Starphix
Network Engineering / Sources
The Lab / Sources / Network Engineering / Security/Network-Security-Fundamentals.md

Network Security Fundamentals

Network security is the discipline of deciding who may talk to what, and proving it. This note is the mental model: assets, trust boundaries, the attacks that actually happen, and where defences are usually missing.

Start with the model, not the tools

Question Why it matters
What are the assets? Data, availability, reputation — the things worth attacking
Where are the trust boundaries? Every boundary is where policy belongs
Who is the adversary? Opportunistic scanner, insider, organised crime, nation state
What does "compromised" look like? Detection requires a definition of normal

Threat modelling frameworks (STRIDE, attack trees) are just structured ways of asking these four questions. The output is a list of boundaries and controls, not a product purchase.

The attacks that actually arrive

Attack Mechanism First control
Credential stuffing Reused passwords from breaches MFA, breach-password blocking
Phishing / BEC Human trust Mail filtering, DMARC, training, payment controls
Ransomware Phish → lateral movement → encryption Segmentation, EDR, offline backups
Scanning and exploitation Internet-exposed services Attack-surface reduction, patching
MITM on local networks ARP spoofing, rogue DHCP, rogue AP Dynamic ARP inspection, DHCP snooping, 802.1X
DNS poisoning / tunnelling False answers, exfiltration over 53 DNSSEC, resolver policy, egress filtering
DDoS Volumetric, protocol, application floods Anycast, scrubbing, rate limits
Supply chain Compromised dependency or vendor SBOM, pinning, vendor access control

Most breaches are not exotic. They are an unpatched edge device, a reused password, or a flat network that let one workstation reach everything.

The controls worth naming

Control What it buys Typical mistake
Segmentation Limits lateral movement VLANs without inter-VLAN policy
Least privilege Shrinks what a stolen credential can do Service accounts with domain admin
MFA Kills password-only attacks SMS-only for high-value accounts
Egress filtering Stops exfiltration and C2 "Allow all outbound" because it is easier
Logging + retention Makes incidents visible Logs on the compromised host
Patch management Removes known exploits Edge devices excluded "because they might reboot"
Backups, tested Survives ransomware Backups reachable from the domain

Defence in depth, honestly

Layers only help if they are independent. Five controls that all depend on the same identity provider are one control. A useful test: for each layer, ask "what has to be true for this to fail, and does the same thing break the next layer?"

Encryption in transit, in practice

  • TLS 1.2+ everywhere, 1.3 preferred.
  • mTLS for service-to-service identity, not just encryption.
  • No cleartext protocols on any network you do not physically control: Telnet, FTP, HTTP, LDAP, SNMPv1/v2c.
  • Certificate management is part of security, not a separate chore (see TLS note).

Where it goes wrong

  • Flat networks. One VLAN for everything, with a firewall at the edge only. Ransomware thanks you.
  • Segmentation without policy. VLANs exist, inter-VLAN routing permits everything; the diagram looks segmented and the traffic is not.
  • Trusting the internal network. "Inside" is not a trust level; it is a location. Zero trust exists because of this assumption.
  • Shadow IT. A developer's test instance with a public IP and no patching, outside every inventory.
  • Alerting without response. A SIEM that nobody reads is a compliance artefact, not a control.
  • Security that blocks work. Controls that make the safe path slower than the unsafe one get bypassed, and the bypass is permanent.
  • No asset inventory. You cannot protect what you cannot list; most incident response time is spent finding out what exists.

From the Network Engineering research vault · CC BY 4.0 · all notes · raw markdown