Network Security Concepts
Network Security Concepts
Network security is the disciplined protection of information, systems, and services. This chapter connects threats and vulnerabilities to risk, the CIA triad, encryption and PKI, AAA, identity controls, compliance, and audit evidence.
Security Supports the Organization
Earlier systems were often protected partly by physical isolation. Modern networks connect users, partners, mobile devices, cloud services, and remote locations, increasing both their usefulness and their exposure. Network security therefore combines technical controls, policies, processes, training, physical protection, and continuous monitoring.
Asset
Anything valuable that must be protected: information, identities, devices, services, facilities, reputation, or business operations.
Control
A safeguard that reduces likelihood or impact. Examples include firewalls, MFA, encryption, backups, training, and documented procedures.
Residual risk
The risk remaining after controls are applied. Security reduces and manages risk; it cannot guarantee that every threat disappears.
Threat, Risk, and Security Control
A threat is a potential cause of harm. A vulnerability is a weakness that could be exploited. Risk expresses the possibility that a threat will exploit a vulnerability and produce an adverse impact. A control reduces the likelihood, impact, or both.
External threats
Originate outside the organization, such as threat actors delivering ransomware, malware, or denial-of-service traffic.
Internal threats
Come from employees, contractors, or trusted accounts. They may be malicious or may misuse privileged knowledge and access.
Unintentional threats
Include weak passwords, accidental disclosure, phishing mistakes, and misconfiguration. Training and guardrails reduce these events.
Threats also include non-malicious physical and environmental events such as fire, flood, equipment failure, and power loss. Risk analysis must consider both probability and business impact.
Vulnerability, CVE, Zero-Day, and Exploit
| Term | Meaning | Example or distinction |
|---|---|---|
| Vulnerability | A weakness in hardware, software, configuration, process, or physical protection | An unpatched service or default password |
| CVE | A standardized identifier for a publicly known vulnerability | It supplies a common name; other databases provide scores and detail |
| Zero-day vulnerability | A newly discovered flaw without an available fix or effective workaround | “Zero days” of advance remediation time |
| Zero-day exploit | An attack or technique actively using that unpatched flaw | The vulnerability is the weakness; the exploit acts on it |
| Exploit | Code, a method, or a technique that takes advantage of a vulnerability | May be used by attackers or authorized security testers |
Patching removes many known weaknesses, but no system can be assumed vulnerability-free. Defense in depth, least privilege, segmentation, monitoring, secure configuration, and incident readiness reduce the impact when prevention fails.
Confidentiality, Integrity, and Availability
The CIA triad describes what security controls are trying to preserve. A well-designed network balances all three objectives rather than maximizing one at the expense of the others.
Confidentiality
Only authorized subjects can access information. Authentication, authorization, encryption, segmentation, firewalls, and physical controls support confidentiality.
Integrity
Information remains accurate, complete, and protected against unauthorized alteration. Hashes, digital signatures, checksums, ACLs, and change controls support integrity.
Availability
Authorized users can access systems and information when required. Redundancy, fault tolerance, backups, capacity planning, and recovery procedures support availability.
Data States and Encryption Methods
| Data state | Meaning | Typical protection |
|---|---|---|
| Data at rest | Stored on disks, databases, removable media, or backups | Full-disk, file, database, or backup encryption |
| Data in transit | Moving across a network or between systems | TLS, IPsec, SSH, VPNs, and secure application protocols |
| Data in use | Being processed, usually in memory | OS isolation, access controls, secure applications, and specialized memory protection |
Symmetric encryption
The same shared secret key encrypts and decrypts. It is efficient for large amounts of data, but the key must be distributed and protected securely.
Think: one secret key, high speed, difficult key sharing.
Asymmetric encryption
A mathematically related public/private key pair performs complementary operations. It enables identity verification, digital signatures, and secure key establishment, but is slower.
Think: public key may be shared; private key must remain secret.
Real protocols often use both: asymmetric mechanisms authenticate parties and establish a session secret, then fast symmetric encryption protects the bulk data. Encryption supports confidentiality, while digital signatures can support integrity, authenticity, and non-repudiation.
Certificates and Public Key Infrastructure
A digital certificate binds an identity—such as a website or organization—to a public key. Public Key Infrastructure (PKI) provides the people, policies, hardware, software, and procedures used to issue, manage, validate, revoke, and renew certificates.
Public CA
Its root certificates are commonly trusted by browsers and operating systems. Appropriate for public-facing services requiring broad trust.
Private CA
Operated for an organization’s internal needs. Clients must receive and trust the organization’s root certificate securely.
Self-signed certificate
Signed with its own private key rather than by a trusted CA. It can encrypt traffic, but identity trust must be established manually.
The Certificate Revocation List (CRL) identifies certificates revoked before expiry. Authority Information Access (AIA) points clients toward issuer information and, depending on the certificate, validation services. Private keys must never be placed in public trust stores or shared as if they were certificates.
The AAA Model
Authentication
Who are you? Verifies a claimed identity using credentials and authentication factors.
Authorization
What may you do? Determines the resources and operations available after identity is verified.
Accounting
What happened? Records logins, sessions, commands, resource usage, and other events for monitoring and audit.
Authentication factors include something you know (password), have (token), are (biometric), somewhere you are (location), and something you do (behavioural characteristic). Multifactor authentication (MFA) combines factors from at least two different categories—not merely two passwords.
SSO, SAML, RADIUS, TACACS+, and LDAP
| Technology | Primary purpose | Transport / port | Exam distinction |
|---|---|---|---|
| SAML | Exchanges XML-based authentication and authorization assertions between an identity provider and service provider | Normally carried through web protocols | Commonly supports federated SSO using claims/assertions |
| RADIUS | Centralized network access AAA | UDP 1812 authentication; UDP 1813 accounting | Common for VPN, wireless, and 802.1X network access |
| TACACS+ | Centralized administrative AAA for network devices | TCP 49 | Separates authentication, authorization, and accounting; encrypts the packet body |
| LDAP | Queries and modifies directory information | TCP/UDP 389; LDAPS commonly TCP 636 | Directory access is not itself the complete AAA model |
An identity provider (IdP) authenticates a user and supplies an assertion or token to a service provider (SP). SSO reduces repeated logins, but the central identity service becomes highly important and should be protected with MFA, resilient design, secure federation configuration, and monitoring.
Authorization, IAM, Least Privilege, RBAC, and Geofencing
Identity and Access Management
IAM governs identity creation, authentication, authorization, role changes, reviews, and deprovisioning across the identity life cycle.
Least privilege
Grant only the minimum access needed, for only as long as needed. Remove permissions when duties or employment change.
Role-Based Access Control
RBAC assigns permissions to job roles, then assigns users to those roles. This scales better than managing every user permission separately.
Geofencing
Allows, denies, or challenges access according to geographic location. Because location can be imprecise or spoofed, it should be one signal among several.
Authorization occurs after authentication but must still be checked for every protected action. Periodic access reviews, separation of duties, privileged access management, and immediate deprovisioning reduce excessive or stale privileges.
Accounting, Regulatory Compliance, and Audits
Accounting produces the evidence needed to reconstruct access and activity. Useful logs identify who acted, what occurred, when it happened, where it originated, the result, and the affected resource. Centralized collection, time synchronization, access protection, retention rules, and monitoring make those records reliable.
| Requirement | Primary scope | Common association |
|---|---|---|
| GDPR | Personal data and privacy rights in the European Union / EEA context | Lawful processing, protection, and data-subject rights |
| HIPAA | Protected health information in covered U.S. healthcare contexts | Healthcare privacy and security |
| PCI DSS | Cardholder-data environments | Payment-card security standard |
| SOX | Financial reporting controls for applicable U.S. public companies | Integrity and accountability of financial reporting |
| FERPA | Student education records in the United States | Education-record privacy |
| GLBA | Customer financial information at applicable U.S. financial institutions | Financial privacy safeguards |
Compliance requirements are translated into policies, standards, processes, and procedures. An internal audit is performed by or for the organization to assess its controls. An external audit provides independent examination. An audit verifies evidence against criteria at a point or period in time; it does not prove permanent security.
Match the Scenario to the Security Concept
Select a scenario to reveal the most relevant concept and the reasoning behind it.
The best concept, protocol, or control will appear here.