D4 — Firewalls, VPNs & Wireless Security

Lesson 6 covered the OSI model as a security map and segmentation's purpose. This lesson covers the specific technologies that implement network-layer defense and secure connectivity in practice — firewalls, VPNs, and wireless security — each with a specific generational or architectural distinction the exam tests precisely.

Firewall generations: what each actually inspects

• Packet-filtering (stateless) — inspects each packet in isolation against static rules (source/destination IP, port, protocol). No memory of prior packets, so it can't distinguish a legitimate response packet from an unsolicited one with the same header values — cheap and fast, but structurally blind to context.
• Stateful inspection — tracks connection state (a state table of established sessions), so it can verify a packet belongs to a legitimate, already-permitted conversation. This is the meaningful generational leap: stateful firewalls can allow a response packet through specifically because it matches an outbound request already tracked, something stateless filtering cannot reason about at all.
• Next-generation firewall (NGFW) — adds application-layer awareness on top of stateful inspection: it can identify the actual application/protocol regardless of port (distinguishing, say, disguised traffic on port 443 that isn't really HTTPS), integrate intrusion prevention, and apply identity-aware policies. The generational jump from stateful to NGFW is inspecting what the traffic actually is, not just whether it fits an allowed connection pattern.

The exam-relevant point: a stateless packet filter and a stateful firewall can enforce the identical rule ("allow inbound on port 443") and still behave completely differently for a crafted packet that spoofs a response without a real preceding request — only the stateful firewall's connection tracking catches that.

VPNs: IPsec's two modes, and the metadata trade-off

IPsec secures IP traffic, and operates in one of two modes with a specific, frequently tested difference:

• Transport mode — encrypts only the payload of the IP packet; the original IP header (source/destination addresses) remains visible. Typically used for host-to-host communication within a trusted network.
• Tunnel mode — encrypts the entire original IP packet, including its header, and wraps it in a new IP header for routing between the endpoints. This is what site-to-site and most remote-access VPNs use, because it hides the original source/destination from anyone observing traffic between the VPN endpoints.

The trade-off: transport mode leaks routing metadata (who is talking to whom) even though the payload is protected; tunnel mode protects that metadata too, at the cost of additional overhead (an extra IP header) and typically requiring a VPN gateway at each end rather than pure host-to-host simplicity.

Wireless security: what WPA3 actually fixed

WPA2's 4-way handshake (used to derive a fresh session key between a client and access point) had a structural flaw exploited by the KRACK attack: an attacker could force a key reinstallation by replaying a specific handshake message, tricking the client into resetting its encryption nonce, which could then allow decryption or injection of traffic. Note precisely what this attack targeted — not the underlying encryption algorithm's math, but the handshake protocol's state-management logic.

WPA3 addresses this at the protocol level, primarily through Simultaneous Authentication of Equals (SAE), which replaces the vulnerable pre-shared key exchange with a handshake resistant to offline dictionary attacks and structured to prevent the specific key-reinstallation pattern KRACK relied on. This is a useful pattern to recognize generally: a protocol-level vulnerability (in the handshake's state logic) requires a protocol-level fix (a redesigned handshake), not a stronger encryption algorithm layered on top of the same flawed handshake.

The CISSP mindset: manager vs technician

A company sets up remote access for employees using a VPN in transport mode, reasoning "the data is encrypted, so we're secure."

The technician answer: confirm the payload is encrypted end-to-end and consider the requirement met — confidentiality of the actual data is protected.

The manager (CISSP) answer: ask what's actually being protected against, given the full threat model. If an observer on the path between endpoints can still see which internal hosts are communicating with which external addresses (transport mode leaves the original IP header visible), that metadata alone can reveal sensitive information — which employee is connecting to which internal system, or the existence and pattern of a remote-access relationship at all — regardless of payload confidentiality. For remote access specifically, where hiding the internal network's topology from any observer on the path is usually part of the actual requirement, tunnel mode is the CISSP-correct choice, not because transport mode is "weaker" in the abstract, but because it doesn't protect the metadata this particular use case needs protected — the same "match the control to what property is actually required" reasoning from Lesson 10's crypto/integrity confusion.