MODULE 6 — Network Security Foundations
Learning Objectives
Learners should be able to:
- Analyse network-level threats and vulnerabilities.
- Explain firewall types and detection systems.
- Understand segmentation, zero-trust, and network trust boundaries.
- Evaluate architecture designs for security robustness.
Module Overview
Networks are the circulatory system of digital infrastructure.
Every packet, every request, every authentication event flows through networks.
As such, network security underpins confidentiality, integrity, and availability.
This module introduces the mechanisms that limit attacker movement and enforce trusted communication.
1. Foundations of Network Security
Attackers exploit:
- Unfiltered traffic
- Open ports
- Misconfigured firewalls
- Flat networks with no segmentation
- Weak authentication at network boundaries
Network security focuses on:
- Traffic control
- Segmentation
- Monitoring
- Attack detection
- Access verification
Networks fail loudly (outages) and quietly (lateral movement). Both must be defended.
2. Firewalls: The First Line of Digital Control
2.1 Packet Filtering Firewalls
Simple rule-based filtering using:
- IP addresses
- Ports
- Protocols
Strength: Fast
Weakness: No state awareness
2.2 Stateful Firewalls
Track connection states and block anomalous flows.
2.3 Next-Generation Firewalls (NGFW)
Add:
- Application-layer filtering
- Threat intelligence integration
- Malware inspection
- SSL/TLS inspection
These form a modern organisation’s primary perimeter control.
3. Intrusion Detection & Prevention
3.1 IDS (Intrusion Detection System)
Observes traffic, raises alerts, but does not block.
3.2 IPS (Intrusion Prevention System)
Inline system that:
- Analyses packets
- Drops malicious traffic
Detection methods:
- Signature-based
- Behavioural/anomaly-based
- Heuristic models
IDS/IPS systems convert network flows into security intelligence.
4. Segmentation and Micro-Segmentation
Segmentation is the single most effective method for restricting attacker movement.
4.1 Traditional Segmentation
VLANs, subnets, internal firewalls.
4.2 Micro-Segmentation
Granular, identity-driven isolation in cloud and virtual environments.
Purpose:
Prevent an attacker who compromises one host from reaching others.
5. Zero-Trust Networking
Traditional model: “Inside is trusted, outside is not.”
Zero-trust model:
“Trust no device, no user, no network — verify continuously.”
Core principles:
- Identity-based access
- Continuous verification
- Minimal implicit trust
- East–west traffic restrictions
Zero-trust is now the modern standard for corporate security architecture.
6. Network Monitoring & Telemetry
Monitoring tools include:
- NetFlow
- Packet capture
- SIEM correlation
- DNS analytics
- Cloud-native logging
Visibility is the lifeblood of network defence.
Reflection Questions
- Why does segmentation drastically reduce breach impact?
- Why is zero-trust becoming the new default model?
Summary
Network security is a multi-layered discipline that shapes traffic, isolates risks, and provides visibility into attacker behaviour.