Every packet you send crosses multiple networks you don't control. Network security is about ensuring that data arrives intact, from the right source, and unread by anyone else. Understanding the threat landscape is essential for building systems that stay secure.

Cryptography Fundamentals#

Symmetric Encryption#

Same key encrypts and decrypts. Fast. Problem: how do you share the key securely?

text

Asymmetric (Public Key) Encryption#

Two mathematically linked keys: public key (share freely) and private key (keep secret).

  • Encrypt with public key → only private key can decrypt (confidentiality)
  • Sign with private key → anyone can verify with public key (authenticity)

RSA and ECDH (Elliptic Curve Diffie-Hellman) are common algorithms. RSA 3072-bit ≈ ECDH 256-bit in security.

Hashing#

One-way function: any input → fixed-size digest. Same input always gives same output; impossible to reverse.

text

Used for: password storage (+ salt), data integrity, digital signatures, TLS certificate fingerprints.

TLS: How HTTPS Actually Works#

TLS combines asymmetric crypto for the handshake (key exchange) and symmetric crypto for data (speed).

TLS 1.3 Handshake in Detail#

text

Step 3 is where most of the security actually lives, and it is the step the list above skims: "verifies certificate chain" is six separate checks, performed in a fixed order, and the order is the interesting part.

The simulation below runs the whole handshake phase by phase. Both key shares are real modular exponentiation. The numbers are small so they fit on screen, but the client and the server compute the shared secret from different halves and still land on the same value. The chain check then walks the list above: the name, the dates, the OCSP answer, each signature, and finally the root, which is the only thing in the picture that never crossed the wire.

The beat worth waiting for is the one after the chain verifies. It swaps in the certificate a man-in-the-middle would present (same domain, same dates, not revoked) and runs it through the same six checks. Three of them pass. The fourth is the one that needs a key the attacker does not have.

Certificate Revocation#

If a private key is stolen, the certificate must be revoked before it expires:

  • CRL (Certificate Revocation List): a signed list of revoked serial numbers, downloaded periodically
  • OCSP (Online Certificate Status Protocol): real-time query to the CA
  • OCSP Stapling: server includes fresh OCSP response with every TLS handshake, so the client makes no extra round trip

PKI (Public Key Infrastructure)#

The Certificate Authority (CA) hierarchy is what makes certificate verification work globally:

text

Let's Encrypt is a free, automated CA that issues certificates via the ACME protocol. Used by ~350 million websites.

Common Attacks#

Man-in-the-Middle (MITM)#

Attacker intercepts traffic between client and server, potentially reading or modifying it.

Defence: TLS with certificate validation. The attacker can't forge a valid certificate for your domain without the CA's private key.

text

DDoS (Distributed Denial of Service)#

Flood a server with traffic from many sources (botnet) to exhaust resources.

Types:

  • Volumetric: saturate bandwidth (UDP flood, DNS amplification)
  • Protocol: exhaust connection tables (SYN flood: send SYNs, never ACK)
  • Application layer: send expensive requests (slow HTTP read, database queries)

Defences: CDN (absorb volumetric), SYN cookies (stateless SYN handling), rate limiting, WAF.

Bots and CAPTCHA#

Many of those requests come from scripts, so sites ask "are you a person?", and the checkbox decides mostly before you click it. A cursor driven by a hand curves, overshoots, slows down near the target and hesitates; a naive script runs a straight line at one speed and clicks the instant it arrives. The box can also weigh signals like your cookies and the browser you run in. Google does not publish exactly what reCAPTCHA weighs, so the figures below are measured off two modelled cursors, not taken from it. A visitor who still looks like a bot gets the picture puzzle.

SYN Flood#

Attacker sends many SYN packets without completing the handshake. Server allocates state for each half-open connection, filling the backlog queue.

text

SYN cookies: server encodes connection state in the ISN (Initial Sequence Number), requires no state until the ACK arrives.

DNS Spoofing / Cache Poisoning#

Attacker injects false DNS records into a recursive resolver's cache, redirecting users to malicious IPs.

Defence: DNSSEC validates records with digital signatures. Source port randomisation + 16-bit transaction ID randomisation makes injection harder.

SSL Stripping#

Attacker downgrades HTTPS to HTTP by intercepting the initial redirect.

Defence: HSTS (HTTP Strict Transport Security). The browser remembers "only HTTPS for this domain" for N seconds.

http

Firewalls#

A firewall filters network traffic based on rules.

Stateless packet filter: evaluates each packet independently (source/dest IP, port, protocol).

Stateful inspection: tracks connection state, and allows responses to established connections without explicit outbound rules.

Application-layer firewall (WAF): understands HTTP; can block SQL injection, XSS, suspicious User-Agent strings.

Think of a packet filter as a bouncer at your server's door with a guest list. Every packet arrives wearing a badge: the port it wants and the address it comes from. The bouncer reads the list from the top and stops at the first line that fits both. The rules below let in HTTPS on port 443 from anyone and SSH on port 22 only from the office. So a stranger asking for port 22 is turned away even though SSH is on the list, because the address is part of the rule. A packet that fits no allow line falls to the last line and is dropped.

bash

VPNs#

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a VPN server. Your traffic appears to originate from the VPN server's IP.

Use cases: secure remote access to corporate networks, bypass geographic restrictions, protect traffic on public WiFi.

Common protocols: OpenVPN, WireGuard (modern, fast, 4000 lines of code vs OpenVPN's ~100k), IPSec/IKEv2.

Zero Trust Architecture#

Traditional security assumed "inside the perimeter = trusted." Modern systems assume zero trust: no implicit trust based on network location.

Principles:

  • Verify every request explicitly (identity, device health, context)
  • Least privilege: access only what's needed
  • Assume breach: segment networks, log everything, detect anomalies

What to Remember#

  • Symmetric crypto is fast; asymmetric (public/private key) solves the key exchange problem
  • TLS uses asymmetric crypto for handshake + symmetric for data, with 1 RTT in TLS 1.3
  • The CA hierarchy (PKI) enables trusting certificates from strangers
  • MITM attacks are defeated by certificate validation; SYN floods by SYN cookies; DNS spoofing by DNSSEC
  • HSTS and certificate pinning prevent protocol downgrade attacks
  • Modern security follows zero trust: verify every access, never assume trust by location