10. How do packet-switching services differ from other WAN services?
11. Where does packetizing take place?
12. Compare and contrast frame relay and Ethernet services.
13. Which is likely to be the longer-term winner: MPLS or Ethernet services?
14. Explain the differences between CIR and MAR.
15. How do VPN services differ from common carrier services?
16. Explain how VPN services work.
17. Compare the three types of VPN.
18. How can you improve WAN performance?
19. Describe three important factors in selecting WAN services.
20. Are Ethernet services a major change in the future of networking or a technology blip?
21. What is SDWAN and what benefits does it provide?
22. What is the architecture of an SDWAN?
23. Are there any WAN technologies that you would avoid if you were building a network today? Explain.
24. Suppose you joined a company that had a WAN composed of SONET, T carrier, and frame relay
services, each selected to match a specific network need for a certain set of circuits. Would you say
this was a well-designed network? Explain.
25. It is said that frame relay services and dedicated-circuit services are somewhat similar from the
perspective of the network designer. Why?
EXERCISES
A. Find out the data rates and costs of T-carrier services in your area.
B. Find out the data rates and costs of packet-switched and dedicated-circuit services in your area.
C. Investigate the WAN of a company in your area. Draw a network map.
D. Using Figure 9-10:
a. Suppose that the example used a layer 2 VPN protocol called L2TP. Draw the messages and the
packets they would contain.


packets they would contain.
b. Suppose that the Web server was an email server. Draw the messages from the email server to
the employee’s computer. Show what packets would be in the message.
c. Suppose the office connects to its ISP using metro Ethernet. What packets would be in the
message from the office router to the ISP?
d. Suppose the employee connects to the ISP using a layer 2 protocol called XYZ. What packets
would be in the message from the employee’s router to the ISP?
E. Select one SDWAN vendor and describe the products it offers.
MINICASES
I. Cookies Are Us Cookies Are Us runs a series of 100 cookie stores across the midwestern United
States and central Canada. At the end of each day, the stores send sales and inventory data to
headquarters, which uses the data to ship new inventory and plan marketing campaigns. The
company has decided to move to a new WAN. What type of a WAN architecture and WAN service
would you recommend? Why?
II. MegaCorp MegaCorp is a large manufacturing firm that operates five factories in Dallas, four
factories in Los Angeles, and five factories in Albany, New York. It operates a tightly connected order


management system that coordinates orders, raw materials, and inventory across all 14 factories.
What type of WAN architecture and WAN service would you recommend? Why?
III. Sunrise Consultancy Sunrise Consultancy is a medium-sized consulting firm that operates 17
offices around the world (Dallas, Chicago, New York, Atlanta, Miami, Seattle, Los Angeles, San Jose,
Toronto, Montreal, London, Paris, Sao Paulo, Singapore, Hong Kong, Sydney, and Mumbai). They
have been using Internet connections to exchange email and files, but the volume of traffic has
increased to the point that they now want to connect the offices via a WAN. Volume is low but
expected to grow quickly once they implement a new knowledge management system. What type of a
WAN topology and WAN service would you recommend? Why?
IV. Cleveland Transit Reread Management Focus 9-1. What other alternatives do you think Cleveland
Transit considered? Why do you think they did what they did?
V. Marietta City Schools Reread Management Focus 9-2. What alternatives do you think Marietta
City Schools considered? Why do you think they did what they did?
TECH UPDATES
In every chapter, we will offer a couple of ideas to investigate. Pick one of these topics to investigate.
Topic A: Password Cracking
Password cracking is done by either repeatedly guessing the password, usually through a computer
algorithm in which the computer tries numerous combinations until the password is successfully
discovered. What are the top three ways password cracking can be done? What tools can one download
from the Internet to do password cracking? How fast are these tools? What are the most common
passwords? Demonstrate in real time two password cracking techniques.
Topic B: Blockchain and Cryptocurrency
Bitcoin is the name of the best-known cryptocurrency, the one for which blockchain technology was


Bitcoin is the name of the best-known cryptocurrency, the one for which blockchain technology was
invented. Blockchain is, quite simply, a digital, decentralized ledger that keeps a record of all transactions
that take place across a peer-to-peer network. This seems like a very good idea, yet banks while open to
blockchain seem to have strong opinions about cryptocurrency. Why do think this is happening? Who is
Satoshi Nakamoto? Investigate the origins of cryptocurrency, its history, and predictions for the future.
Deliverables
Your job will be to prepare a presentation/video (7–10 minutes long) that addresses the topic and
provides information on the following items:
1. Title Slide
2. Short description of the topic
3. Main players—these could be people, processes, software, hardware, etc.
4. How it works—use a lot of pictures and be as technical as possible; create this part as a tutorial so that
your audience can follow along
5. How does it relate to material covered in class so far (and in the future)
6. Additional material/books/links where to learn more about this topic
7. Credits
8. List of References
9. Memo addressed to your professor describing all of the above information
HANDS-ON ACTIVITY 9A


Examining Wide Area Networks
There are millions of WANs in the world. Some are run by common carriers and are available to the
public. Others are private networks run by organizations for their internal use only. Thousands of these
networks have been documented on the Web.
Explore the Web to find networks offered by common carriers and compare the types of network circuits
they have. Now do the same for public and private organizations to see what they have. Figure 9-14 shows
the network map for Zayo, a large common carrier (see www.zayo.com). This figure shows the circuits
running at 100 Gbps that connect major cities in the United States. Zayo has a much larger network that
includes portions that run slower than 100 Gbps, but the network has hundreds of sites and is too hard to
show in one figure.
FIGURE 9-14 100 Gbps network for a U.S. Internet service provider
Deliverable
1. Print or copy two different WAN maps. Does the WAN use only one type of circuits, or are there a mix
of technologies in use?
HANDS-ON ACTIVITY 9B
Examining VPNs with Wireshark
If you want to see VPNs in action and understand how they protect your data as they move over the
Internet, you can sniff your packets with Wireshark. To do this lab, you’ll have to have a VPN you can use.
This will normally be available from your school.
In this exercise, you’ll use Wireshark to sniff the packets with and without the VPN. Before you start,
you’ll need to download and install Wireshark, a packet sniffer software package, on your computer.
1. Start the VPN software on your computer.
2. Start a Web browser (e.g., Internet Explorer) and go to a website.


2. Start a Web browser (e.g., Internet Explorer) and go to a website.
3. Start Wireshark and click on the Capture menu item. This will open up a new menu (see the very top
of Figure 9-15). Click on Interfaces.
4. This will open a new window that will enable you to select which interface you want to capture
packets from. Figure 9-15 shows you the three interfaces I have on my computer. The first interface is


a dial-up modem that I never use. The second interface (labeled “Broadcom NetXtreme Gigabit
Ethernet Driver”) is my Ethernet local area network. It has the IP address of 192.168.1.104. The third
interface (labeled “WN (PPP/SLIP) Interface”) is the VPN tunnel; it has an IP address of
156.56.198.144 and only appears when you start the VPN software and log into a VPN gateway. If you
do a WhoIs on this IP address (see Chapter 5 for WhoIs), you will see that this IP address is owned by
Indiana University. When I logged into my VPN software, it assigned this IP address to the tunnel so
that all IP packets that leave my computer over this tunnel will appear to be from a computer on a
subnet on the Indiana University campus that is connected to the VPN gateway. Your computer will
have different interfaces and IP addresses because your network is different than mine, but the
interfaces should be similar.


FIGURE 9-15 Starting Wireshark
FIGURE 9-16 Viewing encrypted packets
5. Start by capturing packets on your regular Ethernet interface. In my case, this is the second interface.
Click on the Start button beside the Ethernet driver (which is 192.168.1.104 on my computer).
6. Go to your Web browser and use it to load a new Web page, which will cause some packets to move
through your network.
7. A screen similar to that in Figure 9-16 will appear. After a few seconds, go back to Wireshark and click
the Interface menu item and then click Stop.
8. The top window in this figure shows the packets that are leaving the computer through the tunnel.
Click on a packet to look at it. The middle window in this figure shows what’s inside the packet. We
see an Ethernet frame, an IP packet, a UDP datagram, and an Encapsulating Security Payload packet
(which is the ESP packet). Notice that you cannot see anything inside the ESP packet because its


contents are encrypted. All packets in this tunnel will only flow to and from my computer
(192.168.1.104) and the VPN gateway (156.56.245.15).
9. Now we want to look at the packets that are sent by your computer into the VPN tunnel. No one else
can see these packets. You can see them only because they are on your computer and you’re looking at
them as they move from your traditional network software to your VPN software.
10. Click on the Wireshark Capture menu item and click Interfaces.
11. Click on the Start button beside your VPN interface, which in my case in Figure 9-15 is the button in
front of 156.56.198.144.
12. Go to your Web browser and use it to load a new Web page, which will cause some packets to move
through your network.
13. A screen similar to that in Figure 9-17 will appear. After a few seconds, go back to Wireshark and click
the Interface menu item, and then click Stop.
14. The top window in Figure 9-17 shows the packets that are entering the VPN tunnel. Click on an HTTP
packet to look at it (you may need to scroll to find one). The middle window in this figure shows
what’s inside the packet. We see an Ethernet frame, an IP packet, a TCP segment, and an HTTP
request (for a page called/enterprise/ at the server www.tatacommunications.com). We can see these
because they have not yet entered the VPN software to be encrypted. These are the packets that would
normally be sent over the Internet if we have not started the VPN software. Like all normal Internet
messages, they can be read by anyone with sniffer software such as Wireshark.
Deliverables


Deliverables
1. What layer 2, 3, and 4 protocols are used on your network to transmit an HTTP packet without a
VPN?
2. What layer 2, 3, and 4 protocols are used on your network to transmit an HTTP packet when your
VPN is active?
3. Look inside the VPN tunnel as was done in step 14. What layer 2, 3, and 4 protocols are used inside
the encrypted packet?
HANDS-ON ACTIVITY 9C
Examining VPNs with Tracert
Tracert is a useful tool for seeing how VPNs affect routing. To do this lab, you’ll have to have a VPN you
can use. This will normally be available from your school.
Tracert is a simple command that comes preinstalled on all Windows and Mac computers. Tracert enables
you to see the route that an IP packet takes as it moves over the Internet from one computer to another.
Do this activity when you are not on campus.
Tracert is a command line command, so you first need to start the CMD window. Click Start, then Run,
and then type CMD and press enter. This will open the command window, which is usually a small
window with a black background. You can change the size and shape of this window, but it is not as
flexible as a usual window.
We will first trace the route from your computers to two other computers without using the VPN. So make
sure your VPN is not connected.
We’ll start by tracing the route from your computer to a computer on the campus of the site you VPN into.
In my case, I VPN into my university, which is Indiana University. I can choose to trace the route to any
computer on campus. I’ll choose our main Web server (www.iu.edu). At the command prompt, type


tracert and the URL of a computer on your campus.
The top half of Figure 9-18 shows the route from my computer to www.iu.edu. There are 18 hops and it
takes about 35 ms. The first hop does not report information because this feature is turned off in the
router at my house for security reasons. You can see that my ISP is Comcast (hop 6). If you compare this


to the tracert at the end of Chapter 5, you’ll notice that my ISP changed (and thus the route into the
Internet changed) between the time I wrote Chapter 5 and this chapter; Comcast bought Insight in my
town of Bloomington, Indiana.


FIGURE 9-17 Packets that enter the VPN tunnel
FIGURE 9-18 Tracert without a VPN
Now trace the route from your computer to another computer on the Internet. The bottom of Figure 9-18
shows the route from my computer to www.google.com. There are 17 hops, and it takes about 35 ms.
You’ll see that the routes to IU and Google are the same until step 6, and then they diverge.
Next we want to see what happens when you have a VPN connection. Start your VPN software and
connect into the VPN gateway at your school.
Trace the route from your computer to the same computer as in step 3. At the command prompt, type
tracert and the URL of a computer on your campus.


The top half of Figure 9-19 shows the route from my computer to www.iu.edu. There are two hops and it
takes about 35 ms. The VPN is in operation and is transparent to my networking software, which thinks it
is on the same subnet as the VPN gateway. Therefore, it thinks there is just one hop from my computer to
the subnet’s gateway, the VPN gateway. You’ll see that the time is still about 35 ms, so the packet is still
traveling the same 18 hops to get there; it’s just that the tracert packet is encapsulated and doesn’t see all
the hops through the VPN tunnel.
Now do a tracert to the same computer as you did in step 5. The bottom of Figure 9-19 shows the route
from my computer to www.google.com. There are nine hops and it takes about 43 ms. Of course, the first
hop is really 17 hops and 35 ms; this is again hidden from view. As we explained in the text, when the VPN
is connected, all packets go from your computer to the VPN gateway on your campus before being routed
to the final destination. You can see from this figure that this adds additional hops and time to packets
that are not going to your campus, compared to not using the VPN. You can also see that once the packets
leave the VPN gate-way, they are ordinary packets; they are no longer encrypted and protected from view.
FIGURE 9-19 Tracert with a VPN
The VPN provides security only to and from the VPN gateway on your campus, not beyond it. Therefore,
you should use your VPN if you have security concerns to and from campus (e.g., someone sniffing your
packets). But if most of your work is going to be off campus, then the VPN increases the time it takes to


send and receive packets and only provides security protection over the last section from your computer to
your school’s campus. Using the VPN may not be worth the additional response time it imposes on you.
Deliverables
1. What are the routes from your computer to your campus Web server with and without the VPN?
2. What are the routes from your computer to www.google.com with and without the VPN?
HANDS-ON ACTIVITY 9D
Apollo Residence Network Design


Apollo is a luxury residence hall that will serve honor students at your university. We described the
residence in Hands-On Activities at the end of Chapters 7 and 8.
The university has recognized that work is going virtual, with more and more organizations building
virtual teams with members drawn from different parts of the organization who work together from
different cities, instead of meeting face-to-face. It has joined together with five universities across the
United States and Canada (located in Boston, Los Angeles, Atlanta, Dallas, and Toronto) to form a
consortium of universities that will build virtual team experiences into their programs.
The universities have decided to start with their honors programs, and each has created a required course
that involves its students working with students at the other universities to complete a major project. The
students will use collaboration software such as email, chat, Google Docs, Skype, and WebEx to provide
text, audio, and video communication. These tools can be used over the Internet, but to ensure that there
are no technical problems, the universities have decided to build a separate private WAN that connects
the six honors residences on each university campus (in the five cities listed, plus your university).
WAN Service Data Rate Monthly Cost
T1
1.5 Mbps
$400
T3
45 Mbps
$1,500
SONET OC-1
52 Mbps
$1,800
SONET OC-3
155 Mbps
$2,800
MPLS
1.5 Mbps
$450
MPLS
45 Mbps
$1,700
MPLS
52 Mbps
$2,000
MPLS
155 Mbps
$3,000
Ethernet
1 Mbps
$300
Ethernet
5 Mbps
$400
Ethernet
10 Mbps
$500
Ethernet
20 Mbps
$700
Ethernet
50 Mbps
$900
Ethernet
100 Mbps


20 Mbps
$700
Ethernet
50 Mbps
$900
Ethernet
100 Mbps
$1,500
Ethernet
200 Mbps
$2,500
Internet VPN
25 Mbps
$75
Internet VPN
50 Mbps
$100
Internet VPN
100 Mbps
$125
Internet VPN
150 Mbps
$150
Internet VPN
200 Mbps
$175
FIGURE 9-20 Monthly costs for WAN services
Deliverable
Your team was hired to design the WAN for this six-university residence network. Figure 9-20 provides a
list of possible WAN services you can use. Specify what services you will use at each location and how the
six locations will be connected. Provide the estimated monthly operating cost of the network.


CHAPTER 10
THE INTERNET
This chapter examines the Internet in more detail to explain how it works and why it is a network of
networks. The chapter also examines Internet access technologies, such as DSL and cable modem, as well
as the possible future of the Internet.
OBJECTIVES
Understand the overall design of the Internet
Be familiar with DSL, cable modem, and fiber to the home
Be familiar with possible future directions of the Internet
OUTLINE
10.1 Introduction
10.2 How the Internet Works
10.2.1 Basic Architecture
10.2.2 Connecting to an ISP
10.2.3 The Internet Today
10.3 Internet Access Technologies
10.3.1 Digital Subscriber Line
10.3.2 Cable Modem
10.3.3 Fiber to the Home
10.4 The Future of the Internet
10.4.1 Internet Governance
10.4.2 Building the Future
10.5 Implications for Cyber Security
Summary
10.1 INTRODUCTION
The Internet is the most used network in the world, but it is also one of the least understood. There is no
one network that is the Internet. Instead, the Internet is a network of networks—a set of separate and
distinct networks operated by various national and state government agencies, nonprofit organizations,
and for-profit corporations. The Internet exists only to the extent that these thousands of separate
networks agree to use Internet protocols and to exchange data packets among one another.
When you are on the Internet, your computer (iPad, smartphone, etc.) is connected to the network of an
Internet service provider (ISP) that provides network services for you. Messages flow between your client
device and the ISP’s network. Suppose you request a Web page on CNN.com, a website that is outside of
your ISP’s network. Your HTTP request flows from your device through your ISP’s network and through


your ISP’s network. Your HTTP request flows from your device through your ISP’s network and through
other networks that link your ISP’s network to the network of the ISP that provides Internet services for
CNN. Each of these networks is separate and charges its own customers for Internet access but permits
traffic from other networks to flow through them. In many ways, the Internet is like the universe (see
Figure 10-1). Each of us works in our own planet with its own rules (i.e., ISP) but each planet is


interconnected with all the others.
The Internet is simultaneously a strict, rigidly controlled club in which deviance from the rules is not
tolerated and a freewheeling, open marketplace of ideas. All networks that connect to the Internet must
rigidly conform to an unyielding set of standards for the transport and network layers; without these
standards, data communication would not be possible. At the same time, content and new application
protocols are developed freely and without restriction, and quite literally anyone in the world is allowed to
comment on proposed changes.
FIGURE 10-1 The Internet is a lot like the universe—many independent systems linked together
Source: NASA.
In this chapter, we first explain how the Internet really works and look inside the Seattle Internet
exchange point, at which more than 150 separate Internet networks meet to exchange data. We then turn
our attention to how you as an individual can access the Internet and what the Internet may look like in
the future. Many experts have predicted we will have high-speed wireless Internet access in a few years.
However, none of these predictions have come to pass. We may have wireless Internet access in our
homes, but for the foreseeable future, Internet access to our homes will require a wire.


10.2 HOW THE INTERNET WORKS
10.2.1 Basic Architecture
The Internet is hierarchical in structure. At the top are the very large national Internet service
providers (ISPs), such as AT&T and Sprint, that are responsible for large Internet networks. These
national ISPs, called tier 1 ISPs, connect together and exchange data at Internet exchange points
(IXPs) (Figure 10-2). For example, AT&T, Sprint, Verizon, Qwest, Level 3, and Global Crossing are all
tier 1 ISPs that have a strong presence in North America.
In the early 1990s, when the Internet was still primarily run by the U.S. National Science Foundation
(NSF), the NSF established four main IXPs in the United States to connect the major tier 1 ISPs (the 1990s
name for an IXP was network exchange point or NAP). When the NSF stopped funding the Internet, the
companies running these IXPs began charging the ISPs for connections, so today the IXPs in the United
States are all not-for-profit organizations or commercial enterprises run by various common carriers such
as AT&T and Sprint. As the Internet has grown, so too has the number of IXPs; today there are several
dozen IXPs in the United States with more than a hundred more spread around the world.
IXPs were originally designed to connect only large tier 1 ISPs. These ISPs in turn provide services for
their customers and also to regional ISPs (sometimes called tier 2 ISPs) such as Comcast or BellSouth.
These tier 2 ISPs rely on tier 1 ISPs to transmit their messages to ISPs in other countries. Tier 2 ISPs, in
turn, provide services to their customers and to local ISPs (sometimes called tier 3 ISPs) who sell


Internet access to individuals. As the number of ISPs grew, smaller IXPs emerged in most major cities to
link the networks of these regional ISPs.
FIGURE 10-2 Basic Internet architecture. ISP = Internet service provider; IXP = Internet exchange point
Because most IXPs and ISPs are now run by commercial firms, many of the early restrictions on who
could connect to whom have been lifted. Most now openly solicit business from all tiers of ISPs and even
large organizations. Regional and local ISPs often will have several connections into other ISPs to provide


backup connections in case one Internet connection fails. In this way, they are not dependent on just one
higher-level ISP.
In general, ISPs at the same level do not charge one another for transferring messages they exchange.
That is, a national tier 1 ISP does not charge another national tier 1 ISP to transmit its messages. This is
called peering. Figure 10-2 shows several examples of peering. It is peering that makes the Internet work
and that has led to the belief that the Internet is free. This is true to some extent, but higher-level ISPs
normally charge lower-level ISPs to transmit their data (e.g., a tier 1 will charge a tier 2 and a tier 2 will
charge a tier 3). And, of course, any ISP will charge individuals like us for access!
In October 2005, an argument between two national ISPs shut down 45 million websites for a week. The
two ISPs had a peering agreement, but one complained that the other was sending it more traffic than it
should, so it demanded payment and stopped accepting traffic, leaving large portions of the network
isolated from the rest of the Internet. The dispute was resolved, and they began accepting traffic from
each other and the rest of the Internet again.
In Figure 10-2, each of the ISPs is an autonomous system, as defined in Chapter 5. Each ISP is
responsible for running its own interior routing protocols and for exchanging routing information via the
Border Gateway Protocol (BGP) exterior routing protocol (see Chapter 5) at IXPs and at any other
connection points between individual ISPs.
10.2.2 Connecting to an ISP
Each of the ISPs is responsible for running its own network that forms part of the Internet. ISPs make
money by charging customers to connect to their part of the Internet. Local ISPs charge individuals for


money by charging customers to connect to their part of the Internet. Local ISPs charge individuals for
access, whereas national and regional ISPs (and sometimes local ISPs) charge larger organizations for
access.
Each ISP has one or more points of presence (POP). A POP is simply the place at which the ISP
provides services to its customers. To connect into the Internet, a customer must establish a circuit from
his or her location into the ISP POP. For individuals, this is often done using a DSL modem or cable
modem, as we discuss in the next section. Companies can use these same technologies, or they can use the
WAN technologies we discussed in the previous chapter. Once connected, the user can begin sending
TCP/IP packets from his or her computer to the POP.
MANAGEMENT FOCUS 10-1
Inside the Seattle Internet Exchange Point
The Seattle Internet Exchange (SIX) was established as a nonprofit organization in April 1997 by two
small ISPs with offices in Seattle’s Westin Building. The ISPs had discovered that to send data to
each other’s network in the same building, their data traveled to Texas and back. They decided to
peer and installed a 10Base-T Ethernet hub connecting their two networks so that traffic flowed
between them much more quickly.
In June 1997, a third small ISP joined and connected its network into the hub. Gradually word
spread and other small ISPs began to connect. In May 1998, the first tier 1 ISP connected its
network, and traffic grew enough so that the old 10 Mbps hub was replaced by a 10/100 Ethernet
switch. As an aside, we’ll note that the switch you have in your house or apartment today probably
has more capacity than this switch. In February 1999, Microsoft connected its network, and traffic


took off again. In September 2001, the 10/100 Ethernet switch was replaced by a 10/100/1000
Ethernet switch.
The current configuration is a set of two large switches in the Westin building and two smaller
switches (which are still immense by corporate standards) in nearby buildings connected together
with Ethernet circuits running at up to 800 Gbps. There are another eight GbE switches located
elsewhere in Seattle and other cities in the United States.
Today, SIX offers several types of Ethernet connections to its clients. The first 1 Gbps connection has


a one-time connection fee of $100 with subsequent 1 Gbps connections costing a one-time fee of
$1,500. Faster connections have a monthly fee (10 Gbps costs $180/month and 100 Gbps
$900/month). Of course, you have to pay a common carrier to provide a network circuit into the
Westin Building and then pay the Westin Building a small fee to run a fiber cable from the building’s
MDF to the SIX network facility. Traffic averages between 800 Gbps and 1,5 Tbps across the SIX
network.
More than 150 ISPs (e.g., AT&T, Verizon, Bell Canada, and Saskatchewan Telecommunications) and
corporations (e.g., Akamai, Google, Facebook, and Yahoo) are members of SIX. About half of the
members are open to peering with anyone who joins SIX. The rest, mostly tier 1 ISPs and well-
known corporations, are selective or restrictive in their peering agreements, which means that they
are already well connected into the Internet and want to ensure that any new peering agreements
make business sense.
Source: Adapted from Settle Internet Exchange. www.seattleix.net.
It is important to note that the customer must pay for both Internet access (paid to the ISP) and for the
circuit connecting from the customer’s location to the POP (usually paid to the local exchange carrier [e.g.,
BellSouth and AT&T], but sometimes the ISP also can provide circuits). For a T1 connection, for example,
a company might pay the local exchange carrier $250 per month to provide the T1 circuit from its offices
to the ISP POP and also pay the ISP $250 per month to provide the Internet access.
An ISP POP is connected to the other POPs in the ISP’s network. Any messages destined for other


customers of the same ISP would flow within the ISP’s own network. In most cases, the majority of
messages entering the POP are sent outside of the ISP’s network and thus must flow through the ISP’s
network to the nearest IXP and, from there, into some other ISP’s network.
This can be less efficient than one might expect. For example, suppose you are connected to the Internet
via a local tier 3 ISP in Minneapolis and request a Web page from another organization in Minneapolis. A
short distance, right? Maybe not. If the other organization uses a different local tier 3 ISP, which, in turn,
uses a different regional tier 2 ISP for its connection into the Internet, the message may have to travel all
the way to the nearest IXP, which could be in Chicago, Dallas, or New York, before it can move between
the two separate parts of the Internet.
10.2.3 The Internet Today
Figure 10-3 shows the North American backbone of a major ISP as it existed while we were writing this
book; it will have changed by the time you read this. As you can see, it has many Internet circuits across
the United States and Canada. Many interconnect in Chicago, where many ISPs connect into the Chicago
IXP. It also connects into major IXPs in Reston, Virginia; Miami; Los Angeles; San Jose; Palo Alto;
Vancouver; Calgary; Toronto; and Montreal.
Today, the backbone circuits of the major U.S. national ISPs operate at SONET OC-192 (10 Gbps). A few
are now experimenting with OC-768 (80 Gbps), and several are in the planning stages with OC-3072 (160
Gbps). This is good because the amount of Internet traffic has been growing rapidly.
As traffic increases, ISPs can add more and faster circuits relatively easily, but where these circuits come


As traffic increases, ISPs can add more and faster circuits relatively easily, but where these circuits come
together at IXPs, bottlenecks are becoming more common. Network vendors such as Cisco and Juniper
are making larger and larger switches capable of handling these high-capacity circuits, but it is a daunting
task. When circuit capacities increase by 100%, switch manufacturers also must increase their capacities
by 100%. It is simpler to go from a 622 Mbps circuit to a 10 Gbps circuit than to go from a 20 Gbps switch
to a 200 Gbps switch.


FIGURE 10-3 A typical Internet backbone of a major ISP
10.3 INTERNET ACCESS TECHNOLOGIES
There are many ways in which individuals and organizations can connect to an ISP. Most individuals use
DSL or cable modem. As we discussed in the preceding section, many organizations lease T1, T3, or
Ethernet circuits into their ISPs. DSL and cable modem technologies are commonly called broadband
technologies because they provide high-speed communications.
It is important to understand that Internet access technologies are used only to connect from one location
to an ISP. Unlike the WAN technologies in the previous chapter, Internet access technologies cannot be
used for general-purpose networking from any point to any point. In this section, we discuss three
principal Internet access technologies (DSL, cable modem, and fiber to the home). Of course, many users
connect to the Internet using Wi-Fi on their laptops from public access points in coffee shops, hotels, and
airports. Since we discussed Wi-Fi in Chapter 7, we won’t repeat it here.
10.3.1 Digital Subscriber Line
Digital subscriber line (DSL) is a family of point-to-point technologies designed to provide high-
speed data transmission over traditional telephone lines. The reason for the limited capacity on
traditional telephone circuits lies with the telephone and the switching equipment at the end offices. The
actual cable in the local loop from a home or office to the telephone company end office is capable of
providing much higher data transmission rates. So DSL usually requires just changing the telephone
equipment, not rewiring the local loop, which is what has made it so attractive.
Architecture DSL uses the existing local loop cable but places different equipment on the customer
premises (i.e., the home or office) and in the telephone company end office. The equipment that is
installed at the customer location is called the customer premises equipment (CPE). Figure 10-4


shows one common type of DSL installation. (There are other forms.) The CPE in this case includes a line
splitter that is used to separate the traditional voice telephone transmission from the data transmissions.
The line splitter directs the telephone signals into the normal telephone system so that if the DSL
equipment fails, voice communications are unaffected.
The line splitter also directs the data transmissions into a DSL modem, which is sometimes called a DSL
router. This is both a modem and a frequency division multiplexing (FDM) multiplexer (see Chapter 3).


The DSL modem produces Ethernet packets so it can be connected directly into a computer or to a router
and can serve the needs of a small network. Most DSL companies targeting home users combine all of
these devices (and a wireless access point) into one device so that consumers just have to install one box,
rather than separate line splitters, modems, routers, switches, and access points.
Figure 10-4 also shows the architecture within the local carrier’s end office (i.e., the telephone company
office closest to the customer premises). The local loops from many customers enter and are connected to
the main distribution facility (MDF). The MDF works similarly to the CPE line splitter; it splits the
voice traffic from the data traffic and directs the voice traffic to the voice telephone network and the data
traffic to the DSL access multiplexer (DSLAM). The DSLAM demultiplexes the data streams and
converts them into digital data, which are then distributed to the ISPs. Some ISPs are collocated, in that
they have their POPs physically in the telephone company end offices. Other ISPs have their POPs located
elsewhere.
Types of DSL
There are many different types of DSL. The most common type today is asymmetric DSL (ADSL).
ADSL uses FDM (see Chapter 3) to create three separate channels over the one local loop circuit. One
channel is the traditional voice telephone circuit. A second channel is a relatively high-speed data channel
downstream from the carrier’s end office to the customer. The third channel is a slightly slower data
channel upstream from the customer to the carrier’s end office. ADSL is called asymmetric because its two
data channels have different speeds. Each of the two data channels is further multiplexed using time
division multiplexing so they can be subdivided.


division multiplexing so they can be subdivided.
FIGURE 10-4 DSL architecture. DSL = digital subscriber line; ISP = Internet service provider; POP =
point of presence
The size of the two digital channels depends on the distance from the CPE to the end office. The shorter
the distance, the higher the speed, because with a shorter distance, the circuit suffers less attenuation and


higher-frequency signals can be used, providing a greater bandwidth for modulation. Figure 10-5 lists the
common types of DSL, although some providers offer faster speeds, such as 100 Mbps down and 20 Mbps
up.
10.3.2 Cable Modem
One alternative to DSL is the cable modem, a digital service offered by cable television companies. The
Data over Cable Service Interface Specification (DOCSIS) standard is the dominant one. DOCSIS
is not a formal standard but is the one used by most vendors of hybrid fiber coax (HFC) networks (i.e.,
cable networks that use both fiber-optic and coaxial cable). As with DSL, these technologies are changing
rapidly.
FIGURE 10-5 Some typical digital subscriber line data rates
Architecture
Cable modem architecture is very similar to DSL—with one very important difference. DSL is a point-to-
point technology, whereas cable modems use shared multipoint circuits. With cable modems, each user
must compete with other users for the available capacity. Furthermore, because the cable circuit is a
multipoint circuit, all messages on the circuit go to all computers on the circuit. If your neighbors were
hackers, they could use pocket sniffers such as Wireshark (see Chapter 4) to read all messages that travel
over the cable, including yours.
Figure 10-6 shows the most common architecture for cable modems. The cable TV circuit enters the
customer premises through a cable splitter that separates the data transmissions from the TV
transmissions and sends the TV signals to the TV network and the data signals to the cable modem. The
cable modem (both a modem and frequency division multiplexer) translates from the cable data into
Ethernet packets, which then are directed into a computer to a router for distribution in a small network.


As with DSL, cable modem companies usually combine all of these separate devices into one or two
devices to make it easier for the home consumer to install.
The cable TV wiring entering the customer premises is a standard coaxial cable. A typical segment of cable
is shared by anywhere from 300 to 1,000 customers, depending on the cable company that installed the
cable. These 300–1,000 customers share the available data capacity, but, of course, not all customers who
have cable TV will choose to install cable modems. This coax cable runs to a fiber node, which has an
optical-electrical (OE) converter to convert between the coaxial cable on the customer side and fiber-
optic cable on the cable TV company side. Each fiber node serves as many as half a dozen separate coaxial
cable runs.


FIGURE 10-6 Cable modem architecture. ISP = Internet service provider; POP = point of presence
The fiber nodes are in turn connected to the cable company distribution hub (sometimes called a
headend) through two separate circuits: an upstream circuit and a downstream circuit. The upstream
circuit, containing data traffic from the customer, is connected into a cable modem termination
system (CMTS). The CMTS contains a series of cable modems/multiplexers and converts the data from
cable modem protocols into protocols needed for Internet traffic, before passing them to a router
connected to an ISP POP. Often, the cable company is a regional ISP, but sometimes it just provides
Internet access to a third-party ISP.
The downstream circuit to the customer contains both ordinary video transmissions from the cable TV
video network and data transmissions from the Internet. Downstream data traffic enters the distribution
hub from the ISP POP and is routed through the CMTS, which produces the cable modem signals. This
traffic is then sent to a combiner, which combines the Internet data traffic with the ordinary TV video
traffic and sends it back to the fiber node for distribution.
Types of Cable Modems
The DOCSIS standard provides many types of cable modems. The maximum speed is about 200 Mbps
downstream and about 200 Mbps upstream, although most cable TV companies provide at most 50 Mbps
downstream and 10 Mbps upstream. Cable modems can be configured to limit capacity, so the most
common speeds offered by most cable providers range from 10 to 75 Mbps downstream and from 1 to 15
Mbps upstream. Of course, this capacity is shared, so an individual user will only see this when no other
computers on his or her segment are active.
MANAGEMENT FOCUS 10-2
Internet Speed Test


The speed of your Internet connection depends on many things, such as your computer’s settings,
the connection from your computer to your ISP, and the connections your ISP has into the Internet.
Many Internet sites enable you to test how fast your Internet connection actually is. Our favorite is
speedtest.net
10.3.3 Fiber to the Home
Fiber to the home (FTTH) is exactly what it sounds like: running fiber-optic cable into the home. The
traditional set of hundreds of copper telephone lines that run from the telephone company switch office is
replaced by one fiber-optic cable that is run past each house or office in the neighborhood. Data are
transmitted down the signal fiber cable using wavelength division multiplexing (WDM), providing
hundreds or thousands of separate channels. FTTH is only available to about a quarter of the homes in the
United States and Canada, but it is growing.
Architecture
FTTH architecture is very similar to DSL and cable modem. At each subscriber location, an optical
network unit (ONU) (also called an optical network terminal [ONT]) acts like a DSL modem or cable
modem and converts the signals in the optical network into an Ethernet format. The ONU acts as an
Ethernet switch and can also include a router. FTTH is a dedicated point-to-point service like DSL, not a
shared multipoint service like cable modem.
Providers of fiber to the home can use either active optical networking or passive optical networking to
connect the ONU in the customer’s home. Active networking means that the optical devices require
electrical power and works in much the same way as traditional electronic switches and routers. Passive
optical networking devices require no electrical current and thus are quicker and easier to install and
maintain than traditional electrical-based devices, but because they are passive, the optical signal fades
quickly, giving a maximum range of about 10 miles.


quickly, giving a maximum range of about 10 miles.
Types of FTTH
There are many types of FTTH, and because FTTH is a new technology, these types are likely to evolve as
FTTH enters the market and becomes more widely adopted. Most common carriers offer 1 Gbps services—
that is 1 Gbps both up and down.
10.4 THE FUTURE OF THE INTERNET
10.4.1 Internet Governance
Because the Internet is a network of networks, no one organization operates the Internet. The closest
thing the Internet has to an owner is the Internet Society (internetsociety.org). The Internet Society is
an open-membership professional society with about 150 organizational members and 65,000 individual
members in more than 100 countries, including corporations, government agencies, and foundations that
have created the Internet and its technologies. Because membership is open, anyone, including students,
is welcome to join and vote on key issues facing the Internet.
Its mission is to ensure “the open development, evolution and use of the Internet for the benefit of all
people throughout the world.” It works in three general areas: public policy, education, and standards. In
terms of public policy, the Internet Society participates in the national and international debates on
important issues such as censorship, copyright, privacy, and universal access. It delivers training and
education programs targeted at improving the Internet infrastructure in developing nations. Its most
important activity lies in the development and maintenance of Internet standards. It works through four
interrelated standards bodies: the Internet Engineering Task Force, Internet Engineering Steering Group,
Internet Architecture Board, and Internet Research Task Force.
The Internet Engineering Task Force (IETF) (www.ietf.org) is a large, open international
community of network designers, operators, vendors, and researchers concerned with the evolution of the


community of network designers, operators, vendors, and researchers concerned with the evolution of the
Internet architecture and the smooth operation of the Internet. The IETF works through a series of


working groups, which are organized by topic (e.g., routing, transport, and security). The request for
comments (RFCs) that form the basis for Internet standards are developed by the IETF and its working
groups.
Closely related to the IETF is the Internet Engineering Steering Group (IESG). The IESG is
responsible for technical management of IETF activities and the Internet standards process. It
administers the process according to the rules and procedures that have been ratified by the Internet
Society trustees. The IESG is directly responsible for the actions associated with entry into and movement
along the Internet “standards track,” including final approval of specifications as Internet standards. Each
IETF working group is chaired by a member of the IESG.
Whereas the IETF develops standards and the IESG provides the operational leadership for the IETF
working groups, the Internet Architecture Board (IAB) provides strategic architectural oversight.
The IAB attempts to develop conclusions on strategic issues (e.g., top-level domain names, use of
international character sets) that can be passed on as guidance to the IESG or turned into published
statements or simply passed directly to the relevant IETF working group. In general, the IAB does not
produce polished technical proposals but rather tries to stimulate action by the IESG or the IETF that will
lead to proposals that meet general consensus. The IAB appoints the IETF chairperson and all IESG
members, from a list provided by the IETF nominating committee. The IAB also adjudicates appeals when
someone complains that the IESG has failed.
The Internet Research Task Force (IRTF) operates much like the IETF: through small research
groups focused on specific issues. Whereas IETF working groups focus on current issues, IRTF research


groups work on long-term issues related to Internet protocols, applications, architecture, and technology.
The IRTF chairperson is appointed by the IAB.
TECHNICAL FOCUS 10-1
Registering an Internet Domain Name
Until the 1990s, there was only a moderate number of computers on the Internet. One organization
was responsible for registering domain names (sets of application layer addresses) and assigning IP
addresses for each top-level domain (e.g., .COM). Network Solutions, for example, was the sole
organization responsible for domain name registrations for the .COM, .NET, and .ORG domains. In
October 1998, the Internet Corporation for Assigned Names and Numbers (ICANN) was
formed to assume responsibility for the IP address space and domain name system management.
In spring 1999, ICANN established the Shared Registration System (SRS) that enabled many
organizations to perform domain name registration and address assignment using a shared
database. More than 1,000 organizations are now accredited by ICANN as registrars and are
permitted to use the SRS. Each registrar has the right to assign names and addresses in one or more
top-level domains. For a list of registrars and the domains they serve, see www.internic.com.
If you want to register a new domain name and obtain an IP address, you can contact any accredited
registrar for that top-level domain. One of the oldest privately operated registrars is register.com.
Each registrar follows the same basic process for registering a name and assigning an address, but
each may charge a different amount for its services. To register a name, you must first check to see if
it is available (i.e., that no one else has registered it). If the name has already been registered, you
can find out who owns it and perhaps attempt to buy it from the owner.


can find out who owns it and perhaps attempt to buy it from the owner.
If the domain name is available, you will need to provide the IP address of the DNS server that will
be used to store all IP addresses in the domain. Most large organizations have their own DNS
servers, but small companies and individuals often use the DNS of their ISP.
10.4.2 Building the Future
The Internet is changing. New applications and access technologies are being developed at lightning pace.
But these innovations do not change the fundamental structure of the Internet. It has evolved more slowly


because the core technologies (TCP/IP) are harder to change gradually; it is difficult to change one part of
the Internet without changing the attached parts.
Many organizations in many different countries are working on dozens of different projects in an attempt
to design new technologies for the next version of the Internet. The two primary American projects
working on the future Internet got started at about the same time in 1996. The U.S. National Science
Foundation provided $100 million to start the Next Generation Internet® (NGI) program, and 34
universities got together to start what turned into Internet2®. Internet2 comprises about 400
universities, corporations, government agencies, and organizations from more than 100 countries with a
primary focus to develop advanced networking as well as other innovative technologies for research and
education.
Internet2® Figure 10-7 shows the major high-speed circuits in the Internet2® network. All the circuits in
are at least OC-192 (10 Gbps). Many circuits are 100 Gbps, with 1 Tbps circuits being tested.
The access points are called gigapops, so named because they provide a POP at gigabit speeds. Gigapops
also usually provide a wider range of services than traditional IXPs, which are primarily just data
exchange points. All of the gigapops provide connections at layer 1, the physical layer. Many of the
gigapops also provide layer 2 connections (usually Ethernet) and layer 3 connections (usually IPv6).
Typical connection fees range from $6,000 per year for 1 Gbps to $165,000 per year for 100 Gbps.
Besides providing very-high-speed Internet connections, these networks are intended to experiment with
new protocols that 1 day may end up on the future Internet. For example, most circuits run IPv6 as the


primary network layer protocol rather thanInternet2®IPv4. Most are also working on new ways to provide
quality of service (QoS) and multicasting. is also developing new applications for a high-speed Internet,
such as tele-immersion and videoconferencing.
FIGURE 10-7 Internet2 network map
Reproduced by permission of Internet2®
10.5 IMPLICATIONS FOR CYBER SECURITY


As Internet speeds have gotten faster for the average user who has a DSL or cable modem connection in
his or her house, security at home has become increasingly important. The irony is that attackers break
into home computers not to attack them, but to use them to attack others in what is called a distributed
denial-of-service attack (DDOS). As we will discuss in the next chapter, the attacker plants DDOS software
on an unsuspecting user’s home computer. Once the attacker has installed it on thousands of computers,
he activates all of them and they begin sending billions of messages to the website the attacker has
targeted. This site is so flooded with messages that normal users can’t access it, and it becomes
unavailable. And, of course, the user’s own Internet is so flooded with outgoing messages that he or she
can’t use the Internet, although that is just collateral damage to the attacker.
DDOS software is most often contained in a video, a song, or a free application that the unsuspecting user
has downloaded. However, as the Internet of Things is growing and more consumer products are
becoming “smart” (e.g., TVs, thermostats, light bulbs), attackers are beginning to shift their attacks to
these devices because users often don’t bother to update them as regularly as they update their computers
or mobile phones. Typically, attackers find a bug (called a security hole) in a commonly used device such
as a smart TV. They write software to search the Internet to find these devices and use the bug to trick the
device into accepting the DDOS software.
Interestingly, university students who live in dorms are a prime target. Most universities have very large
Internet connections, so that a DDOS attack launched from within a university can do a lot more damage
than one launched from a home. There are many computers and smart devices in university dorms, often


more than you would find in a typical classroom building, so it is a target-rich environment. Students
usually are not as careful about security as professional university staff, so their devices are often softer
targets than university-managed computers.
SUMMARY
How the Internet Works The Internet is a set of separate networks, ranging from large national
ISPs to midsize regional ISPs to small local ISPs, that connect with one another at IXPs. IXPs charge
the ISPs to connect, but similar-sized ISPs usually do not charge each other to exchange data. Each
ISP has a set of POP through which it charges its users (individuals, businesses, and smaller ISPs) to
connect to the Internet. Users connect to a POP to get access to the Internet. This connection may be
via DSL, cable modem, or a WAN circuit such as T1 or Ethernet.
DSL DSL enables users to connect to an ISP POP over a standard point-to-point telephone line. The
customer installs a DSL modem that connects via Ethernet to his or her computer system. The
modem communicates with a DSLAM at the telephone company office, which sends the data to the
ISP POP. ADSL is the most common type of DSL and often provides 24 Mbps downstream and 3
Mbps upstream.
Cable Modem Cable modems use a shared multipoint circuit that runs through the cable TV cable.
They also provide the customer with a modem that connects via Ethernet to his or her computer
system. The modem communicates with a CMTS at the cable company office, which sends the data to
the ISP POP. The DOCSIS standard is the dominant standard, but there are no standard data rates
today. Typical downstream speeds range between 10 and 75 Mbps, and typical upstream speeds range
between 1 and 15 Mbps.


between 1 and 15 Mbps.
Fiber to the Home FTTH is a new technology that is not widely implemented. It uses fiber-optic
cables to provide high-speed data services (e.g., 100 Mbps to 1 Gbps) to homes and offices.
The Future of the Internet The closest the Internet has to an owner is the Internet Society, which
works on public policy, education, and Internet standards. Standards are developed through four
related organizations governed by the Internet Society. The IETF develops the actual standards
through a series of working groups. The IESG manages IETF activities. The IAB sets long-term
strategic directions, and the IRTF works on future issues through working groups in much the same
way as the IETF. Many different organizations are currently working on the next generation of the
Internet, including Internet2.


KEY TERMS
asymmetric DSL (ADSL)
autonomous system
broadband technologies
cable modem
cable modem termination system (CMTS)
customer premises equipment (CPE)
Data over Cable Service Interface Specification (DOCSIS)
digital subscriber line (DSL)
distribution hub
DSL access multiplexer (DSLAM)
DSL modem
fiber to the home (FTTH)
gigapop
hybrid fiber coax (HFC)
Internet Architecture Board (IAB)
Internet Corporation for Assigned Names and Numbers (ICANN)
Internet Engineering Steering Group (IESG)
Internet Engineering Task Force (IETF)
Internet exchange point (IXP)
Internet Research Task Force (IRTF)
Internet service provider (ISP)
Internet Society
Internet2®
line splitter
local loop
main distribution facility (MDF)
national ISPs
Next Generation Internet (NGI)
optical-electrical (OE) converter
optical network unit (ONU)
peering
point of presence (POP)
regional ISP
request for comment (RFC)
tier 1 ISP
tier 2 ISP
tier 3 ISP


QUESTIONS
1. What is the basic structure of the Internet?
2. Explain how the Internet is a network of networks.
3. What is an IXP?
4. What is a POP?
5. Explain one reason why you might experience long response times in getting a Web page from a
server in your own city.
6. What types of circuits are commonly used to build the Internet today? Internet2® What type of
circuits are commonly used to build?
7. Compare and contrast cable modem and DSL.
8. Explain how DSL works.
9. How does a DSL modem differ from a DSLAM?
10. Explain how ADSL works.
11. Explain how a cable modem works.
12. What is an OE converter? A CMTS?
13. Which is better, cable modem or DSL? Explain.
14. Explain how FTTH works.
15. What are some future technologies that might change how we access the Internet?
16. What are the principal organizations responsible for Internet governance, and what do they do?
17. How is the IETF related to the IRTF?
18. What is the principal American organization working on the future of the Internet?
19. What is Internet2®?
20. What is a gigapop?
21. Today, there is no clear winner in the competition for broadband Internet access. What technology or
technologies do you think will dominate in 2 years’ time? Why?
22. Would you be interested in subscribing to 1 Gbps FTTH (i.e., 1 Gbps both up and down) for a monthly
price of $150? Why or why not?
23. Many experts predicted that small, local ISPs would disappear as regional and national ISPs began
offering local access. This hasn’t happened. Why?
EXERCISES


offering local access. This hasn’t happened. Why?
EXERCISES
A. Describe the current network structure of Internet2®.
B. Provide the service details (e.g., pricing and data rates) for at least one high-speed Internet access
service provider in your area.
C. Some people are wiring their homes for with Cat 5e for 1000Base-T. Suppose a friend who is building
a house asks you what—if any—wired network to put inside the house and what Internet access
technology to use. What would you recommend?
D. Provide service details (e.g., pricing and data rates) for FTTH in your area or a large city such as New
York or Los Angeles.
E. Report the prices and available connections for one IXP, such as the Seattle IXP.


MINICASES
I. Cathy’s Collectibles Your cousin Cathy runs a part-time business out of her apartment. She buys
and sells collectibles such as antique prints, baseball cards, and cartoon cells and has recently
discovered the Web with its many auction sites. She has begun buying and selling on the Web by
bidding on collectibles at lesser-known sites and selling them at a profit at more well-known sites.
She downloads and uploads lots of graphics (pictures of the items she’s buying and selling). She asks
you for advice. Figure 10-8 shows some of the available Internet services and their prices. Explain the
differences in these services and make a recommendation.
II. Surfing Sam Sam likes to surf the Web for fun, to buy things, and to research for his classes. Figure
10-8 shows some of the available Internet services and their prices. Explain the differences in these
services and make a recommendation.
III. Cookies Are Us Cookies Are Us runs a series of 100 cookie stores across the midwestern United
States and central Canada. At the end of each day, the stores express-mail a USB drive of sales and
inventory data to headquarters, which uses the data to ship new inventory and plan marketing
campaigns. They have decided to move data over a WAN or the Internet. What type of a WAN
topology and service (see Chapter 9) or Internet connection would you recommend? Figure 10-8
shows some of the available Internet services and their prices, whereas Figure 9-20 in the previous
chapter shows the WAN circuits.
IV. Organic Foods Organic Foods operates organic food stores in Toronto. The store operates like a
traditional grocery store but offers only organically grown produce and meat, plus a wide array of
health food products. Organic Foods sells memberships, and its 3,000 members receive a discount on


all products they buy. There are also special member events and sales promotions each month.
Organic Foods wants to open a new Internet site that will enable it to email its members monthly and
provide up-to-date information and announcements about new products, sales promotions, and
member events on its website. It has two options. First, it could develop the software on its own
server in its office and connect the office (and the server) to the Internet via DSL, T1, or similar
connection from its offices to an ISP (see Chapter 9, and Figure 9-20). Alternately, it could use
Amazon or other cloud providers to host the website on its servers and just connect the office to the
ISP for Internet service. Figure 10-8 shows some of the available Internet services and their prices.
Web hosting would cost $100–$300 per month, depending on the traffic. Which would you
recommend, and what size of an Internet connection would you recommend? Justify your choice.
Service
Data Rate
Monthly Cost
Down
Up
DSL
3 Mbps
512 Kbps
$40
6 Mbps
640 Kbps
$50
50 Mbps
50 Mbps
$70
Cable Modem
25 Mbps
20 Mbps
$60
100 Mbps
50 Mbps
$80
100 Mbps 100 Mbps
$125
150 Mbps 150 Mbps
$150
200 Mbps 200 Mbps
$175
FTTH
1 Gbps
1 Gbps
$150
FIGURE 10-8 Internet prices
TECH UPDATES
In every chapter, we will offer a couple of ideas to investigate. Pick one of these topics to investigate.
Topic A: Stuxnet


Stuxnet is an extremely sophisticated computer worm that exploited multiple previously unknown
Windows zero-day vulnerabilities to infect computers and spread. Its purpose was not just to infect PCs
but to cause real-world physical effects. It targets the types of industrial control systems (ICS) that are
commonly used in infrastructure supporting facilities (i.e., power plants, water treatment facilities, gas
lines, etc.). How does Stuxnet work? Who created it? Does it still pose a threat?
Topic B: The Dark Web and Tor
The Dark Web is part of the Internet that is not visible to the search engines we use every day and can only
be access by a special browser, called Tor. How did the Dark Web start? How created Tor and why? How
does Tor work? Who pays for Tor (for the development and maintenance of its network of servers)? How
come governments cannot (or will not) shut it down? How is the Dark Web connected to cryptocurrency?
So many questions… Hopefully, you can provide answers to these questions.
Deliverables
Your job will be to prepare a presentation/video (7–10 minutes long) that addresses the topic and
provides information on the following items:
1. Title Slide
2. Short description of the topic
3. Main players—these could be people, processes, software, hardware, etc.
4. How it works—use a lot of pictures and be as technical as possible; create this part as a tutorial so that
your audience can follow along
5. How does it relate to material covered in class so far (and in the future)
6. Additional material/books/links where to learn more about this topic
7. Credits
8. List of References
9. Memo addressed to your professor describing all of the above information
HANDS-ON ACTIVITY 10A
Seeing the Internet


HANDS-ON ACTIVITY 10A
Seeing the Internet
The Internet is a network of networks. One way to see this is by using the VisualRoute software.
VisualRoute is a commercial package but provides a demonstration on its website. Go to visualroute.com
and register to use their free service.
Then enter a URL and watch as the route from your computer to the destination is traced and graphed.
Figure 10-9 shows the route from my house in Indiana to the City University of Hong Kong.


FIGURE 10-9 Visual trace route
Another interesting site is the Internet Traffic Report (www.internettrafficreport.com). This site shows
how busy the parts of the Internet are in real time. The main page enables you to see the current status of
the major parts of the world, including a “traffic index” that rates performance on a 100-point scale. You
can also see the average response time at key Internet NAPs, MAEs, and peering points (at least those that
have agreed to be monitored), which is an average of 135 milliseconds. It also shows the global packet loss
rates—the percentage of packets discarded due to transmission errors (an average of 3% today).


FIGURE 10-10 Internet traffic reports
By clicking on a region of the world, you can see the same statistics for routers in that region. If you click
on a specific router, you can see a graph of its performance over the past 24 hours. Figure 10-10 shows the
statistics for one router operated by Sprint.
You can also get traffic reports for Internet2® at noc. net.internet2.edu/i2network/live-network-
status.html.Internet2®. The “weathermap,” as calls it, shows traffic in both directions because the circuits
are full duplex. You can also click on any circuit to see a graph of traffic over the last 24 hours.
Deliverables
1. Trace the route from your computer to CNN.com and to the University of Oxford www.ox.ac.uk
2. Use the Internet traffic report to find the average response time and packet loss in Asia, Australia,
and North America. Pick a router in North America and report its typical response time for the past
24 hours.
3. How busy are the Internet2® links from Chicago to Atlanta right now? What was the peak traffic on


these circuits over the last 24 hours?
HANDS-ON ACTIVITY 10B
Measuring Your Speed
The download and upload speeds you get on the Internet depend partly on the type of Internet access you
have. The speeds also depend on how your ISP is connected to other ISPs, how busy the Internet is today,
and how busy the website you’re working with is. The last two factors (Internet traffic and Web traffic at
the server) are beyond your control. However, you can choose what type of Internet connection you have
and who your ISP is.
Many sites on the Internet can test the speed of your Internet connection. Our favorite speed site is
speedtest.net. Speedtest.net has lots of advertising; ignore it (and any “windows scan” offer) and just do
the speed test. You begin by selecting a server for the test. I selected a server in Nova Scotia and tested
how fast the connection was between it and my computer in Indiana, which is connected to the Internet
using Comcast’s cable modem service. Figure 10-11 shows that my download speed was 28.86 Mbps and
my upload speed was 5.63 Mbps. I ran the same test to a server closer to my computer in Indiana and got
about the same speeds. The speeds to a server in Mexico were about 1.5 Mbps down and 1.0 up.
Deliverable
Test the upload and download speeds to a server close to your computer and to one far away from you.
FIGURE 10-11 A speed test on my computer in Indiana
HANDS-ON ACTIVITY 10C
Apollo Residence Network Design
Apollo is a luxury residence hall that will serve honor students at your university. We described the
residence in Hands-On Activities at the end of Chapters 7 and 8.


Your university has a good Internet2®connection to the Internet through the high-speed network, which
you’ll recall is a network that connects about 400 research and education organizations around the world
over some very-high-speed Internet circuits. While much of the Internet traffic from the university goes to
and comes from theInternet2®, other universities and organizations that are part of a substantial portion
of traffic goes to and comes from the commercial Internet. This is especially true for traffic generated by
undergraduate students who make up the majority of the intended population of the Apollo Residence.
Therefore, the university has decided to build a second connection into the Internet for primary use by the
students of the Apollo Residence. This Internet connection will also provide a backup connection for
Internet2®, the university’s main Internet connection, just in case it experiences problems.
Deliverable
Your team was hired to select the Internet circuit. Figure 10-8 provides a list of possible Internet services
you can use. Specify what service(s) you will use. Provide the estimated monthly operating cost of the
circuit(s).


PART THREE NETWORK MANAGEMENT


CHAPTER 11
NETWORK SECURITY
This chapter describes why networks need security and how to provide it. The first step in any security
plan is risk assessment, understanding the key assets that need protection, and assessing the risks to each.
A variety of steps can be taken to prevent, detect, and correct security problems due to disruptions,
destruction, disaster, and unauthorized access.
OBJECTIVES
Be familiar with the major threats to network security
Be familiar with how to conduct a risk assessment
Understand how to ensure business continuity
Understand how to prevent intrusion
OUTLINE
11.1 Introduction
11.1.1 Why Networks Need Security
11.1.2 Types of Security Threats
11.1.3 Network Controls
11.2 Risk Assessment
11.2.1 Develop Risk Measurement Criteria
11.2.2 Inventory IT Assets
11.2.3 Identify Threats
11.2.4 Document Existing Controls
11.2.5 Identify Improvements
11.3 Ensuring Business Continuity
11.3.1 Virus Protection
11.3.2 Denial-of-Service Protection
11.3.3 Theft Protection
11.3.4 Device Failure Protection
11.3.5 Disaster Protection
11.4 Intrusion Prevention
11.4.1 Security Policy
11.4.2 Perimeter Security and Firewalls
11.4.3 Server and Client Protection
11.4.4 Encryption
11.4.5 User Authentication
11.4.6 Preventing Social Engineering
11.4.7 Intrusion Prevention Systems


11.4.8 Intrusion Recovery
11.5 Best Practice Recommendations
11.6 Implications for Your Cyber Security
Summary
11.1 INTRODUCTION
Business and government have always been concerned with physical and information security. They have
protected physical assets with locks, barriers, guards, and the military since organized societies began.
They have also guarded their plans and information with coding systems for at least 3,500 years. What
has changed in the last 50 years is the introduction of computers and the Internet.
The rise of the Internet has completely redefined the nature of information security. Now companies face
global threats to their networks and, more importantly, to their data. Malware such as viruses and
ransomware has long been a problem, but credit card theft and identity theft, two of the fastest-growing
crimes, pose an immense liability to firms who fail to protect their customers’ data. Laws have been slow
to catch up, despite the fact that breaking into a computer in the United States—even without causing
damage—is a federal crime punishable by a fine and/or imprisonment. Nonetheless, we have a new kind
of transborder cybercrime against which laws may apply but that will be very difficult to enforce. The
United States and Canada may extradite and allow prosecution of digital criminals operating within their
borders, but investigating, enforcing, and prosecuting transnational cybercrime across different borders is
much more challenging. And even when someone is caught, he or she faces a lighter sentence than a bank
robber.
Computer security has become increasingly important with the Sarbanes-Oxley Act (SOX) and the Health
Insurance Portability and Accountability Act (HIPAA). However, despite these measures, the number of
security incidents is growing by about 30% per year. In 2016, about 50 million passwords were stolen. A


survey of 1,500 U.S. adults found that 51% had experienced some form of a cybersecurity incident in 2016.
These incidents included not only malware such as viruses but also industrial espionage, fraud, extortion
(ransomware), and identity theft. In the early days of the Internet, creating a virus and breaking into
websites was mainly done by young adults craving excitement. Those days are gone. Today’s goal is
money.
You probably heard on the news that the large companies Zappos and Target had been victims of
cyberattacks and that millions of the credit card information of millions of their customers had been
stolen. However, a company of any size can be the target of an attack. According to Symantec, more than
50% of all targeted companies had fewer than 2,500 employees because they often have weaker security.
Many organizations, private and public, focus on helping individuals, organizations, and governments to
protect themselves from criminals operating on the Internet (cybercriminals). These include CERT
(Computer Emergency Response Team) at Carnegie Mellon University, APWG (Anti-Phishing Working
Group), the Russian-based Kaspersky Lab, McAfee, and Symantec.
There are three main reasons why there has been an increase in computer security over the past few years.
First, in the past, hacking into somebody’s computer was considered to be a hobby, but today being a
cybercriminal is a profession. There are professional organizations that one can hire to break into
computer networks of specific targets to steal information. We are not talking about ethical hacking (when
a company hires another company to test its security) but rather hackers who, for a fee, will steal credit
cards, personal information, or intellectual property. These attacks are called targeted attacks, in which


cards, personal information, or intellectual property. These attacks are called targeted attacks, in which
cybercriminals not only try to exploit technical vulnerabilities but also try to “hack the human” via social
engineering or phishing emails. These targeted attacks can be very sophisticated, and any organization
can become a victim because every organization has data that can be of value to cybercriminals.
Second, hacktivism (the use of hacking techniques to bring attention to a larger political or social goal) has
become more common. Hacktivism combines illegal hacking techniques with digital activism and usually
targets large organizations and governments by sabotaging or defacing their public websites to bring
attention to the hackers’ social or political cause. For example, the group called Anonymous has taken


down websites owned by Visa and MasterCard to protest their denial of payments to WikiLeaks. This type
of threat is not as pervasive as that from cybercriminals, but it has increased in the past few years.
Third, the increase in mobile devices offers a very fertile environment for exploitation. More and more
frequently, we access our bank accounts, buy items on Amazon, and use our business data through our
mobile devices, so cybercriminals are now targeting these mobile devices. These types of attacks are often
easier to develop because mobile security is typically weaker than computer security, so they offer a
potentially high yield.
These trends will increase the value of personal data, and, therefore, the potential threat to our privacy
and the privacy of businesses will increase. It is thus very important for businesses and also individuals to
understand their assets, potential threats to these assets, and the way they can protect them. We explore
these in the next section of this chapter.
11.1.1 Why Networks Need Security
In recent years, organizations have become increasingly dependent on data communication networks for
their daily business communications, database information retrieval, distributed data processing, and the
internetworking of LANs. The rise of the Internet with opportunities to connect computers and mobile
devices anywhere in the world has significantly increased the potential vulnerability of the organization’s
assets. Emphasis on network security also has increased as a result of well-publicized security break-ins
and as government regulatory agencies have issued security-related pronouncements.
The losses associated with security failures can be huge. An average data breach costs about $3.5 million,
but this is just the tip of the iceberg. The potential loss of consumer confidence from a well-publicized
security break-in can cost much more in lost business. More important than these, however, are the
potential losses from the disruption of application systems that run on computer networks. As


potential losses from the disruption of application systems that run on computer networks. As
organizations have come to depend on computer systems, computer networks have become “mission-
critical.” Bank of America, one of the largest banks in the United States, estimates that it would cost the
bank $50 million if its computer networks were unavailable for 24 hours. Other large organizations have
produced similar estimates.
Protecting customer privacy and the risk of identity theft also drive the need for increased network
security. In 2016, the European Union passed a strong data privacy law, called the General Data
Protection Regulation (GDPR), on data protection and privacy in the European Union. GDPR also
addresses the transfer of private information outside of the EU thus influencing international business. In
the United States, organizations have begun complying with the data protection requirements of HIPAA
and a California law providing fines up to $250,000 for each unauthorized disclosure of customer
information (e.g., if someone were to steal 100 customer records, the fine could be $25 million).
As you might suspect, the value of the data stored on most organizations’ networks and the value provided
by the application systems in use far exceeds the cost of the networks themselves. For this reason, the
primary goal of network security is to protect organizations’ data and application software, not the
networks themselves.
11.1.2 Types of Security Threats
For many people, security means preventing intrusion, such as preventing an attacker from breaking into
your computer. Security is much more than that, however. There are three primary goals in providing
security: confidentiality, integrity, and availability (also known as CIA). Confidentiality refers to the
protection of organizational data from unauthorized disclosure of customer and proprietary data.
Integrity is the assurance that data have not been altered or destroyed. Availability means providing


Integrity is the assurance that data have not been altered or destroyed. Availability means providing
continuous operation of the organization’s hardware and software so that staff, customers, and suppliers
can be assured of no interruptions in service.
There are many potential threats to confidentiality, integrity, and availability. In general, security threats
can be classified into two broad categories: ensuring business continuity and preventing unauthorized
access.
Ensuring business continuity refers primarily to ensuring availability, with some aspects of data
integrity. There are three main threats to business continuity. Disruptions are the loss of or reduction in


network service. Disruptions may be minor and temporary. For example, a network switch might fail or a
circuit may be cut, causing part of the network to cease functioning until the failed component can be
replaced. Some users may be affected, but others can continue to use the network. Some disruptions may
also be caused by or result in the destruction of data. For example, a virus may destroy files, or the “crash”
of a hard disk may cause files to be destroyed. Other disruptions may be catastrophic. Natural (or human-
made) disasters may occur that destroy host computers or large sections of the network. For example,
hurricanes, fires, floods, earthquakes, mudslides, tornadoes, or terrorist attacks can destroy large parts of
the buildings and networks in their path.
Preventing unauthorized access, also referred to as intrusion, refers primarily to confidentiality, but
also integrity, as an intruder may change important data. Intrusion is often viewed as external attackers
gaining access to organizational data files and resources from across the Internet. However, almost half of
all intrusion incidents involve employees. An intrusion may have only minor effects. A curious intruder
may simply explore the system, gaining knowledge that has little value. A more serious intruder may be a
competitor bent on industrial espionage who could attempt to gain access to information on products
under development, or the details and price of a bid on a large contract, or a thief trying to steal customer
credit card numbers or information to carry out identity theft. Worse still, the intruder could change files
to commit fraud or theft or could destroy the information to injure the organization.
MANAGEMENT FOCUS 11-1
Same Old Same Old
No matter the industry, every company should consider itself to be a target of cybercrime—Target


No matter the industry, every company should consider itself to be a target of cybercrime—Target
learned this the hard way in December 2013. Russian hacker(s) were able to install malware on the
company’s point-of-sale systems (cash registers) and steal the credit card information of more than
40 million individuals.
Hackers probably got access to Target’s network using the credentials of an HVAC vendor.
Investigators said that the malware installed on the point-of-sale systems was neither sophisticated
nor novel and was detected by two security systems that Target had installed on its network. Why
didn’t security specialists listen to the warnings from their security software? Target, just like any
other company, gets bombarded by thousands of attacks each day, and the likelihood of one of them
getting through increases each day—just a simple logic of probability. Although some attacks are
sophisticated, most of them are well known. One can say, same old same old. Cyberattackers are
playing the game of numbers—the more persistent they are in their attacks, the more likely they will
get inside a network and gain access to critical information such as credit card numbers.
This only reminds us that cybersecurity is a global problem and that everybody who uses the Internet
can be and probably is under attack. Therefore, learning about security and investing in it is
necessary to survive and strive in the Internet era.
Source: Adapted from “Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It,” by Michael Riley, Ben
Elgin, Dune Lawrence, and Carol Matlack, Bloomberg Businessweek (www.businessweek.com) and Krebs on Security
(krebsonsecuirty.com).
11.1.3 Network Controls
Developing a secure network means developing controls. Controls are software, hardware, rules, or


Developing a secure network means developing controls. Controls are software, hardware, rules, or
procedures that reduce or eliminate the threats to network security. Controls prevent, detect, and/or
correct whatever might happen to the organization because of threats facing its computer-based systems.
Preventive controls mitigate or stop a person from acting or an event from occurring. For example, a
password can prevent illegal entry into the system, or a set of second circuits can prevent the network
from crashing. Preventive controls also act as a deterrent by discouraging or restraining someone from
acting or proceeding because of fear or doubt. For example, a guard or a security lock on a door may deter
an attempt to gain illegal entry.


Detective controls reveal or discover unwanted events. For example, software that looks for illegal
network entry can detect these problems. They also document an event, a situation, or an intrusion,
providing evidence for subsequent action against the individuals or organizations involved or enabling
corrective action to be taken. For example, the same software that detects the problem must report it
immediately so that someone or some automated process can take corrective action.
Corrective controls remedy an unwanted event or an intrusion. Either computer programs or humans
verify and check data to correct errors or fix a security breach so it will not recur in the future. They also
can recover from network errors or disasters. For example, the software can recover and restart the
communication circuits automatically when there is a data communication failure.
The remainder of this chapter discusses the various controls that can be used to prevent, detect, and
correct threats. We also present a general risk assessment framework for identifying the threats and their
associated controls. This framework provides a network manager with a good view of the current threats
and any controls that are in place to mitigate the occurrence of threats.
Nonetheless, it is important to remember that it is not enough just to establish a series of controls;
someone or some department must be accountable for the control and security of the network. This
includes being responsible for developing controls, monitoring their operation, and determining when
they need to be updated or replaced.
Controls must be reviewed periodically to be sure that they are still useful and must be verified and tested.
Verifying ensures that the control is present, and testing determines whether the control is working as
originally specified.
It is also important to recognize that there may be occasions in which a person must temporarily override
a control, for instance, when the network or one of its software or hardware subsystems is not operating


properly. Such overrides should be tightly controlled, and there should be a formal procedure to
document this occurrence should it happen.
11.2 RISK ASSESSMENT
The first step in developing a secure network is to conduct a risk assessment. There are several
commonly used risk assessment frameworks that provide strategies for analyzing and prioritizing the
security risks to information systems and networks. A risk assessment should be simple so that both
technical and nontechnical readers can understand it. After reading a risk assessment, anyone should be
able to see which systems and network components are at high risk for attack or abuse and which are at
low risk. Also, the reader should be able to see what controls have been implemented to protect him or her
and what new controls need to be implemented.
Three risk assessment frameworks are commonly used:
1. Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) from the Computer
Emergency Readiness Team
2. Control Objectives for Information and Related Technology (COBIT) from the Information Systems
Audit and Control Association
3. Risk Management Guide for Information Technology Systems (NIST guide) from the National
Institute of Standards and Technology
Each of these frameworks offers a slightly different process with a different focus. However, they share
five common steps:
1. Develop risk measurement criteria
2. Inventory IT assets
3. Identify threats
4. Document existing controls
5. Identify improvements


11.2.1 Develop Risk Measurement Criteria
Risk measurement criteria are the measures used to evaluate the way a security threat could affect the
organization. For example, suppose that a hacker broke in and stole customer credit card information
from a company server. One immediate impact to the organization is financial, because some customers
are likely to stop shopping, at least in the short term. Depending where the company is located, there may
also be some legal impact because some countries and/or states have laws concerning the unauthorized
release of personal information. There also may be longer-term impacts on the company’s reputation.
Each organization needs to develop its own set of potential business impacts, but the five most commonly
considered impact areas are financial (revenues and expenses), productivity (business operations),
reputation (customer perceptions), safety (the health of customers and employees), and legal
(potential for fines and litigation). However, some organizations add other impacts and not all
organizations use all of these five because some may not apply. It is important to remember that these
impacts are for information systems and networks, so although safety is important to most organizations,
there may be little impact on safety from information systems and network problems.
Once the impact areas have been identified, the next step is to prioritize them. Not all impact areas are
equally important to all organizations. Some areas may be a high priority, some medium, and some low.
For example, for a hospital, safety may be the highest priority and financial the lowest. In contrast, for a
restaurant, information systems and networks may pose a low (or nonexistent) safety risk (because they
are not involved in food safety) but a high priority reputation risk (if, for example, credit card data were
stolen). There may be a temptation to say every impact is a high priority, but this is the same as saying


that all impacts are medium, because you cannot distinguish between them when it comes time to take
action.
The next step is to develop specific measures of what could happen in each impact area and what we
would consider a high, medium, and low impact. For example, one financial impact could be a decrease
in sales. What would we consider a low financial impact in terms of a decrease in sales: 1%? 2%? What
would be a high impact on sales? These are business decisions, not technology decisions, so they should
be made by the business leaders.
Figure 11-1 has sample risk measurement criteria for a Web-based bookstore. As you can see, only four of
the impact areas apply for this company, because information systems and network security problems
would not harm the safety of employees or customers. However, it would be a different case if this were a
pharmaceutical company. A threat, such as malware, could cause changes in how a drug is prepared,
potentially harming customers (patients) and also employees.
As Figure 11-1 suggests, our fictional Web-based book company believes that financial and reputation
impacts have high priority, whereas productivity and legal impacts are medium. This figure also provides
metrics for assessing the impact of each risk. For example, our fictitious company considers it a low
financial impact if their sales were to drop by 2% because of security problems. The financial impact
would be high if they were to lose more than 10% of sales.
Impact
Area
Priority Low Impact
Medium Impact
High Impact
Financial
High
Sales drop by less than
2%
Sales drop by 2–10%
Sales drop by more than
10%
Productivity Medium Increase in annual
operating expenses by
less than 3%
Increase in annual
operating expenses between
3% and 6%


Increase in annual
operating expenses between
3% and 6%
Increase in annual
operating expenses by
more than 6%
Reputation
High
Decrease in number of
customers by less than
2%
Decrease in number of
customers by 2–15%
Decrease in number of
customers by more than
15%
Legal
Medium Incurring fines or legal
fees less than $10,000
Incurring fines or legal fees
between $10,000 and
$60,000
Incurring fines or legal
fees exceeding $60,000
FIGURE 11-1 Sample risk measurement criteria for a Web-based bookstore


Hardware
Servers, such as mail servers, Web servers, DNS servers, DHCP servers, and
LAN file servers
Client computers
Devices such as switches and routers
Circuits
Locally operated circuits such as LANs and backbones
Contracted circuits such as WAN circuits
Internet access circuits
Network software
Server operating systems and system settings
Application software such as mail server and Web server software
Client software
Operating systems and system settings
Application software such as word processors
Organizational data
Databases with organizational records
Mission-critical
applications
For example, for an Internet bank, its website is mission-critical
FIGURE 11-2 Types of assets. DNS = Domain Name Service; DHCP = Dynamic Host Control Protocol;
LAN = local area network; WAN = wide area network
11.2.2 Inventory IT Assets
An asset is something of value and can be either hardware, software, data, or applications. Figure 11-2
defines six common categories of IT assets.
An important type of asset is the mission-critical application, which is an information system that is
critical to the survival of the organization. It is an application that cannot be permitted to fail, and if it
does fail, the network staff drops everything else to fix it. For example, for an Internet bank that has no
brick-and-mortar branches, the website is a mission-critical application. If the website crashes, the bank
cannot conduct business with its customers. Mission-critical applications are usually clearly identified so
that their importance is not overlooked.
The next most important type of asset is the organization’s data. For example, suppose someone were to
destroy a mainframe computer worth $10 million. The computer could be replaced simply by buying a
new one. It would be expensive, but the problem would be solved in a few weeks. Now suppose someone


were to destroy all the student records at your university so that no one would know what courses anyone
had taken or their grades. The cost would far exceed the cost of replacing a $10 million computer. The
lawsuits alone would easily exceed $10 million, and the cost of staff to find and reenter paper records
would be enormous and certainly would take more than a few weeks.
Once all assets are identified, they need to be rated for importance. To order them, you need to answer
questions such as, what would happen if this information asset’s confidentiality, integrity, or accessibility
were compromised? This will allow you to assess the importance of this asset as low, medium, or high.
You need also to document each asset, not just information assets, and briefly describe why each asset is
critical to the organization. Finally, the owners of each asset are recorded. Figure 11-3 summarizes some
typical assets found in most organizations.
TECHNICAL FOCUS 11-1
Basic Control Principles of a Secure Network
The less complex a control, the better.
A control’s cost should be equivalent to the identified risk. It often is not possible to ascertain
the expected loss, so this is a subjective judgment in many cases.
Preventing a security incident is always preferable to detecting and correcting it after it occurs.
An adequate system of internal controls is one that provides “just enough” security to protect


the network, taking into account both the risks and costs of the controls.
Automated controls (computer-driven) always are more reliable than manual controls that
depend on human interaction.
Controls should apply to everyone, not just a few select individuals.
When a control has an override mechanism, make sure that it is documented and that the
override procedure has its own controls to avoid misuse.
Institute the various security levels in an organization based on “need to know.” If you do not
need to know, you do not need to access the network or the data.
The control documentation should be confidential.
Names, uses, and locations of network components should not be publicly available.
Controls must be sufficient to ensure that the network can be audited, which usually means
keeping historical transaction records.
When designing controls, assume that you are operating in a hostile environment.
Always convey an image of high security by providing education and training.
Make sure the controls provide the proper separation of duties. This applies especially to those
who design and install the controls and those who are responsible for everyday use and
monitoring.
It is desirable to implement entrapment controls in networks to identify attackers who gain
illegal access.
When a control fails, the network should default to a condition in which everyone is denied
access. A period of failure is when the network is most vulnerable.
Controls should still work even when only one part of a network fails. For example, if a
backbone network fails, all LANs connected to it should still be operational, with their own
independent controls providing protection.
Don’t forget the LAN. Security and disaster recovery planning has traditionally focused on host
mainframe computers and WANs. However, LANs now play an increasingly important role in
most organizations but are often overlooked by central site network managers.
Always assume your opponent is smarter than you.


Always assume your opponent is smarter than you.
Always have insurance as the last resort should all controls fail.
11.2.3 Identify Threats
A threat is any potential occurrence that can do harm, interrupt the systems using the network, or cause
a monetary loss to the organization.
Figure 11-4 summarizes the most common types of threats and their likelihood of occurring based on
several surveys in recent years. This figure shows the percentage of organizations experiencing each threat
in a typical year but not whether the threat caused damage. For example, 100% of companies reported
experiencing one or more malware attacks such as viruses or ransomware, but in most cases, their
antivirus software prevented any problems. Another common threat is information theft, whether by
phishing (where an attacker sends an email to trick employees into revealing their passwords), or other
means such as via a security hole or social engineering. Other less common threats are the theft of
equipment, device failure, denial of service, sabotage (where an attacker changes data), or a natural
disaster such as a fire or flood.
Asset
Importance Most
Important
Security
Requirement
Description
Owner(s)