How the Internet Works — A Security View

You can't secure what you don't understand

Cybersecurity is, in large part, about protecting communication — data moving between computers over networks. So a security professional needs a solid grasp of how the internet actually works, viewed through the lens of "where could this be attacked?". This chapter builds that foundation. Don't worry if networking is new; we'll cover exactly what you need, with security always in mind.

How data travels: packets and protocols

When data moves across the internet, it's broken into small chunks called packets, each carrying a piece of the data plus addressing information (where it's from and where it's going). These packets travel across networks and are reassembled at the destination. The rules governing how this happens are called protocols — agreed languages computers use to communicate.

From a security view, every point where packets travel or are processed is a potential place for attack or defence. An attacker might try to intercept packets (to steal data), forge them (to impersonate), or flood a system with them (to overwhelm it). Understanding packets helps you understand both the threats and the protections.

IP addresses and the key protocols

Every device on a network has an IP address — its unique identifier, like a postal address. Several core protocols then govern communication, and each has security relevance:

• TCP/IP — the fundamental protocols that route packets and ensure reliable delivery across the internet.
• HTTP / HTTPS — how web browsers and servers communicate. HTTP is unencrypted (anyone intercepting it can read everything); HTTPS is encrypted (the secure version — the padlock in your browser). This difference is hugely important: never send sensitive data over plain HTTP.
• DNS — translates human-friendly names (like a website name) into IP addresses. It's a frequent attack target (e.g. tricking it to redirect users to fake sites).
• SSH — secure, encrypted remote access to servers. The safe way to administer a remote machine.

The recurring security theme: encrypted protocols (HTTPS, SSH) protect data in transit; unencrypted ones (HTTP, older protocols) expose it. A core defensive practice is ensuring sensitive communication always uses encrypted protocols.

Ports: the doors into a system

This is a crucial security concept. A single computer can run many network services at once — a web server, an email server, a database — so how does incoming traffic reach the right one? Through ports, numbered "doors" on a machine, each typically associated with a service:

# Common ports and their services:
#   Port 22   → SSH (secure remote login)
#   Port 80   → HTTP (web, unencrypted)
#   Port 443  → HTTPS (web, encrypted)
#   Port 3306 → MySQL database
#   Port 25   → Email (SMTP)

Here's why ports matter so much for security: every open port is a potential entry point for an attacker. A door that's open and unguarded is a way in. A key defensive principle is therefore to close every port you don't need and carefully protect the ones you do — this is called reducing your "attack surface". Attackers, in turn, often start by scanning to find which ports are open on a target (something only done legally, with authorisation, in testing).

Firewalls: controlling the doors

If ports are doors, a firewall is the guard deciding which traffic is allowed through them. A firewall enforces rules about what connections are permitted — for example, "allow web traffic on port 443, but block everything else". It's one of the most fundamental defensive tools:

# Conceptual firewall rules (the idea, simplified):
#   ALLOW  incoming traffic on port 443 (HTTPS)   → website works
#   ALLOW  incoming SSH on port 22 from office IP  → admins can manage
#   DENY   everything else                          → close all other doors

Well-configured firewalls dramatically reduce risk by ensuring only intended, necessary traffic gets through. The principle of "deny by default, allow only what's needed" is a cornerstone of network defence — it's the digital equivalent of locking every door and only opening the ones you must.

The layered view of attacks and defence

Putting it together, you can now see where security happens across the journey of data. An attacker might target any layer; a defender protects each one:

  USER → BROWSER → INTERNET → FIREWALL → SERVER → DATABASE
   │        │         │           │          │         │
  phishing  weak    intercept   open       software   stolen
  social    crypto  packets     ports      flaws      data
  tricks   (use      (use       (close     (patch &    (encrypt
           HTTPS)    HTTPS)      unused)    secure)    & control
                                                       access)

This layered thinking — recognising that security must be applied at every stage, because an attacker only needs one weak point — is fundamental. It's called "defence in depth": multiple layers of protection, so that if one fails, others still stand. With this networking-and-security foundation, you're ready to study the actual threats and attacks that target these systems, which is the next chapter.