Network Security

What is Network Security?

Network Security consists of the policies, processes, and technologies deployed to prevent, detect, and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources. Operating across multiple layers of the OSI model, network security targets both external threats (like internet hackers) and internal threats (like compromised corporate devices or malicious insiders).

Because computer networks carry critical business transactions, proprietary data, and personal credentials, establishing a robust network security posture is a fundamental component of information assurance and compliance programs.

Common Network Threat Vectors

Network attacks exploit vulnerabilities in protocols, hardware configurations, or human choices. Common attacks include:

• Man-in-the-Middle (MitM) — An attacker intercepts and potentially alters communication between two nodes without their knowledge. Commonly executed on unencrypted public Wi-Fi networks using tools to capture logins or session cookies.
• DDoS (Distributed Denial of Service) — A coordinated attack using a network of compromised machines (botnets) to flood a target server or network boundary with traffic, exhausting resources and making services unavailable to legitimate users.
• ARP Poisoning (ARP Spoofing) — A local link attack where an attacker broadcasts forged Address Resolution Protocol messages to associate their MAC address with the IP address of a legitimate gateway router, routing local traffic through the hacker's machine.
• IP Spoofing — The creation of IP packets with a forged source IP address to impersonate a trusted computer system or hide the identity of the sender during DDoS attacks.
• Eavesdropping (Sniffing) — The unauthorized capture and analysis of raw network packets using software like Wireshark. If traffic is unencrypted, the sniffer can read passwords and private payloads.

Core Network Defense Mechanisms

Organizations deploy multiple layers of defensive technologies to block and mitigate these threats:

Defense Tool	Primary Layer	Key Function	How It Blocks Threats
Firewall (NGFW)	Layers 3 / 4 / 7	Monitors and filters traffic based on security rules.	Blocks unauthorized port connections and inspects packet payloads. See VPN & Firewall.
IDS / IPS	Layers 3 / 4 / 7	Intrusion Detection (IDS) monitors and alerts; Intrusion Prevention (IPS) actively blocks.	Analyzes packet patterns for known signatures of attacks (like port scans or malware execution).
VPN	Layer 3 / 4	Creates an encrypted tunnel for remote data transit.	Secures connections across untrusted WANs (like public Wi-Fi), preventing eavesdropping.
NAC (Network Access Control)	Layer 2	Enforces security policies before allowing devices to connect.	Verifies device security posture (updated antivirus, patches) before granting network access.

The AAA Security Framework

To control access to critical systems and document administrator actions, network security relies on the **AAA Framework**:

1. Authentication — Verifying the identity of the user requesting access. This answers the question: *"Who are you?"* (Achieved via usernames, passwords, MFA tokens, or biometric scans).
2. Authorization — Determining what resources and actions the authenticated user is allowed to access. This answers the question: *"What are you allowed to do?"* (Achieved via Access Control Lists (ACLs) and Role-Based Access Control (RBAC)).
3. Accounting — Tracking and logging the user's activity while they are connected to the network. This answers the question: *"What did you do?"* (Logs file edits, commands run, connection duration, and login timestamps). Accounting is vital for security audits and forensic analysis.

Data in Transit vs. Data at Rest Encryption

Comprehensive security requires protecting data at all stages of its lifecycle:

• Data in Transit Encryption: Protecting packets as they travel across network cables or wireless links. This prevents eavesdropping and sniffing attacks. Standard protocols include **HTTPS (TLS)**, **SSH**, and **IPsec VPNs**.
• Data at Rest Encryption: Protecting data when it is stored on physical media (hard drives, database servers, backup tapes). This ensures that if the physical drive is stolen, the data remains unreadable without the decryption key. Standard methods include BitLocker, database encryption, and cloud storage bucket encryption.

Frequently Asked Questions (FAQ)

❓ What is the difference between an IDS and an IPS?

An **IDS (Intrusion Detection System)** is a passive monitoring tool. It analyzes traffic and sends alerts to security administrators if it detects suspicious activity, but does not block the traffic. An **IPS (Intrusion Prevention System)** is an active inline device that analyzes traffic and immediately blocks packets or resets connections if an attack signature is identified.

❓ How does a DDoS attack work and how can it be mitigated?

A DDoS attack uses thousands of distributed computers (botnets) to flood a target with traffic, exhausting server CPU, RAM, or bandwidth. Mitigation involves using scrubbing centers (like Cloudflare) that filter incoming traffic, dropping malicious botnet packets at the network edge while allowing legitimate user packets to reach the web server.

❓ What is a Network Access Control (NAC) system?

A NAC system is a gatekeeper for local networks. When a laptop or IoT device connects (via Ethernet or Wi-Fi), the NAC inspects the device. If the device lacks required security updates, has disabled firewalls, or shows signs of infection, the NAC places it in an isolated guest VLAN to prevent it from infecting the rest of the corporate network.

❓ Why is the Accounting phase of AAA critical for incident response?

Accounting is critical because it creates an unalterable audit trail. If a security breach occurs, security teams consult the accounting logs to determine exactly which user account was used, what files were accessed, what commands were executed, and the exact timestamp of the compromise, allowing them to contain the breach and patch the entry point.

What's Next?

Advance your network technology studies:

• Learn diagnostic tools to detect network vulnerabilities in Network Troubleshooting.
• Explore how virtualization shifts security boundaries in SDN & Virtualization.
• Learn how TLS encrypts web data in HTTP & HTTPS.
• Study the core security guidelines in Cyber Security.