSign in

Part 11

Switches, VLANs, and Layer 2 Design

Switches, VLANs, and Layer 2 DesignSign in
VLAN Segmentation (Conceptual)Sign in
Loop Avoidance (High Level)Sign in
L2 Failure DomainsSign in

Part 12

Routers, Routing Protocols, and Layer 3 Design

Routers, Routing Protocols, and Layer 3 DesignSign in
Static vs Dynamic Routing (High Level)Sign in
Default Gateways and Path SelectionSign in
WAN vs LAN PatternsSign in

Part 13

NAT, Firewalls (Basic), and Edge Connectivity

NAT, Firewalls (Basic), and Edge ConnectivitySign in
NAT/PAT ConceptsSign in
Basic Firewall RulesSign in
Internet Edge RiskSign in

Part 14

Common Small Network Topologies

Common Small Network TopologiesSign in
Small Office/Home PatternsSign in
Branch/Campus BasicsSign in
DMZ-Style Intro PatternSign in

Part 15

DNS and Naming

DNS and NamingSign in
Resolution FlowSign in
Internal vs External DNSSign in
DNS as Attack SurfaceSign in

Part 16

Web and API Protocols

Web and API ProtocolsSign in
HTTP Request/ResponseSign in
TLS (Conceptual)Sign in
Load Balancers and Proxies (Conceptual)Sign in

Part 17

Email, Directory, and Remote Access Protocols

Email, Directory, and Remote Access ProtocolsSign in
Email FlowsSign in
Directory and Identity Protocols (High Level)Sign in
Remote Access ModelsSign in

Part 18

Application Protocols as Security Boundaries

Application Protocols as Security BoundariesSign in
Secure Protocol vs Secure Deployment: How Good Protocols Fail Under Bad PlacementSign in
Where to Terminate TLS and Enforce Auth: Turning Boundaries into Concrete Enforcement PointsSign in
Mapping Services to Zones: Aligning App Surfaces with Segmentation StrategySign in

Part 19

Logical Segmentation and Zoning

Logical Segmentation and ZoningSign in
Zones by Function: User/Server/Management/External as Different Risk ProfilesSign in
Micro vs Macro Segmentation: Operational Cost Versus Blast-Radius ReductionSign in
Business Domains to Network Domains: Mapping Organizational Boundaries into Network BoundariesSign in

Part 20

Perimeter, DMZ, and Hybrid Border Patterns

Perimeter, DMZ, and Hybrid Border PatternsSign in
Perimeter Models: What They Assume About "Inside" and Why Those Assumptions BreakSign in
DMZ Placement: Controlling Exposure and Constraining DependenciesSign in
Hybrid Borders: Remote Access, VPN-like Connectivity, and Policy Consistency ProblemsSign in

Part 21

Data Center, Campus, and Cloud Network Designs

Data Center, Campus, and Cloud Network DesignsSign in
Common Design Families (Conceptual): core-distribution-access and leaf-spine as failure-domain choicesSign in
Cloud VPC/VNet Concepts: virtual segmentation and routing as software-defined boundariesSign in
Hybrid Connectivity: linking failure and trust domains across on-prem and cloudSign in

Part 22

Segmentation for Security and Containment

Segmentation for Security and ContainmentSign in
Limiting Lateral Movement: why segmentation is a primary defensive controlSign in
Least Privilege for Networks: making "who can talk to whom" explicit and reviewableSign in
ACLs, Firewalls, Security Groups (Conceptual): choosing enforcement points and avoiding policy sprawlSign in

Part 23

Identity-Aware and Zero-Trust-Inspired Approaches

Identity-Aware and Zero-Trust-Inspired ApproachesSign in
From Location Trust to Identity Decisions: what changes when "inside" is no longer trustedSign in
Contextual Inputs: strong auth, device posture, and policy evaluation as architectureSign in
Architectural Implications: where policy engines sit and how traffic is forced through themSign in

Part 24

Security Objectives and Policy

Security Objectives and PolicySign in
CIA and Beyond: confidentiality, integrity, availability, auditability as system propertiesSign in
Policy and Classification: translating organizational intent into technical requirementsSign in
Policy to Controls: mapping words to enforcement points and measurable outcomesSign in

Part 25

Trust Boundaries and Threat Modeling Basics

Trust Boundaries and Threat Modeling BasicsSign in
Assets, Entry Points, Boundaries: defining what matters before choosing controlsSign in
STRIDE Categories (High Level): a vocabulary for "how this could fail"Sign in
Data-Flow Diagrams for Threat Modeling: tracing trust transitions and identifying control gapsSign in

Part 26

Authentication, Authorization, and Accounting

Authentication, Authorization, and AccountingSign in
Identity Provider Patterns (Conceptual): centralizing identity and distributing enforcementSign in
RBAC and ABAC: roles and attributes as different policy machinesSign in
Accounting and Audit: logging privileged actions as a control, not just telemetrySign in

Part 27

Security Controls Across Network Layers

Security Controls Across Network LayersSign in
L2-L3 Controls (Conceptual): port security and admission ideas as boundary enforcementSign in
L4-L7 Controls: gateways, proxies, and inspection as policy executionSign in
Endpoint and Network Controls Together: avoiding gaps caused by assuming one layer "covers" anotherSign in

Part 28

Resilience and Availability as Security Concerns

Resilience and Availability as Security ConcernsSign in
DoS and DDoS (Conceptual): availability failures as adversarial outcomesSign in
Redundancy and Failover: designing continuity under partial compromise or partial failureSign in
Graceful Degradation: keeping critical functions alive when the network is under stressSign in

Part 29

The Attack Lifecycle

The Attack LifecycleSign in
Stages and Objectives: recon to impact as a planning modelSign in
Mapping Objectives to Paths: how attackers traverse network boundariesSign in
Layered Defenses by Stage: designing controls that interrupt progress, not just block entrySign in

Part 30

Reconnaissance and Discovery (High-Level)

Reconnaissance and Discovery (High-Level)Sign in
Discovery Categories: what can be learned from exposure and misconfigurationSign in
Reducing exposed surface: minimizing what is discoverable by defaultSign in
Monitoring and rate limiting: turning recon into detectable, bounded behaviorSign in

Part 31

Initial Access and Perimeter Breaches

Initial Access and Perimeter BreachesSign in
High-Level Entry Categories: misconfiguration, credential abuse, vulnerable services as architectural risksSign in
Defensive Baselines: patching, hardening, and secure defaults as repeatable practiceSign in
Segmentation After Breach: assuming compromise and limiting blast radiusSign in

Part 32

Lateral Movement and Internal Recon

Lateral Movement and Internal ReconSign in
Conceptual Movement Mechanics: how compromised identity or hosts become pivotsSign in
Flat Networks as Fuel: why implicit trust is the real exploitSign in
Detecting and Limiting Movement: policy, logging, and anomaly detection tied to segmentationSign in

Part 33

Common Attack Categories and Mitigation Patterns

Common Attack Categories and Mitigation PatternsSign in
Broad Classes: spoofing, man-in-the-middle, protocol misuse, weak auth abuseSign in
Defensive Building Blocks: encryption, mutual auth, integrity checks, secure configurationSign in
Secure Defaults as Architecture: how platforms eliminate whole classes of operator mistakesSign in

Part 34

Security Testing and Validation (High-Level)

Security Testing and Validation (High-Level)Sign in
Scanning and Review Concepts: finding misconfigurations and exposure patternsSign in
Red/Blue/Purple Team Models: aligning learning with operational readinessSign in
Turning Findings into Design Changes: closing the loop from discovery to architectureSign in

Part 35

Network Telemetry and Observability

Network Telemetry and ObservabilitySign in
Device and Service Logs: what they reveal and what they omitSign in
Flow Data (Conceptual): why flows scale better than packets for many questionsSign in
Packet Capture as Deep Diagnosis: when you need it and how to scope it responsiblySign in

Part 36

IDS/IPS and Network Security Sensors

IDS/IPS and Network Security SensorsSign in
Signature vs Anomaly (High Level): what each class can detect reliablySign in
Placement Trade-offs: taps/SPAN, inline vs out-of-band and failure impactsSign in
Tuning for Value: reducing noise and focusing on high-fidelity signalsSign in

Part 37

Centralized Logging and Correlation

Centralized Logging and CorrelationSign in
Aggregation and Normalization (Conceptual): why schema matters for security investigationsSign in
Correlation and Alerting: building detections that align with threat modelsSign in
Retention and Forensics: designing logging for investigations, not just dashboardsSign in

Part 38

Threat Hunting and Anomaly Detection

Threat Hunting and Anomaly DetectionSign in
Hypothesis-Driven Hunting: searching with intent rather than reacting to alertsSign in
Baselines and Deviations: how "normal" becomes an operational dependencySign in
Using Hunts to Improve Architecture: hunting outcomes as feedback into segmentation and controlsSign in

Part 39

Monitoring for Performance and Reliability

Monitoring for Performance and ReliabilitySign in
Health and Capacity Metrics: keeping networks stable so security signals remain meaningfulSign in
Security-Reliability Interactions: why outages can be incidents and incidents can be outagesSign in
Dashboards and Alerts for Two Audiences: aligning NOC and SOC needs without duplicationSign in

Part 40

Incident Response Lifecycle

Incident Response LifecycleSign in
The IR Phases: preparation through lessons learned as a repeatable operating loopSign in
Network-Specific IR Tasks: evidence capture, isolation, and indicator blocking as boundary operationsSign in
Coordination and Communication: aligning technical containment with stakeholder needsSign in

Part 41

Containment Strategies in Network Incidents

Containment Strategies in Network IncidentsSign in
Quarantine and Blocking Patterns: isolating hosts and segments without collapsing the businessSign in
Continuity vs Containment: making trade-offs explicit and time-boundedSign in
Playbooks and Decision Trees: reducing improvisation under pressureSign in

Part 42

Hardening Network Infrastructure

Hardening Network InfrastructureSign in
Secure Configuration Concepts: minimizing administrative exposure and unsafe defaultsSign in
Baselines and Golden Configs: making "known good" repeatable and reviewableSign in
Patch and Lifecycle Planning: managing vendor and device lifecycles as security realitySign in

Part 43

Designing Secure and Resilient Architectures

Designing Secure and Resilient ArchitecturesSign in
Defense-in-Depth Across Layers: composing controls so single failures are survivableSign in
Redundancy and Diversity: avoiding shared-mode failures that drop both security and availabilitySign in
Recoverability by Design: building systems that can be restored quickly and safelySign in

Part 44

Governance, Compliance, and Continuous Improvement

Governance, Compliance, and Continuous ImprovementSign in
Standards as Feedback: turning policy into design review, not paperworkSign in
Audits as Signals: using findings to improve architecture and operationsSign in
Metrics and Maturity: measuring progress in visibility, containment, and reliabilitySign in

Part 45

Reference Architectures for Secure Networks

Reference Architectures for Secure NetworksSign in
Organization Archetypes (High Level): small org, distributed org, cloud-heavy org, OT/IT boundarySign in
Mapping the Ladder to Roadmaps: sequencing investments without skipping essential boundariesSign in
Trade-off Narratives: when complexity pays off and when it becomes the riskSign in

Part 46

Network Design Patterns

Network Design PatternsSign in
Topology Patterns: hub-and-spoke, mesh, leaf-spine as reliability and blast-radius choicesSign in
Redundant Paths and HA Pairs: designing for failure without creating control-plane fragilitySign in
Management and Out-of-Band Access: separating operator paths from production flowsSign in

Part 47

Security Architecture Patterns

Security Architecture PatternsSign in
DMZ and Tiered Applications: aligning exposure with controlled dependenciesSign in
Zero-Trust-Inspired Per-Request Checks (High Level): enforcing identity and context at the right boundarySign in
Isolation for High-Risk Systems: patterns for constraining compromise and enabling recoverySign in

Part 48

Operational Patterns and Anti-Patterns

Operational Patterns and Anti-PatternsSign in
Change and Peer Review: preventing configuration drift from becoming vulnerabilitySign in
Anti-Patterns: snowflake configs, flat networks, implicit trust as incident multipliersSign in
Automation and IaC-Like Approaches: reducing operator error and improving auditabilitySign in

Part 49

Design Checklists for Secure Networked Systems

Design Checklists for Secure Networked SystemsSign in
Connectivity and Boundary Review: ensuring the architecture matches intended trustSign in
Auth, Logging, Monitoring Coverage: making detection and investigation feasibleSign in
Resilience and IR Readiness: ensuring recovery is planned, tested, and executableSign in

Course overview