3. Networks

A network is a chain of machines you do not control, passing your bytes along. By default, any of them can read, drop, replay or modify what passes through. Network security is the art of not depending on the honesty of the path.

The layers, simplified

Layer	What it does	Example	Security relevance
Link	Delivers frames on a local network	Ethernet, Wi-Fi	Anyone on open Wi-Fi or the same LAN can try to intercept (e.g. ARP spoofing)
Internet	Routes packets between networks by IP address	IPv4, IPv6, BGP	An IP address is a location, not an identity; routes can be hijacked
Transport	Ports and reliable streams	TCP, UDP	Open ports reveal services; floods exhaust connections
Application	Meaningful messages	HTTP, DNS, SMTP, gRPC	Where most attacks happen

TLS sits between transport and application. The key insight: the lower layers give you no confidentiality and no authenticity. “The request came from an internal IP” is not authentication. Anything you need protected must be protected end to end, above these layers.

DNS: the internet’s phone book, originally unauthenticated

DNS maps names to IP addresses. It was designed for a cooperative network, so classic DNS answers carry no proof they are genuine. Common problems:

• Spoofing and cache poisoning - fake answers send users to an attacker’s server.
• Registrar account takeover - the attacker controls your domain’s records directly.
• Typosquatting - look-alike domains catch mistyped names.
• Subdomain takeover - a DNS record still points to a deleted cloud resource, and an attacker claims that resource.

DNSSEC adds signatures to DNS records; DNS over HTTPS or TLS adds privacy. One more point matters for sandboxing: DNS queries themselves can carry data out. A sandbox that blocks HTTP but allows arbitrary DNS lookups can still leak secrets.

TLS: a secure channel over an insecure path

TLS (the “S” in HTTPS) gives three properties:

• Confidentiality - traffic is encrypted.
• Integrity - tampering is detected.
• Server authentication - a certificate proves the server controls the domain you asked for. With mutual TLS (mTLS), the client proves its identity too.

The handshake, conceptually: the client says hello; the server sends its certificate chain; both run a key exchange (usually elliptic-curve Diffie–Hellman) to agree on a shared secret that never crossed the wire; both derive session keys from it; encrypted traffic flows. Because the key-exchange keys are temporary, a server key stolen later cannot decrypt recorded past sessions. This property is forward secrecy.

What TLS does not give you:

• It says nothing about whether the server is honest, only that it owns the domain.
• It protects data in transit, not at the endpoints, where most breaches happen.
• It leaks metadata: which server you talk to, when, and how much data flows.

A man-in-the-middle (MITM) attacker sits between client and server. TLS defeats them, unless the client stops checking certificates. In Python this looks like verify=False in requests, which often slips into data-download and scraping scripts “to make an error go away”. That single argument turns TLS into encryption with an unknown party.

AI link. Metadata leaks matter for LLMs. Researchers have shown that the sizes and timing of packets in encrypted, streamed LLM responses can reveal what a conversation is about, because tokens are sent one by one. Encryption hid the words but not their rhythm. Mitigations include padding and batching tokens.

Network defenses

• Firewalls allow or deny traffic by address, port and protocol. Default-deny inbound traffic.
• Segmentation splits the network into zones, so a compromise in one zone cannot reach the others freely.
• Egress filtering controls outbound traffic. It is underrated and crucial: it stops data exfiltration and blocks malware from calling home. For AI agents, it is often the single strongest control.
• Private networking keeps databases, model servers and internal tools off the public internet entirely, reachable only through a VPN or bastion host.
• Zero trust drops the idea of a trusted inside network: every request is authenticated and authorized, wherever it comes from.
• DDoS protection - CDNs and edge networks absorb floods before they reach you.
• Monitoring - flow logs and intrusion detection show who talks to whom.

What an attacker sees

Attackers start with reconnaissance. Internet-wide scanners continuously index every exposed service, so a newly exposed service is often found within hours. ML tooling is a frequent victim, because many tools assume they run on a trusted laptop or private network and ship with no authentication: notebook servers, cluster dashboards, experiment trackers, vector databases and local model servers. Exposing one to the internet can hand an attacker code execution on GPU machines, along with every credential stored there.

Questions to ask

• Which services are reachable from the internet, and should each one be?
• Does anything trust a request because of its source IP or network location?
• Is every connection encrypted and certificate-verified, including internal ones and scripts?
• What outbound connections can this workload make? Could it send data anywhere?
• What does traffic metadata - sizes, timing, destinations - reveal, even when encrypted?
• If one machine on this network is compromised, what else can it reach?