Security work is applied networking. These six concepts come up again and again, whichever specialisation you end up in.
Addressing and subnetting
You cannot judge whether traffic is suspicious without knowing which ranges belong to whom. Subnetting fluency lets you read a firewall log at a glance.
The protocols that carry attacks
DNS, HTTP, SMB and RDP account for a large share of what you will investigate. Learn their normal behaviour so abnormal behaviour stands out.
- DNS for exfiltration and command-and-control
- SMB for lateral movement
- HTTP and TLS for application-layer attacks
Segmentation and trust boundaries
Most damaging breaches are not sophisticated; they simply move sideways through flat networks. Understanding segmentation lets you propose controls that contain incidents instead of just detecting them.
