After this lesson you can explain the TCP/IP model and map security controls to each layer, describe how IP addresses and ports identify hosts and services on a ship network, distinguish TCP from UDP and their respective security implications, explain how DNS works and how it can be exploited, describe what a firewall does and articulate the default-deny principle, explain network segmentation's role in limiting attacker lateral movement, and understand why VPN security directly affects shipboard remote access risk.
Every attack in cybersecurity involves a network. A phishing email arrives over SMTP. Ransomware spreads laterally over SMB (port 445). A command-and-control server communicates with its implant over HTTPS (port 443) — chosen specifically because HTTPS traffic blends in with normal web browsing and is rarely blocked outright. GPS spoofing attacks corrupt the signal before it even reaches the vessel's antenna. A remote access tool communicates over a VPN tunnel that was opened using stolen credentials.
Understanding networks is not optional for a cybersecurity practitioner. It is the foundation on which every other discipline is built. Threat intelligence analysis, penetration testing, incident response, SIEM detection engineering — all of these require fluency in how network protocols work, what the traffic looks like, and what "normal" looks like so that "abnormal" can be identified.
For maritime professionals, there is an additional dimension: shipboard networks are a unique environment. They combine IT protocols (TCP/IP, HTTP, DNS) with OT protocols designed decades ago for isolated industrial environments (Modbus, DNP3, NMEA), all running over a VSAT or LTE link with limited bandwidth and, in many cases, no security monitoring at all. Understanding the fundamentals in this lesson is the prerequisite for understanding why that combination is dangerous — and what IACS UR E26 requires to make it safe.
1. The TCP/IP Model — How Networks Are Organised
The TCP/IP model is the framework that governs how data moves across all modern networks — from the internet to corporate LANs to shipboard OT networks. It has four layers, each handling a distinct part of the communication process. Security controls map to specific layers, which is why understanding the model is a prerequisite for understanding why a given attack works and which control can stop it.
When two systems communicate, data moves down the stack on the sending side (each layer adds its own header) and up the stack on the receiving side (each layer reads and strips its header). Security controls — firewalls, IDS, TLS — intercept this flow at specific layers to inspect, permit, or block traffic.
The TCP/IP model is a simplification of the 7-layer OSI model, which adds Presentation and Session layers between Application and Transport. Both models are used in practice — OSI for conceptual precision when discussing specific protocol behaviour, TCP/IP for real-world traffic analysis and firewall configuration. Security certifications (Security+, CISSP, CEH) test both.
2. IP Addresses and Ports — How Hosts and Services Are Identified
An IP address uniquely identifies a host on a network. IPv4 uses 32-bit addresses written as four decimal octets separated by dots (e.g., 192.168.1.10). IPv6 uses 128-bit addresses written in hexadecimal groups. For security purposes, the critical distinction is between public addresses (globally routable — visible on the internet) and private addresses (RFC 1918 ranges, used internally and translated at the network border via NAT).
A port number is a 16-bit integer (0–65,535) that identifies a specific service or application running on a host. If the IP address is the building's street address, the port is the apartment number: a firewall can allow traffic to a host's IP address (the building) but block specific ports (the apartment) to control which services can be reached.
Together, an IP address and port number define a socket — the specific endpoint of a network connection. Every TCP and UDP connection is uniquely identified by the combination of source IP, source port, destination IP, and destination port. This is the fundamental unit that firewalls inspect.
⚠️ Maritime OT insight: A standard enterprise firewall is typically configured for IT environments — it knows about ports 80, 443, 22, 3389. It does not have rules for Modbus (502), DNP3 (20000), or IEC 61850 (61450) by default. When OT systems and IT systems share a network without deliberate OT-aware security policy, OT traffic passes uninspected. Attackers who reach the network can query Modbus devices directly. Asset visibility tools that enumerate open OT ports are the essential first step in any shipboard cyber assessment — before you know what's talking to what, you cannot write effective firewall rules.
3. TCP vs UDP — Reliability vs Speed
At the Transport layer, two protocols handle the vast majority of internet traffic. Understanding the difference between them matters for security because each has distinct vulnerabilities and each is used by different types of services — including OT systems that your firewall may not be treating appropriately.
Connection-oriented: TCP establishes a connection with a three-way handshake before sending data — SYN → SYN-ACK → ACK. This ensures both parties are ready and reachable. TCP guarantees delivery and correct ordering: if a packet is lost, TCP retransmits it; if packets arrive out of order, TCP reassembles them.
Used by: HTTP/S, SSH, SMTP, FTP, RDP, SMB — anything that requires reliable data delivery.
Connectionless: UDP sends packets without establishing a connection first — "fire and forget." There is no guarantee of delivery, no ordering, and no error recovery. What UDP loses in reliability it gains in speed and low overhead.
Used by: DNS, DHCP, streaming media, VoIP, SNMP, and many OT protocols (Modbus UDP, NMEA broadcasts).
From a security monitoring perspective: TCP's handshake and connection tracking make it easier to detect anomalies (unexpected SYN traffic, established connections to unusual ports). UDP's stateless nature makes it harder to monitor and is sometimes used to evade detection — DNS tunnelling, for example, encodes data in DNS UDP queries to exfiltrate data or communicate with a C2 server.
4. DNS — The Internet's Address Book (and a Major Attack Surface)
The Domain Name System (DNS) translates human-readable domain names into IP addresses. Without DNS, every application would need to use IP addresses directly — an unusable experience for users and impractical for dynamic cloud environments where IP addresses change frequently. DNS is one of the oldest and most fundamental protocols on the internet, and it was designed in an era where security was an afterthought.
When your browser visits www.shippauljobs.com, your computer sends a DNS query to a resolver (typically provided by your ISP or a public resolver like Google's 8.8.8.8 or Cloudflare's 1.1.1.1). The resolver walks the DNS hierarchy: Root nameservers → TLD nameservers (.com) → Authoritative nameserver for the domain → returns the IP address. The result is cached according to its TTL (Time To Live) to avoid repeated lookups for the same domain.
DNS is one of the most exploited protocols in cybersecurity for two reasons: it is almost always permitted outbound through firewalls (because nothing works without DNS), and the traffic is rarely inspected deeply. This makes it a favoured channel for both attacks and covert communication.
DNS Cache Poisoning (DNS Spoofing)
An attacker injects forged DNS records into a resolver's cache. When users query the compromised resolver, they receive malicious IP addresses — redirecting them to phishing sites or man-in-the-middle interception servers. DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify authenticity. However, DNSSEC adoption remains incomplete, leaving many domains vulnerable.
DNS Tunnelling
Since DNS traffic is almost never blocked at firewalls, attackers encode data in DNS query strings and receive responses from an attacker-controlled nameserver that encodes the reply. This creates a covert channel for data exfiltration or C2 communication — one that bypasses firewalls, proxy servers, and many DLP solutions. Detection requires DNS traffic analysis and anomaly detection (unusual query lengths, high query rates, queries to unusual TLDs).
Domain Generation Algorithms (DGA)
Malware uses algorithms to generate large numbers of pseudo-random domain names, checking each to see if a C2 server is registered there. Blocking individual C2 domains is futile; defenders need DGA detection based on lexical analysis of queried domain names (high entropy, unusual character sequences).
5. HTTP and HTTPS — Plaintext vs Encrypted Web Traffic
HTTP (HyperText Transfer Protocol) is the foundation of the web — a request-response protocol where the client sends a method (GET, POST, PUT, DELETE) and the server sends a response with status code and content. HTTP is entirely plaintext: every header, every cookie, every form submission, and every credential transmitted over HTTP is readable by any device on the network path between client and server — including a network switch, a router, a proxy server, or a malicious device the attacker has inserted.
HTTPS wraps HTTP inside TLS (Transport Layer Security). TLS provides three security properties: confidentiality (data is encrypted and unreadable to on-path observers), authentication (the server presents a digital certificate that the client verifies against a trusted Certificate Authority), and integrity (the data cannot be modified in transit without detection). Modern TLS versions are TLS 1.2 and TLS 1.3. Older versions (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1) have known cryptographic weaknesses and must be disabled on any properly configured system.
A practical caution: HTTPS proves the connection is encrypted and that the certificate belongs to the domain shown in the browser. It does not prove the website is legitimate. Phishing sites routinely use valid HTTPS certificates — including free ones from Let's Encrypt — while serving malicious content. "The padlock means it's safe" is a common and dangerous misconception.
6. Firewalls — Enforcing Access Policy at the Network Boundary
A router moves packets between networks based on IP addresses and routing tables. It makes forwarding decisions packet by packet, directing each toward its destination through a sequence of network hops. Routers can implement Access Control Lists (ACLs) — simple permit/deny rules based on IP address and port — to filter traffic at the network layer, but this is not their primary function.
A firewall is a dedicated security device (or software) whose primary job is to enforce access policy. Firewalls have evolved through several generations:
Packet-filter firewalls (first generation) — inspect individual packets against rules based on source/destination IP and port. Stateless: each packet is evaluated independently, with no memory of prior packets in the same connection. Fast but easily bypassed.
Stateful firewalls (second generation) — track the state of active TCP connections. A stateful firewall can enforce that inbound traffic on port X is only permitted if it belongs to an established connection that was initiated outbound. This blocks most unsolicited inbound connection attempts — the most common approach for perimeter firewalls.
Next-Generation Firewalls (NGFW) — add application-layer inspection (can identify applications regardless of port), intrusion prevention (IPS signatures), TLS decryption/inspection, and user-identity-based rules. Increasingly essential for detecting attacks that use HTTPS to evade detection.
Default-deny (allowlist posture) blocks everything except what is explicitly permitted. This is the recommended approach — contrast with default-allow (denylist), which permits everything except what is explicitly blocked. Default-allow leaves unknown traffic passing unchecked.
7. Network Segmentation — Containing Lateral Movement
Network segmentation divides a network into distinct zones — each with its own trust level, access controls, and monitoring policy. The security purpose is simple: once an attacker gains access to one zone, segmentation prevents them from freely moving to other zones. Attackers call this lateral movement — traversing from an initial foothold to higher-value targets. Segmentation forces lateral movement through control points that can detect and block it.
VLANs (Virtual Local Area Networks) are the primary mechanism for segmentation on modern managed switches. Each VLAN is a separate broadcast domain. Inter-VLAN traffic must pass through a Layer 3 device — a router or firewall — where policy can be enforced. A switch port assigned to the OT VLAN cannot directly communicate with a port assigned to the crew Wi-Fi VLAN without the traffic passing through the firewall in between.
Beyond VLANs, enterprise environments use micro-segmentation — applying host-based firewalls and Software-Defined Networking (SDN) to isolate individual workloads even within the same VLAN. Zero-trust architectures take this further: no traffic is implicitly trusted regardless of network location; every connection must be authenticated and authorised.
🚢 Maritime — IACS UR E26 Zone and Conduit Model: IACS UR E26 directly mandates network segmentation for shipboard systems. All Computer-Based Systems (CBS) must be categorised by their safety and operational impact, then placed in security zones (groups of systems with similar trust levels and security requirements). Communication between zones must pass through defined conduits (communication paths with controls that enforce the zone security policy). A flat network — where the ECDIS workstation, the crew Wi-Fi router, the cargo management terminal, and the engine IAS all exist on a single unpartitioned network — is incompatible with UR E26 compliance and represents a severe security risk: a crew member's personal device, if infected, can reach safety-critical OT systems with no barriers in between.
8. VPN — Securing Remote Access to Ship Networks
A VPN (Virtual Private Network) creates an encrypted tunnel between two endpoints over an untrusted network — typically the internet. Within the tunnel, all traffic is encrypted and protected from interception or modification by anyone on the path between the endpoints. VPNs allow remote users or remote sites to communicate as if they were on the same local network, even when separated by thousands of kilometres.
In maritime operations, VPNs serve two critical purposes. Remote Access VPN allows shore-based superintendents, company security officers, or vendor technicians to connect to a vessel's network over VSAT for remote troubleshooting, monitoring, or software updates. Site-to-Site VPN creates a permanent encrypted tunnel between the ship's onboard network and the fleet operations centre ashore, allowing persistent monitoring and data transfer over a trusted encrypted channel.
Individual users connect to the ship or company network over VSAT/LTE. Credentials authenticate the user; the VPN tunnel protects the data. Critical attack vector: stolen credentials allow an attacker to authenticate to the VPN and gain network access just as if they were a legitimate user — bypassing all perimeter controls.
The entire shipboard network segment is connected to the shore network via a permanent encrypted tunnel — typically IPsec over VSAT. Traffic between vessel and company flows through this tunnel. The tunnel endpoint configuration must be hardened: default or weak pre-shared keys, outdated encryption algorithms, or misconfigured routes have all been exploited.
Common VPN protocols: IPsec (industry standard, used extensively in maritime/enterprise), OpenVPN (open-source, flexible), WireGuard (modern, fast, cryptographically strong). In all cases, the security of the VPN is only as strong as the credentials and configuration protecting it.
- The TCP/IP model — four layers (Application, Transport, Internet, Network Access) — is the framework for all modern network communication. Security controls map to specific layers.
- IP addresses identify hosts (public vs private/RFC 1918); port numbers identify services. Together they define a socket — the unit that firewalls inspect.
- Maritime OT uses non-standard ports (Modbus 502, DNP3 20000, IEC 61850 61450) that standard IT firewalls may not be configured to inspect or block.
- TCP is reliable and connection-oriented (vulnerable to SYN floods); UDP is connectionless and fast (vulnerable to amplification attacks, used by DNS and many OT protocols).
- DNS is critical infrastructure that is also a major attack surface — cache poisoning, tunnelling, and DGA are key attack techniques that exploit DNS's ubiquity and low inspection rate.
- HTTPS (HTTP over TLS) provides encrypted, authenticated web communication. The padlock does not guarantee a site is legitimate — only that the connection is encrypted.
- Default-deny firewall posture (allowlist) is the correct approach: block everything, then explicitly permit required traffic.
- Network segmentation (VLANs) limits lateral movement. IACS UR E26 requires Zone and Conduit architecture for all shipboard systems.
- VPN remote access to ship networks must be protected by MFA. Compromised VPN credentials bypass all perimeter controls.
Lesson 3 — Linux & Operating System Fundamentals moves from the network layer to the host layer. You now understand how data moves between systems. Next you will learn what happens inside the operating system that runs on each network node — how processes start and communicate, how users and permissions are structured, how files are organised on disk, and how to monitor a host for signs of compromise. This host-level visibility is essential for the detection and response work that dominates security operations.
For maritime professionals: Lesson 3 will directly address why legacy Windows OS on navigation workstations is a systemic security problem — and what the practical constraints are on patching it.
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment