What we protect
Your laptop joins the office by Wi-Fi through the access point. A file server holds the shared files, and the router links the office to the internet. Security means keeping this network and its data safe. Safe from what, exactly?
Confidentiality means only the right people can read the data. When your laptop fetches the payroll file, nobody else on the way should see inside it. Encryption keeps it secret: the file travels scrambled, and only the two ends hold the key.
Integrity means data arrives exactly as it was sent. If someone changed one number in the file on the way, your laptop must notice. A check value made with a secret key travels with the data, and any change makes the check fail.
Availability means the service works when people need it. A server that has crashed, been switched off or is flooded with junk fails this, even if no secret leaks. Confidentiality, integrity and availability together are called the CIA triad.
Authentication means proving who you are before you get in, with a password, a key or a certificate. The server opens the files only after your laptop proves it is you. Authorisation then decides what you may do.
Threats and attackers
A threat is someone or something that could cause harm, like a criminal on the internet. A vulnerability is a weakness they could use, like a router with an old, known bug. Risk is how likely the harm is, times how bad.
An attacker on the internet is far away. It can only send packets to your public address, 203.0.113.10. It looks for open doors, guesses passwords and floods your line with junk, so it mostly threatens availability and weak logins.
An attacker on the path sits between you and the other end, like a tapped line or a hacked router at your internet provider. Every packet passes through it, so it can read or change anything not encrypted. Confidentiality and integrity are most at risk.
An attacker on the LAN, like an infected PC or a guest on your Wi-Fi, is already inside. It reaches every device directly and can send fake messages to trick them. The router's firewall never sees this traffic, so all three are at risk.
Defence in depth
Defence in depth means many layers, so one failure is not the end: a firewall on the router, WPA3 on the Wi-Fi, encryption, strong logins and updates. An attacker must beat every layer. The next lessons show each attack, then the defence that stops it.
Behind the step
;; step 1/10 · office · scene ;; at your laptop + wi-fi ap + file server + office router office LAN 192.168.1.0/24 (private, RFC 1918) your laptop 192.168.1.20 MAC 00:00:5e:00:53:14 (Wi-Fi) access point MAC 00:00:5e:00:53:02 bridges Wi-Fi onto the LAN file server 192.168.1.10 MAC 00:00:5e:00:53:0a SMB, TCP 445 office router LAN 192.168.1.1 internet side 203.0.113.10 from the internet, only the router's public address is reachable (NAT)
On-path and off-path attackers come from the Internet threat model in RFC 3552. An attacker can move between positions: a remote attacker who breaks into one office PC becomes an attacker on the LAN. The office LAN uses the private range 192.168.1.0/24 (RFC 1918); 203.0.113.10 and 198.51.100.66 are RFC 5737 documentation addresses, and the MAC addresses come from the RFC 7042 documentation block (00:00:5e:00:53:xx).