# Network Security Fundamentals

Network security is the discipline of deciding who may talk to what, and proving it. This note is the mental model: assets, trust boundaries, the attacks that actually happen, and where defences are usually missing.

## Start with the model, not the tools

| Question | Why it matters |
|---|---|
| What are the assets? | Data, availability, reputation — the things worth attacking |
| Where are the trust boundaries? | Every boundary is where policy belongs |
| Who is the adversary? | Opportunistic scanner, insider, organised crime, nation state |
| What does "compromised" look like? | Detection requires a definition of normal |

Threat modelling frameworks (STRIDE, attack trees) are just structured ways of asking these four questions. The output is a list of boundaries and controls, not a product purchase.

## The attacks that actually arrive

| Attack | Mechanism | First control |
|---|---|---|
| **Credential stuffing** | Reused passwords from breaches | MFA, breach-password blocking |
| **Phishing / BEC** | Human trust | Mail filtering, DMARC, training, payment controls |
| **Ransomware** | Phish → lateral movement → encryption | Segmentation, EDR, offline backups |
| **Scanning and exploitation** | Internet-exposed services | Attack-surface reduction, patching |
| **MITM on local networks** | ARP spoofing, rogue DHCP, rogue AP | Dynamic ARP inspection, DHCP snooping, 802.1X |
| **DNS poisoning / tunnelling** | False answers, exfiltration over 53 | DNSSEC, resolver policy, egress filtering |
| **DDoS** | Volumetric, protocol, application floods | Anycast, scrubbing, rate limits |
| **Supply chain** | Compromised dependency or vendor | SBOM, pinning, vendor access control |

Most breaches are not exotic. They are an unpatched edge device, a reused password, or a flat network that let one workstation reach everything.

## The controls worth naming

| Control | What it buys | Typical mistake |
|---|---|---|
| **Segmentation** | Limits lateral movement | VLANs without inter-VLAN policy |
| **Least privilege** | Shrinks what a stolen credential can do | Service accounts with domain admin |
| **MFA** | Kills password-only attacks | SMS-only for high-value accounts |
| **Egress filtering** | Stops exfiltration and C2 | "Allow all outbound" because it is easier |
| **Logging + retention** | Makes incidents visible | Logs on the compromised host |
| **Patch management** | Removes known exploits | Edge devices excluded "because they might reboot" |
| **Backups, tested** | Survives ransomware | Backups reachable from the domain |

## Defence in depth, honestly

Layers only help if they are **independent**. Five controls that all depend on the same identity provider are one control. A useful test: for each layer, ask "what has to be true for this to fail, and does the same thing break the next layer?"

## Encryption in transit, in practice

- **TLS 1.2+** everywhere, 1.3 preferred.
- **mTLS** for service-to-service identity, not just encryption.
- **No cleartext protocols** on any network you do not physically control: Telnet, FTP, HTTP, LDAP, SNMPv1/v2c.
- **Certificate management** is part of security, not a separate chore (see TLS note).

## Where it goes wrong

- **Flat networks.** One VLAN for everything, with a firewall at the edge only. Ransomware thanks you.
- **Segmentation without policy.** VLANs exist, inter-VLAN routing permits everything; the diagram looks segmented and the traffic is not.
- **Trusting the internal network.** "Inside" is not a trust level; it is a location. Zero trust exists because of this assumption.
- **Shadow IT.** A developer's test instance with a public IP and no patching, outside every inventory.
- **Alerting without response.** A SIEM that nobody reads is a compliance artefact, not a control.
- **Security that blocks work.** Controls that make the safe path slower than the unsafe one get bypassed, and the bypass is permanent.
- **No asset inventory.** You cannot protect what you cannot list; most incident response time is spent finding out what exists.

## Teaching hook

**The office-building analogy.** Reception (perimeter), key cards per floor (segmentation), locked cabinets (encryption), CCTV (logging), and a fire drill (incident response). A building with only a reception desk and no internal doors is exactly a flat network.

Exercise: give learners a five-host diagram (web, app, db, admin laptop, internet) and ask them to draw every allowed flow, then name what an attacker on the web host can reach. The second answer is usually the lesson.

## Related Notes

- [[Security/Zero-Trust-And-Segmentation.md]] — the model that replaces "inside is safe"
- [[Network-Services/Firewalls-And-ACLs.md]] — where policy is enforced
- [[Security/DDoS-And-Availability-Attacks.md]] — availability as a security property
- [[Security/VPNs-And-Tunnels.md]] — extending trust across untrusted paths