Domain 4 covers the design and protection of networks: the OSI and TCP/IP layers, secure protocols, VPNs, wireless and cellular links, and the components that carry data between systems that do not trust each other.
Case Study: The "AirLink" Cellular Intercept (IMSI Catcher Attack)
CityBank deployed portable "AirLink" ATMs to a major music festival. The machines reached the bank's processing center over 4G/LTE modems on a private APN. The network engineers judged the carrier's link encryption and the private APN sufficient, and did not configure an IPsec tunnel or application-layer TLS. The transaction messages travelled in clear text above the cellular layer.
Criminals parked a rogue base station, an IMSI catcher, near the festival grounds and broadcast a stronger signal than the legitimate towers. The modems attached to it. The rogue station forced a downgrade from 4G, where the network and the device authenticate each other, to 2G GSM, where only the device authenticates. Now the attackers were the tower. They decrypted the 2G A5/1 stream, which has been practically broken for years, and read the application traffic underneath: customer track data and PIN blocks, captured in real time.
The white paper's section on network attacks covers this family: interception by a rogue device on the line, eavesdropping when the payload is not independently encrypted, and, one step further, modifying a host's "declined" into "approved" or impersonating the host outright, which is jackpotting by another route. It makes the same point the AirLink engineers missed: the value of sniffing depends entirely on whether TLS and a VPN are in place above the transport.
One organization each, three to six questions apiece in the printed examination. Nothing here gives an answer away — the scenario is what the question hands you before it asks.
CityBank deploys portable cash machines that reach its processing center over 4G modems. The network team relied on the carrier's link encryption and a private access point name, and configured neither IPsec nor TLS. At a music festival an attacker's rogue base station forced the modems down to 2G, broke the older link encryption and read cardholder track data in clear. The TLS-inspection and firewall infrastructure at the processing center observed nothing unusual throughout. Voice traffic on the same site links has separately become choppy every evening while bulk transfers run.
CityBank · portable AirLink cash machines
CityBank's incident commander must classify an event for the regulator. During it a rogue base station relayed every transaction between the machines and the carrier network while silently recording cardholder data, and machine service was never interrupted. Privacy counsel wants to know what the attackers could have learned from subscriber identity captures alone, before any traffic was decrypted. An engineer on the review board claims an IPsec tunnel to the processing center would have prevented the incident entirely. Staff handhelds at the same site were separately found to have had contact lists retrieved over Bluetooth.
CityBank · incident response
An auditor reopening CityBank's design file finds the original justification: the carrier's private access point name 'keeps the traffic private', so no further transit protection was configured. The bank also leases dark fiber between its two data centers, and the wide-area team argues that because the bank lights and operates that fiber itself, replication traffic across it can run unencrypted. A separate proposal would terminate an IPsec tunnel from each machine to the processing center. The mobile team must also cut the risk of further Bluetooth data theft from handhelds that still need Bluetooth for card sleds.
CityBank · network architecture
Meridian Transit Authority is agreeing a threat taxonomy for its fare payment network before it reports to the board. In one event an interposed device sat between two endpoints, read live traffic and injected its own. Architects separately worry that a compromised public certificate authority could issue attackers a valid certificate for the processing center's hostname, letting a future rogue network impersonate it. A flat operations network of 500 devices suffers periodic slowdowns from legitimate broadcast traffic reaching every host. Mall security has reported someone parked outside a station for hours with a laptop and a roof antenna.
Meridian Transit Authority · fare payment network
A workshop at Meridian Transit Authority still connects its five diagnostic machines through an old Ethernet hub. Technicians complain transfers slow sharply when several are busy, and a consultant has shown that a sniffer on any hub port captures every station's traffic. When a technician patched a second uplink through a third switch to give the workshop a backup path, the same broadcast frames began circulating endlessly and the segment slowed to a crawl. Tap-to-pay readers are being added to the fare machines, and a risk workshop is weighing how much protection the short operating range gives.
Meridian Transit Authority · station equipment workshop
Assume the carrier is hostile. Encrypt at the layer you control: an IPsec tunnel from modem to bank, and TLS 1.2 or later between the ATM application and the host with mutual certificate validation, so a spoofed host fails the handshake. Add a message authentication code to each transaction message; a forged approval then fails verification even if the tunnel is somehow breached. The white paper lists all three, TLS with mutual validation, VPN, and MACing, among its network controls.
Configure the modems for LTE only and disable 2G and 3G fallback. The default "stay connected at any cost" chose availability over integrity; for a cash dispenser, dropping the link is the safe failure. Monitor the modems for downgrade events and the host for response anomalies, and segment the festival fleet from the rest of the ATM network so a compromised unit is not a path inward, a risk the white paper calls out for any ATM connection.
The captured track data went to fraud. CityBank pulled the AirLink units, reissued the cards, and rebuilt the mobile ATM design with a tunnel, application TLS and LTE-only modems before the next event.
Expect questions on where encryption sits in the stack and why link encryption is not end-to-end encryption, on downgrade attacks and mutual authentication, on IPsec modes versus TLS, on wireless and cellular authentication, and on defense in depth as a network design principle instead of a slogan.
The bank in this scenario is a composite. The attack and the controls are documented in: