Trust Boundaries on the Wire

Networks are where security either holds or collapses. Every protocol described in this course was designed for a simpler, more trusting internet, and network security is largely about compensating for that trust with layers of controls.

Segmentation

The single most effective network defense is segmentation: putting systems into separate networks connected only through controlled choke points. A compromised web server cannot directly reach the payroll database if they sit in different subnets behind a firewall that only permits the application's specific query path. Segmentation limits blast radius—the difference between one breached host and a breached enterprise.

Related patterns: - DMZ: a buffer subnet for internet-facing services, isolated from internal networks. - Micro-segmentation: applying per-workload policy (often in software) so even hosts in the same subnet cannot talk freely. - Zero-trust networking: every request is authenticated and authorized regardless of network location; location alone grants no privilege.

Firewalls

Firewalls enforce the segmentation policy:

  • Packet filters examine IP, port, and protocol—fast but context-free.
  • Stateful firewalls track connection state and only allow return traffic for established sessions.
  • Next-generation firewalls (NGFW) inspect application layer content, identify users, and integrate threat feeds.
  • Web Application Firewalls (WAFs) specialize in HTTP attacks: injection, XSS, and bot traffic.

A firewall rule audit is one of the highest-value security exercises: old "allow any" rules are how breaches traverse otherwise well-designed networks.

Intrusion Detection and Prevention

IDS monitors traffic and raises alerts. IPS can block inline. Signature-based systems catch known attacks; anomaly-based systems flag deviations from a baseline. Both produce false positives, so tuning and context matter. Network detection complements host-based EDR: one watches the wire, the other watches the endpoint.

Encryption in Transit

Assume any network path can be observed. Protect data in transit with TLS everywhere, including internal service-to-service calls (mTLS). Unencrypted protocols—plain HTTP, FTP, Telnet, SNMPv1—leak credentials and data to anyone on the path. Retire them.

DNS Security

DNS is a frequent attack surface: - DNS tunneling exfiltrates data through DNS queries. - DNS spoofing redirects users to malicious hosts (mitigated by DNSSEC and encrypted DNS). - Malicious domains power phishing and command-and-control.

Monitor DNS for unusual query patterns; it is one of the earliest and most reliable breach indicators.

Common Network Attacks

  • ARP spoofing / MITM: poison local ARP caches to intercept traffic.
  • VLAN hopping: escape a VLAN's isolation via switch misconfiguration.
  • DDoS: overwhelm links and services (see the cybersecurity course).
  • Lateral movement: an attacker pivoting from host to host after initial access; segmentation and least privilege are the countermeasures.

Monitoring and Logging

Detection requires visibility. Centralize logs, capture flow data, and build alerts for the behaviors that precede attacks: unusual outbound connections, spikes in failed logins, new listening ports, and traffic to known-bad IPs. A network you cannot see is a network you cannot defend.

Defense in Depth on the Wire

No single network control is sufficient. The effective posture stacks layers so that the failure of any one does not become a breach:

  1. Segment so a compromised host has nowhere to go.
  2. Firewall each boundary with least-privilege rules and regular audits.
  3. Encrypt all transit traffic so a tapped link yields nothing.
  4. Authenticate every service-to-service call (mTLS, workload identity).
  5. Monitor continuously so anomalous behavior is caught early.
  6. Respond with playbooks that isolate a compromised segment without taking down the whole network.

The goal is not a perfect wall—it is making each step of an attacker's journey both harder and noisier. An attacker who must pivot through many boundaries creates many opportunities to be detected, which is ultimately how intrusions are stopped.