Defense in Depth#

Network security uses multiple layers — if one fails, others still protect:

flowchart TD
    Internet["Internet"]
    Internet --> Edge["Edge: WAF, DDoS protection"]
    Edge --> FW["Perimeter: Firewall"]
    FW --> SG["Host: Security Groups / iptables"]
    SG --> App["Application: Auth, input validation"]
    App --> Data["Data: Encryption at rest"]

Firewalls#

Types#

Stateful vs Stateless#

Security Group Example (AWS)#

Inbound Rules:
  Allow TCP 443 from 0.0.0.0/0        (HTTPS from anywhere)
  Allow TCP 22 from 10.0.0.0/16       (SSH from VPC only)

Outbound Rules:
  Allow All traffic to 0.0.0.0/0       (default — allow all outbound)

Principle of least privilege: Only open ports that are needed, only from sources that need access.

NAT (Network Address Translation)#

Allows private IPs to communicate with the internet through a shared public IP:

flowchart LR
    subgraph Private["Private Network"]
        A["10.0.1.10"]
        B["10.0.1.11"]
        C["10.0.1.12"]
    end
    
    Private --> NAT["NAT Gateway<br/>203.0.113.5"]
    NAT --> Internet["Internet"]

NAT Types#

In AWS: NAT Gateway provides SNAT for private subnets.

VPN (Virtual Private Network)#

Encrypted tunnel over public internet — extends a private network:

flowchart LR
    Office["Office<br/>10.0.1.0/24"] <-->|"Encrypted Tunnel<br/>(over Internet)"| Cloud["AWS VPC<br/>10.0.2.0/24"]

VPN Types#

TLS/SSL#

Encrypts data in transit between client and server (covered in detail in HTTP/HTTPS section).

mTLS (Mutual TLS)#

Both sides present certificates — used for service-to-service communication:

sequenceDiagram
    participant A as Service A
    participant B as Service B
    
    A->>B: ClientHello + Client Certificate
    B->>A: ServerHello + Server Certificate
    Note over A,B: Both verify each other's identity
    Note over A,B: Encrypted channel established

Use cases: microservice mesh, API gateways, zero-trust networks.

Common Attack Types#

Network Segmentation#

Isolate workloads to limit blast radius:

flowchart TD
    subgraph Public["Public Subnet (DMZ)"]
        LB["Load Balancer"]
    end
    subgraph Private["Private Subnet"]
        App["App Servers"]
    end
    subgraph Data["Data Subnet"]
        DB["Databases"]
    end
    
    Internet --> LB
    LB --> App
    App --> DB
    DB -.-x Internet

Zero Trust#

Traditional: “Trust everything inside the network perimeter.” Zero Trust: “Never trust, always verify.”

Key Takeaways#

1. Defense in depth — multiple layers, not a single firewall
2. Least privilege — only open what’s needed, from where it’s needed
3. Stateful firewalls (Security Groups) track connections automatically
4. NAT hides private IPs behind a public IP
5. TLS everywhere — encrypt all traffic, even internal
6. Segment networks — public, private, data zones with strict boundaries
7. Zero trust — verify every request regardless of network location