Why This Matters#

Networks carry all data between systems. If an attacker controls the network, they can intercept, modify, or block any communication. Network security creates boundaries, monitors traffic, and ensures only authorized communication occurs.

Defense in Depth#

No single control is sufficient. Layer defenses so that if one fails, others still protect:

flowchart TD
    Internet["Internet (untrusted)"]
    Internet --> Edge["Edge Security<br/>DDoS protection, CDN, WAF"]
    Edge --> Perimeter["Perimeter Firewall<br/>Stateful inspection, IPS"]
    Perimeter --> DMZ["DMZ<br/>Reverse proxies, public-facing services"]
    DMZ --> Internal["Internal Firewall<br/>Micro-segmentation"]
    Internal --> App["Application Layer<br/>Input validation, auth"]
    App --> Data["Data Layer<br/>Encryption at rest, access controls"]

Firewalls#

Types#

Firewall Rule Design#

Rules are evaluated top-to-bottom, first match wins:

Principles:

• Default deny — block everything, allow only what’s needed
• Most specific rules first
• Log denied traffic for visibility
• Review rules regularly (remove stale entries)

Network Segmentation#

Divide the network into isolated zones to limit blast radius:

flowchart TD
    Internet["Internet"] --> LB["Load Balancer<br/>(DMZ)"]
    LB --> Web["Web Tier<br/>(VLAN 10)"]
    Web --> App["App Tier<br/>(VLAN 20)"]
    App --> DB["Database Tier<br/>(VLAN 30)"]
    
    Admin["Admin Network<br/>(VLAN 100)"] --> Web
    Admin --> App
    Admin --> DB
    
    style DB fill:#51cf66
    style Internet fill:#ff6b6b

Segmentation Methods#

Zero Trust Architecture#

Traditional model: “trust inside the perimeter, verify outside.” Zero Trust: “never trust, always verify” — regardless of network location.

Principles#

Zero Trust Components#

flowchart LR
    User["User + Device"] --> PEP["Policy Enforcement<br/>Point (proxy)"]
    PEP --> PDP["Policy Decision<br/>Point (engine)"]
    PDP --> Signals["Context Signals"]
    
    Signals --> Identity["Identity<br/>(who)"]
    Signals --> Device["Device Health<br/>(what)"]
    Signals --> Location["Location<br/>(where)"]
    Signals --> Behavior["Behavior<br/>(how)"]
    
    PEP -->|"Allow/Deny"| Resource["Protected<br/>Resource"]

Zero Trust vs Traditional#

Intrusion Detection and Prevention#

IDS vs IPS#

Detection Methods#

Network Detection and Response (NDR)#

Modern evolution of IDS — uses ML to detect threats in network traffic:

• Encrypted traffic analysis (metadata, not content)
• Lateral movement detection
• Data exfiltration patterns
• Beaconing (C2 communication patterns)

VPN and Secure Remote Access#

VPN Types#

VPN vs Zero Trust Network Access (ZTNA)#

DNS Security#

DNS is often overlooked but critical — it’s used in many attacks:

DNSSEC#

Adds cryptographic signatures to DNS responses — clients can verify responses are authentic:

Root (.) → signs → .com → signs → example.com → signs → A record

DDoS Protection#

Attack Types#

Mitigation Layers#

Network Monitoring#

What to Monitor#

Indicators of Network Compromise#

Key Takeaways#

1. Defense in depth — layer firewalls, segmentation, IDS/IPS, monitoring
2. Default deny — block everything, allow only what’s explicitly needed
3. Zero Trust is the future — network location should not grant trust
4. Segment aggressively — limit blast radius of any compromise
5. Monitor everything — you can’t detect what you can’t see
6. DNS is a blind spot — monitor DNS traffic, implement DNSSEC
7. VPNs are being replaced by ZTNA for better security and UX