Cybersecurity Domain 1

Network Security Architecture & Defense

Comprehensive guide to securing physical and virtual network infrastructure, traffic encryption, OSI layer security, micro-segmentation, and firewalls.

1. Fundamentals of Network Security

Network security encompasses all policies, configurations, technologies, and practices designed to prevent unauthorized access, misuse, modification, or denial of computer networks and network-accessible resources. Modern enterprise networks require a Defense-in-Depth approach where security controls are applied across multiple boundary layers.

Visibility & Traffic Inspection

Continuous packet capturing (PCAP), NetFlow/sFlow monitoring, and Deep Packet Inspection (DPI) to identify anomalous traffic patterns across north-south and east-west network corridors.

Zero Trust Network Access (ZTNA)

Abandoning the implicit trust of traditional perimeter security. Every device, user, and service connection must be authenticated, authorized, and continuously validated before access is granted.

2. OSI Model Security Mapping

Effective network defense requires applying security controls at each specific layer of the Open Systems Interconnection (OSI) 7-layer stack:

Layer 7: Application  -> WAF, API Gateway Security, HTTP/2 & HTTP/3 Inspection
Layer 6: Presentation -> TLS 1.3 / SSL Data Encryption, Payload Encoding Validation
Layer 5: Session      -> SOCKS Proxies, RPC Authentication, Session Token Validation
Layer 4: Transport    -> Stateful Firewalls, TCP SYN Flood Protection, Port Filtering
Layer 3: Network      -> IPsec VPN, BGP RPKI Route Filtering, ICMP Suppression, Router ACLs
Layer 2: Data Link    -> 802.1X Port Security, DHCP Snooping, Dynamic ARP Inspection (DAI)
Layer 1: Physical     -> Fiber Tap Protection, Physical Port Disablement, Cable Shielding
      

3. Network Segmentation & Microsegmentation

Network segmentation partitions a computer network into smaller subnetworks to isolate critical workloads, reduce attack surface area, and limit lateral movement by attackers who breach the perimeter.

Key Architecture Patterns

DMZ (Demilitarized Zone): A perimeter subnetwork containing external-facing services (Web servers, DNS, Email relays) isolated from the internal corporate intranet by dual-homed firewalls.
VLANs & Subnetting: Logically separating finance, engineering, guest Wi-Fi, and IoT devices onto distinct 802.1Q Virtual Local Area Networks with router ACL enforcement.
Software-Defined Microsegmentation: Applying granular firewall policies down to individual workloads or container pods in cloud and data-center environments (e.g., using Kubernetes NetworkPolicies or VMware NSX).

4. Next-Generation Firewalls (NGFW) & IDS/IPS

Traditional packet-filtering firewalls evaluate only IP addresses and port numbers. Next-Generation Firewalls (NGFW) operate up to Layer 7, providing deep context on application protocols, user identities, and malicious payloads.

Stateful Packet Inspection (SPI)

Tracks the state of active TCP connections (SYN, SYN-ACK, ACK) and drops out-of-state packets or malicious TCP flag combinations.

Intrusion Prevention Systems (IPS)

Inline hardware/software (e.g., Snort, Suricata) that compares network traffic against known signature databases and behavioral heuristics to drop active exploits automatically.

5. Encrypted Tunnels & Secure Connectivity

Securing data in transit across public or untrusted networks relies on robust cryptographic protocols:

IPsec (IP Security): Provides suite-level encryption (ESP) and authentication (AH) operating at Layer 3. Uses IKEv2 for key exchange with AES-256-GCM encryption.
WireGuard & OpenVPN: Modern high-performance VPN protocols providing secure remote access tunnels for corporate workforces.
TLS 1.3: The protocol powering HTTPS, securing web traffic with Perfect Forward Secrecy (PFS) using Ephemeral Elliptic Curve Diffie-Hellman (ECDHE).

6. Network Hardening Checklist

Disable unused switch ports and assign them to an isolated blackhole VLAN.
Enable 802.1X Network Access Control (RADIUS/EAP-TLS) on all wired and wireless Ethernet ports.
Implement DHCP Snooping and Dynamic ARP Inspection (DAI) to prevent ARP poisoning and rogue DHCP servers.
Enforce strict ingress and egress firewall filtering rules; drop all outbound traffic except authorized ports (80, 443, 123, 53).
Migrate all plaintext management protocols (Telnet, HTTP, SNMPv1/v2) to secure alternatives (SSHv2, HTTPS, SNMPv3).