5.4. Secure Communication Channels
💡 First Principle: Understanding attack patterns is prerequisite to designing defenses — you cannot defend against what you don't understand. But understanding attacks is not the goal of a security architect; understanding what defensive architecture systematically defeats classes of attacks is. The goal is to make attacks infeasible, not merely difficult.
Network attacks can be categorized by their objective: disruption (DoS/DDoS), interception (MITM, sniffing), unauthorized access (exploitation, privilege escalation), and manipulation (injection, spoofing). Each category requires different defensive controls, and understanding which control addresses which objective is the core Domain 4 exam competency.
Why this matters: Attack scenario questions dominate Domain 4. You will be given a description of an attack (symptoms, traffic patterns, evidence) and asked to identify it and/or the appropriate defensive control. Recognition requires knowing the mechanism; control selection requires knowing what architectural element defeats it.
⚠️ Common Misconception: "IDS/IPS at the perimeter catches all attacks." Perimeter IDS/IPS only sees traffic crossing the perimeter. Lateral movement between internal systems (which represents the most dangerous phase of a sophisticated attack) is invisible to perimeter controls. Internal network monitoring, east-west traffic inspection, and endpoint detection are required to catch post-breach lateral movement.
