Network Security Basics
Every device that talks to a network exposes an attack surface, the sum of all the points where an attacker could try to get in. Network security is largely about shrinking that surface and controlling what is allowed to cross it.
Ports and protocols
A port identifies a specific service running on a machine. A handful show up constantly:
| Port | Protocol | Purpose |
|---|---|---|
| 22 | SSH | Encrypted remote shell access |
| 80 | HTTP | Unencrypted web traffic |
| 443 | HTTPS | Encrypted web traffic (TLS) |
| 25 | SMTP | Sending email |
| 3389 | RDP | Remote desktop (Windows) |
TCP is connection-oriented and guarantees delivery order (used for web pages, file transfers), UDP is connectionless and faster but can drop or reorder packets (used for video calls, DNS lookups).
Firewalls
A firewall inspects traffic and decides what to allow or block, based on rules like source IP, destination port, or protocol.
# Example: a rule that only allows SSH from a specific trusted IP
sudo ufw allow from 203.0.113.10 to any port 22
sudo ufw deny 22The principle behind good firewall rules is default deny: block everything, then explicitly allow only what is needed. This is much safer than trying to enumerate every bad thing to block.
VPNs
A VPN (Virtual Private Network) creates an encrypted tunnel between a device and a private network over the public internet, so traffic can't be read or tampered with by anyone in between, useful for accessing internal company systems securely from an untrusted network like public Wi-Fi.
TIP
"Attack surface" isn't just about open ports, every dependency, every exposed API endpoint, and every user input field is also part of your attack surface.