Network security for a settlement means defending against the people and accidents that can actually reach the network: insiders with legitimate accounts, anyone with physical access to the cables and machines, malware carried in on salvaged disks, and the network’s own mistakes. A network with no outside connection has no remote attackers, so the first defences are physical and procedural: a locked equipment room, few running services, accounts with only the access they need, a firewall that refuses by default, and backups kept offline. Encryption and monitoring come after those, not instead of them.
Part of Networking
Deciding what a settlement network needs to be protected from, and which of the defences in the following articles to build first.
Protect Against The Threats That Can Reach You, Not The Ones In The Textbooks
Most network-security material assumes the internet: anonymous attackers probing a server from anywhere. A settlement network joined only to its neighbours has none of that. The threats that remain are closer, and some are worse because they are trusted.
The carrier Internet Infrastructure sets the tone: the best defence of a rebuilt network is simplicity. Run only the services you need, remove or disable everything else, and review what is running regularly, because an unused service is an unmonitored attack surface. It also lists physical security (a locked, climate-controlled room, battery backup, an offline backup and the topology written on paper) alongside the firewall and encryption advice.
| Threat | Example | First defence | Article |
|---|---|---|---|
| Someone with a legitimate account doing harm or making a mistake | a deleted shared folder | least privilege, groups, backups | Access Control |
| Someone plugging into the network | a laptop on a spare wall socket | locked rooms, unused ports off, encryption | Encryption Basics |
| Software carried in on a disk | an infected salvaged drive | scan and isolate media before connecting | this article |
| Misconfiguration | a second DHCP server, an open relay | documentation, review | Firewalls |
| Hardware failure and loss | a failed disk | mirrors and offline copies | Server Deployment |
| An unnoticed intrusion | an account in use at 3 a.m. | logs read by a person | Intrusion Detection |
What You Need
- A list of what you are protecting — the shared library, mail, the clinic’s records, the server room
- A list of who can reach each of them, by account and by physical access
- The time to read logs — a defence nobody checks is decoration
Method: Secure The Network In Order
Step 1: Lock the places where the network can be touched The equipment room, the wiring closets, the spare wall sockets. Network Interface explains why: on a hub-based network a machine in capture mode sees all traffic on the segment, and on a switched one a mirror port or tap does the same, so anyone who can plug in can listen.
Step 2: Remove what is not needed Services, accounts, open ports. Check the list of listening programs (Core Protocols).
Step 3: Give each person only what they need Access Control.
Step 4: Set the firewall to refuse by default Firewalls.
Step 5: Encrypt what must not be read on the wire Encryption Basics; the carrier says SSH for remote administration, never telnet.
Step 6: Treat incoming media as unsafe Connect a salvaged disk or a drive from another place to a machine that is not on the network, copy off only what you need, and read the files before trusting them (general knowledge).
Step 7: Keep offline backups and a paper diagram, and review monthly The carrier gives these as standing rules.
Worked Example: Ranking A Small Settlement’s Risks
A settlement of one clinic, one workshop and a library, on one switch, with a server in a room that has a door but no lock. Using the table: the likeliest harm is an accidental deletion (insider, no malice), then a failed disk, then a visitor who plugs a machine into a spare socket in the clinic. The one with the largest consequence is the open server room. The order of work is therefore: lock the server room, mirror and back up the disks, set group permissions, switch off unused wall sockets (or the switch ports behind them), then the firewall, then encryption. Remote attack comes last because it has no route to the network. The ranking is a judgement for this invented settlement, not a measurement.
Common Mistakes
- Starting with encryption while the server room is unlocked — a thief walks away with the disk
- Trusting everyone on the inside equally — most damage is accidental
- Believing a firewall protects the inside — it filters what crosses it; it does nothing for an insider (Firewalls)
- Treating security as a one-time install — services change, people come and go; review
What’s Next
- Learn next: Firewalls — deciding what may cross each router
- Combine with: Access Control — who may do what once inside