You are viewing a free preview of this lesson.
Subscribe to unlock all 10 lessons in this course and every other course on LearningBro.
Network security is the practice of protecting computer networks and their data from unauthorised access, misuse, and attack. As organisations become increasingly interconnected, a solid understanding of network security fundamentals is essential for every IT professional.
Networks are the backbone of modern organisations. Every email, database query, file transfer, and cloud API call traverses a network. A single compromised network can expose millions of records, disrupt critical services, and cost organisations millions of pounds in damages.
Key statistics:
Defence in depth is the cornerstone strategy for network security. Rather than relying on a single control, you deploy multiple overlapping layers so that if one fails, others still protect the network.
| Layer | Controls | Examples |
|---|---|---|
| Perimeter | Firewalls, DMZs, proxies | Block unauthorised inbound/outbound traffic |
| Network | Segmentation, VLANs, ACLs | Limit lateral movement between zones |
| Endpoint | Antivirus, EDR, host firewalls | Protect individual devices |
| Application | WAFs, input validation, patching | Secure web apps and APIs |
| Data | Encryption, DLP, access controls | Protect data at rest and in transit |
| Human | Training, policies, phishing simulations | Reduce human error |
Think of defence in depth like an onion — an attacker must peel through multiple layers to reach the core (your critical data):
┌──────────────────────────────────┐
│ Perimeter Security │
│ ┌────────────────────────────┐ │
│ │ Network Security │ │
│ │ ┌──────────────────────┐ │ │
│ │ │ Endpoint Security │ │ │
│ │ │ ┌────────────────┐ │ │ │
│ │ │ │ Application │ │ │ │
│ │ │ │ ┌──────────┐ │ │ │ │
│ │ │ │ │ DATA │ │ │ │ │
│ │ │ │ └──────────┘ │ │ │ │
│ │ │ └────────────────┘ │ │ │
│ │ └──────────────────────┘ │ │
│ └────────────────────────────┘ │
└──────────────────────────────────┘
Every network security control maps back to the CIA triad:
| Principle | Network Application | Example Controls |
|---|---|---|
| Confidentiality | Prevent eavesdropping on network traffic | Encryption (TLS, IPsec), VPNs, network access control |
| Integrity | Ensure packets are not tampered with in transit | Checksums, digital signatures, DNSSEC |
| Availability | Keep network services accessible | Redundancy, load balancers, DDoS mitigation |
| Device/Tool | Purpose | Deployment |
|---|---|---|
| Firewall | Filter traffic based on rules | Perimeter, internal boundaries |
| IDS/IPS | Detect and/or block malicious traffic | Inline or passive monitoring |
| Proxy Server | Intermediary for web traffic, filtering and caching | Forward or reverse proxy |
| Load Balancer | Distribute traffic across servers for availability | Front of application servers |
| NAC (Network Access Control) | Enforce policy on devices connecting to the network | Switch ports, wireless access |
| Packet Capture (PCAP) | Record raw network traffic for analysis | TAPs, SPAN ports |
| Tool | Category | Use Case |
|---|---|---|
| Wireshark | Packet analyser | Inspect network traffic and troubleshoot issues |
| Nmap | Port scanner | Discover hosts, open ports, and services |
| Snort | IDS/IPS | Detect and block malicious network activity |
| tcpdump | Command-line PCAP | Quick traffic capture on Linux/Unix |
| Zeek (formerly Bro) | Network monitor | Generate detailed network metadata logs |
| Nessus | Vulnerability scanner | Identify vulnerabilities in network devices and services |
Understanding attacks is essential for building effective defences:
| Attack | Description | Target |
|---|---|---|
| Port Scanning | Probing for open ports and services | Reconnaissance |
| ARP Spoofing | Poisoning ARP tables to redirect traffic | Local network |
| Man-in-the-Middle | Intercepting communications between two parties | Encryption gaps |
| DDoS | Overwhelming a target with traffic | Availability |
| DNS Spoofing | Returning false DNS responses | Name resolution |
| VLAN Hopping | Jumping between VLANs to access restricted segments | Segmentation |
| Packet Sniffing | Capturing unencrypted traffic on the wire | Confidentiality |
Every organisation needs documented network security policies:
Tip: Network security is not a product you buy — it is a process you build, monitor, and continuously improve.
Network security protects the infrastructure that connects all systems and data. The defence-in-depth strategy layers multiple controls so that no single point of failure compromises the entire network. Understanding devices, tools, common attacks, and architectural principles provides the foundation for all network security work. In the following lessons, we will dive into specific controls — firewalls, IDS/IPS, VPNs, segmentation, and more.