Cybersecurity Roadmap

Learn how to secure networks, applications, and systems against digital threats.

Overall Progress0%

Network Security

Explanation

Network security is the practice of protecting the systems, traffic, and boundaries of a network so that only intended communication happens. It applies the CIA Triad to everything that moves between hosts: keeping data confidential in transit, ensuring it is not altered, and keeping services reachable when they should be. This lesson builds a defensive mental model of a network. You will learn the attack surface, how to segment a network into security zones, how firewalls and ACLs enforce policy, the difference between detecting and preventing attacks (IDS vs IPS), how VPNs and TLS protect communication, and how zero trust changes the classic perimeter assumption. The running example is an enterprise network divided into zones. Everything here is conceptual and defensive: you will reason about policies and detections, never about attacking a real network.

What Network Security Protects

Confidentiality: only authorized parties can read traffic (encryption, segmentation).
Integrity: traffic is not modified in transit (TLS, checksums, detection).
Availability: services remain reachable (redundancy, DDoS mitigation).
Accountability: traffic and changes are logged and attributable.

The Network Attack Surface

Every reachable service, port, and protocol is a potential way in. Reducing attack surface means closing what is not needed.

Open ports and unnecessary services.
Plaintext protocols that leak credentials.
Trust-based protocols such as ARP and DNS.
Weak or default device credentials (routers, switches, firewalls).
Unpatched network devices and firmware.

Defense in Depth and Security Zones

A single firewall is a single point of failure. Defense in depth layers multiple controls so that if one fails, others still protect. Zones group systems by trust level and enforce policy at the boundaries between them.

Internet

↓

Edge Firewall

↓

DMZ

↓

Internal Firewall

↓

Application Network

↓

Database Network

The DMZ hosts internet-facing services (web servers). Even if a DMZ host is compromised, the internal firewall still separates it from the application and database networks.

Network Segmentation

Segmentation divides a network into smaller zones (VLANs, subnets, or micro-segments) so a breach in one zone cannot spread freely to another.

Benefit	How it helps
Blast-radius reduction	Limits how far a compromise can move
Least privilege	Only required cross-zone traffic is allowed
Monitoring	Zone boundaries are natural inspection points
Compliance	Keeps sensitive data in isolated segments

Firewalls

A firewall enforces a policy about which traffic may pass a boundary, based on rules that match addresses, ports, and protocols.

Stateful: tracks the state of connections and allows return traffic for established connections.
Stateless: evaluates each packet independently with no memory of prior packets.
Application (proxy/WAF): inspects traffic at the application layer, not just headers.

Packet Filtering and ACLs

Packet filtering checks each packet against rules. An Access Control List (ACL) is an ordered list of rules applied top to bottom; the first match wins.

Field	Example	Meaning
Source address	10.0.1.0/24	Traffic from this subnet
Destination address	10.0.2.10	A specific internal host
Protocol / port	TCP 443	HTTPS only
Action	PERMIT / DENY	Allow or drop

Syntax

Conceptual firewall rulestext

1# Concept: allow web clients to reach the DMZ web server over HTTPS2PERMIT tcp from ANY to 203.0.113.10 port 4433 4# Concept: allow the DMZ web server to reach the internal DB only5PERMIT tcp from 203.0.113.10 to 10.0.2.20 port 54326 7# Concept: default deny — block everything else8DENY all

These are illustrative policy statements, not a real vendor syntax. Real rules follow the same shape: match, then permit or deny, with a default deny at the end.

NAT and Its Security Implications

NAT hides internal private addresses behind one public address.
It is not a firewall by itself; it only rewrites addresses.
It limits inbound connections by default, which adds a thin layer of obscurity.
It can complicate logging and attribution if not correlated with firewall logs.

IDS vs IPS

An Intrusion Detection System (IDS) detects and alerts; an Intrusion Prevention System (IPS) detects and blocks. IPS sits inline in the traffic path, so a mistake can break availability, while IDS sits out of band and only observes.

	IDS	IPS
Placement	Out of band (copy of traffic)	Inline (in the path)
Action	Detects and alerts	Detects and blocks/prevents
Risk	Low — cannot block	Higher — can drop legitimate traffic
Use	Visibility, forensics	Automated prevention

Signature vs Anomaly Detection

Approach	How it works	Strength	Weakness
Signature	Matches known attack patterns	Low false positives for known attacks	Misses unknown/new attacks
Anomaly	Flags deviations from a learned baseline	Can find novel attacks	More false positives; needs tuning

VPNs

A Virtual Private Network creates an encrypted tunnel across an untrusted network so traffic is confidential and tamper-evident.

	Remote Access VPN	Site-to-Site VPN
Who connects	Individual users / devices	Whole networks / offices
Scale	Per user	Permanent tunnel between sites
Typical use	Remote workers	Connecting branch offices or clouds

TLS and Secure Network Communication

TLS provides confidentiality, integrity, and server (and optionally client) authentication.
It protects application traffic such as HTTPS, not just VPNs.
Modern deployments use TLS 1.2/1.3; older versions are disabled.
TLS protects data in transit; it does not protect a compromised endpoint.

Network Monitoring and Logging

Collect flow data and device logs centrally.
Correlate firewall, IDS/IPS, and endpoint logs.
Watch for anomalies: unexpected hosts, port scans, large egress transfers.
Baseline normal traffic so deviations stand out.

Network Hardening

Inventory devices, ports, and services.
Disable unused services and ports.
Segment the network into zones.
Apply least-privilege firewall rules with a default deny.
Encrypt with TLS/VPN and disable plaintext protocols.
Patch devices and firmware; change default credentials.
Centralize and monitor logs.

Zero Trust Networking

Assume the network is hostile; do not trust something just because it is "inside".
Authenticate and authorize every request, every time.
Grant least-privilege access per session, not broad network access.
Segment and encrypt so lateral movement is difficult.

Common Network Attacks (Defensive View)

Attack	Concept	Defense
DoS / DDoS	Overwhelm a service with traffic	Rate limiting, redundancy, scrubbing
ARP spoofing	Attacker answers ARP with their MAC	Monitoring, static entries, network segmentation
DNS attacks	Poisoning or hijacking name resolution	DNSSEC, monitoring, trusted resolvers
Man-in-the-middle	Intercepting traffic in transit	TLS, mutual authentication, VPNs

Examples

Reasoning about a firewall rule

A web server in the DMZ needs to reach the database, but the internet must not.

text

1Internet ──X──> Database  (denied)2Web (DMZ) ──OK──> Database (permit tcp 10.0.2.20:5432)3Internet ──OK──> Web (DMZ) (permit tcp 203.0.113.10:443)

Output

(the database is reachable only from the application tier)

Where IDS vs IPS belongs

You want visibility on the whole network but only want to block at the edge.

text

1Edge:  IPS (block known attacks before they reach the inside)2Core:  IDS (detect and alert on traffic already inside)3DMZ:  IDS (watch for lateral movement)

Output

(prevent at the perimeter, detect deeper inside)

Key Takeaways

Network security enforces confidentiality, integrity, and availability for traffic.
Segment networks into zones to contain breaches and apply least privilege.
Firewalls enforce policy with ordered rules; default deny is essential.
IDS detects/alerts; IPS detects and blocks — prevention carries more risk.
TLS and VPNs protect data in transit; monitoring makes anomalies visible.
Zero trust removes the implicit trust of the network perimeter.

← PreviousIdentity & Access Management Next →Cloud Security