Corporate Network Security Architecture: Zero Trust, NGFW, NAC, NDR, SIEM and SOC

Corporate network security architecture: a guide to building Zero Trust, NGFW, NAC, NDR, SIEM and SOC layers into one integrated architecture.

The biggest mistake in corporate network security is evaluating security products one by one.

In an organization;

there may be an NGFW.

There may be NAC.

There may be IDS/IPS.

There may be NDR.

There may be a SIEM.

There may be a SOC.

However, if these systems work independently of one another the structure that emerges may not be a truly strong:

Enterprise Network Security Architecture

it may not be this.

Because modern attacks do not target a single security layer.

The attacker;

identity,

endpoint,

network,

application,

cloud,

remote access

and privileged access

moves between these layers.

For this reason the modern corporate network security approach:

Product-Centric Security

instead of

Architecture-Centric Security

must adopt this model.

The aim is not to buy a large number of security products.

The aim is for these products:

to become control layers that complement one another

to become this.

A strong Network Security Architecture must be able to answer these questions:

Who is connecting to the network?

Which device is connecting?

Which resource are they reaching?

Which traffic is being permitted?

What is happening on the network that is not normal?

If an attack is detected how is it contained?

How is all this activity monitored centrally?

For this reason the fundamental components of the modern architecture:

Identity

Access Control

Segmentation

Detection

Visibility

Response

Governance

must be thought of as these.

What Is Network Security Architecture?

Network Security Architecture is the design, integration and operation model of the security controls of the corporate network.

The aim is not only to block traffic;

it is to control trust and to limit the effect of the attack.

What Is Enterprise Network Security?

Enterprise Network Security is, on large and complex corporate networks;

user,

endpoint,

server,

branch,

cloud,

data center,

remote access

and internet traffic being managed securely.

Why Is Network Security Architecture Necessary?

Because a single security control cannot protect the whole attack surface.

Is a Single Firewall Enough?

No.

A firewall only carries out certain traffic control and inspection tasks.

What Is Defense in Depth?

Defense in Depth is the multi-layered security approach in which the other layers continue to stop or detect the attack even if one security control fails.

How Is Defense in Depth Applied on the Network?

For example:

Firewall

↓

Segmentation

↓

NAC

↓

IDS/IPS

↓

NDR

↓

SIEM/SOC

What Is a Security Layer?

It is the independent security layer that controls a certain attack surface.

What Are the Fundamental Layers of Network Security?

Perimeter Security

Internal Segmentation

Access Control

Detection

Monitoring

Response

What Is Perimeter Security?

It is the security layer between the corporate network and the internet.

Which Controls Can Perimeter Security Contain?

NGFW

IPS

DDoS Protection

VPN

Is the Perimeter Model Enough on Its Own?

No.

What Is Castle-and-Moat Security?

It is the classical security model that accepts the outside as untrusted and the internal network as trusted.

Why Has Castle-and-Moat Weakened?

Because the modern enterprise environment:

Cloud

Remote Work

SaaS

BYOD

Third Party

uses these.

What Is Zero Trust?

Zero Trust is the security model that does not give automatic trust to network location.

The basic principle:

Never Trust, Always Verify

What Is Zero Trust Network Architecture?

It must not be confused with ZTNA.

Zero Trust Network Architecture is a broader security approach.

What Are the Fundamental Components of Zero Trust?

Identity

Device

Application

Data

Network

Visibility

Should Connecting to the Network Provide Trust?

No.

Is the Internal Network Trusted?

In the modern Zero Trust approach it is not automatically accepted as trusted.

What Is Implicit Trust?

It is a user or device being automatically considered trusted because of their location.

What Is Explicit Verification?

It is identity, device and context being verified before access.

How Is a Zero Trust Access Decision Made?

For example:

User Identity

Device Health

Application

Risk

↓

Access Decision

What Is Least Privilege?

It is only the necessary minimum access being given to a user or system.

What Is Network Least Privilege?

It is a user reaching only the necessary segment or application instead of the whole network.

What Is the Relationship Between Least Privilege and Segmentation?

Segmentation provides network level least privilege.

What Is Network Segmentation?

It is the network being separated into different security zones.

What Is a Flat Network?

It is the architecture in which there are very few access restrictions between network segments.

Why Is a Flat Network Risky?

The attacker can perform lateral movement.

What Is a Security Zone?

It is the network area in which systems at a similar trust/risk level are grouped.

Example Security Zones

User Zone

Server Zone

Database Zone

Management Zone

Guest Zone

What Is Inter-Zone Traffic?

It is the traffic between security zones.

How Should Inter-Zone Traffic Be Controlled?

Through a firewall or a policy enforcement mechanism.

What Is Default Deny?

It is the blocking of traffic that is not explicitly permitted.

Why Is Default Allow Risky?

Unnecessary communication creates an attack surface.

What Is Micro-Segmentation?

It is more detailed access control being applied at the workload or application level.

Where Is Micro-Segmentation Used?

Data Center

Cloud

Virtualized Environment

Does Micro-Segmentation Reduce Lateral Movement?

Yes.

What Is Lateral Movement?

It is the attacker progressing from the system they have compromised to other internal systems.

What Is Blast Radius?

It is the size of the area a compromise event can affect.

How Does Segmentation Reduce the Blast Radius?

It limits the resources the compromised system can reach.

What Is NGFW?

NGFW:

Next-Generation Firewall

is the firewall class that provides application-aware security capabilities in addition to traditional firewall features.

Which Features Can an NGFW Contain?

Application Control

IPS

URL Filtering

SSL Inspection

Threat Intelligence

Where Is an NGFW Used in the Architecture?

Internet Edge

Data Center

Internal Segmentation

Cloud Edge

What Is an Internal Segmentation Firewall?

It is the firewall that controls the traffic between internal security zones.

What Is East-West Firewalling?

It is internal system-to-system traffic being controlled with firewall policy.

What Is North-South Firewalling?

It is the traffic control between the internal network and the external network.

Does an NGFW Provide Zero Trust?

On its own, no.

What Is an Identity-Based Firewall Policy?

It is user identity information being used in the policy instead of the IP.

What Is an Application-Based Policy?

It is access control being applied through application identity instead of the port.

An Example Security Policy

Finance Users

↓

ERP Application

↓

ALLOW

Why Can a Port-Based Policy Be Insufficient?

Many different applications can run over TCP/443.

What Is NAC?

NAC:

Network Access Control

is the security technology used for the verification of the users and devices connecting to the network and for the granting of appropriate access.

What Does NAC Do in the Architecture?

Before the connection:

Who + What Device

it answers these questions.

The NAC Network Access Lifecycle

Connect

↓

Authenticate

↓

Assess

↓

Authorize

↓

Monitor

What Is 802.1X?

It is the port-based network access authentication standard.

With Which Identity Sources Can NAC Integrate?

Active Directory

LDAP

RADIUS

PKI

Can NAC Use Device Posture?

Yes.

What Is Device Posture?

It is the security state of the endpoint.

What Can Posture Contain?

EDR

Patch Status

Disk Encryption

Firewall

What Is a Compliant Device?

It is the endpoint that meets the security policy.

What Should Happen to a Non-Compliant Device?

Quarantine or restricted access can be applied.

What Is a Quarantine VLAN?

It is the risky device being placed in a limited network.

What Is Dynamic VLAN Assignment?

It is a VLAN being assigned according to user/device identity.

How Do NAC and Segmentation Combine?

NAC places the right device in the right security zone.

What Does IDS/IPS Do in the Architecture?

It detects known attack patterns within network traffic.

What Is the Difference Between IDS and IPS?

IDS:

Detect

IPS:

Detect + Prevent

What Is Signature-Based Detection?

It is detection through known attack patterns.

What Is Protocol Inspection?

It is the analysis of network protocol behaviour from a security point of view.

At Which Layer Is IDS/IPS Used?

It can analyze different traffic characteristics from Layer 3 to Layer 7.

What Is the Difference Between IDS/IPS and a Firewall?

Firewall:

Is the access allowed?

IDS/IPS:

Is the allowed traffic malicious?

What Is NDR?

NDR:

Network Detection and Response

is the security technology that provides anomaly detection through network behaviour and telemetry.

What Does NDR Do in the Architecture?

Inside the network:

Lateral Movement

Beaconing

Exfiltration

it detects behaviours such as these.

Does NDR Take the Place of IDS/IPS?

No.

Why Are IDS/IPS + NDR Strong Together?

IDS/IPS known attack patterns,

NDR behavioural anomalies

they detect these.

What Is the Signature + Behavior Model?

Known Threat Detection

Unknown Behavior Detection

What Is Network Visibility?

It is the communication taking place on the network being visible.

Why Is Visibility the Foundation of the Architecture?

You cannot analyze the traffic you cannot see.

What Is Network Telemetry?

It is the data that provides information about network behaviour.

Examples of Network Telemetry

NetFlow

IPFIX

PCAP

Syslog

DNS Logs

Why Is NetFlow Important in the Architecture?

It provides long-term network communication visibility.

Why Is PCAP Important?

It provides detailed forensic analysis.

Why Is DNS Telemetry Important?

It makes external communication patterns visible.

Why Is East-West Visibility Critical?

The attacker can perform lateral movement on the internal network.

What Are SPAN and TAP?

They are the visibility mechanisms that make it possible for network traffic to be transferred to monitoring systems.

It is the network area that cannot be seen by the security tools.

How Is the Visibility Gap Reduced?

Critical segment coverage must be planned.

What Is ZTNA?

ZTNA:

Zero Trust Network Access

is the secure access model that aims to provide the remote user with specific resource access instead of the entire network.

What Is the Difference Between VPN and ZTNA?

VPN:

Network Access

ZTNA:

Application/Resource Access

How Should a Secure Remote Access Architecture Be?

Identity

↓

MFA

↓

Device Posture

↓

VPN/ZTNA

↓

Authorized Resource

Why Is Least Privilege Important in Remote Access?

Even if the attacker captures a credential the area they can reach can be limited.

Why Should Third-Party Access Be Managed Separately?

Vendor devices and identities may not be completely controlled by the organization.

Third-Party Access Controls

MFA

JIT Access

PAM

Session Monitoring

What Is JIT?

Just-In-Time Access.

Access is opened only when it is needed.

What Is PAM?

PAM:

Privileged Access Management

is the control of privileged accounts and sessions.

Why Is PAM Important in Network Security Architecture?

Network device and critical server administration is high-risk access.

What Is a Bastion Host?

It is the hardened intermediary system used for critical resource access.

The Admin Access Model

Administrator

↓

MFA

↓

PAM/Bastion

↓

Management Network

↓

Target Device

What Is the Management Network?

It is the security segment reserved for network and infrastructure administration.

Should the Management VLAN Be Separated From the User VLAN?

Yes.

What Is Out-of-Band Management?

It is management connectivity independent of production traffic.

What Is Network Infrastructure Security?

It is the protection of the switch, router, DNS, DHCP and management infrastructure.

What Is DHCP Snooping?

It is the Layer 2 security feature that blocks unauthorized DHCP server responses.

What Is Dynamic ARP Inspection?

It is the Layer 2 mechanism that reduces the ARP spoofing risk.

What Is IP Source Guard?

It provides source IP/MAC/port binding validation.

What Is Port Security?

It limits the MAC address usage on the switch port.

The Layer 2 Defense Chain

DHCP Snooping

↓

DAI

↓

IP Source Guard

↓

Port Security

Why Is DNS Important in the Security Architecture?

Communication with malware and attacker infrastructure most often requires DNS resolution.

What Is DNS Filtering?

It is malicious domain access being blocked at the DNS layer.

What Is DNSSEC?

It provides DNS authenticity and integrity validation.

Should DNS Logs Go to the SIEM?

Yes.

What Is a SIEM?

SIEM:

Security Information and Event Management

collects, normalizes and correlates different security and infrastructure logs centrally.

What Does the SIEM Do in the Architecture?

It provides central visibility between distributed security controls.

Which Network Logs Should Be Sent to the SIEM?

Firewall

NAC

IDS/IPS

NDR

VPN

DNS

Switch

Router

What Is Log Normalization?

It is different log formats being converted into a common data model.

What Is Correlation?

It is different events being evaluated together.

A SIEM Correlation Example

VPN Login

NDR Lateral Movement Alert

EDR Malware Alert

↓

High-Risk Incident

Does the SIEM Perform Threat Detection on Its Own?

With certain correlation and detection rules it can.

However, it needs telemetry sources.

What Is the SOC?

SOC:

Security Operations Center

is the operations structure that monitors security events and responds to incidents.

What Does the SOC Do in the Architecture?

It converts the technologies into operational security capability.

What Is the Difference Between a Security Product and a Security Capability?

A product is a technical tool.

A capability, on the other hand, is:

People + Process + Technology

the combination of these.

What Are the SOC's Tasks in Network Security?

Monitoring

Triage

Investigation

Incident Response

Threat Hunting

What Is Alert Triage?

It is the first evaluation of the importance and correctness of the security alert.

What Is Investigation?

It is the scope and root cause analysis of the incident.

What Is Threat Hunting?

It is the proactive searching for potential attack behaviour without an alarm.

Which Data Does Network Threat Hunting Use?

NDR

NetFlow

DNS

PCAP

Firewall

How Do the SOC + NDR Work?

NDR detects suspicious network behaviour.

The SOC investigates whether this is a real threat.

How Do the SOC + SIEM Work?

The SIEM correlates the security events.

The SOC carries out the investigation.

How Do the SOC + SOAR Work?

SOAR can automate repeatable response actions.

What Is SOAR?

SOAR:

Security Orchestration, Automation and Response

is the technology approach that provides security tool integration and response automation.

What Can SOAR Do in Network Security?

Firewall Block

NAC Quarantine

EDR Isolation

Ticket Creation

What Is Automated Containment?

It is the risky entity being isolated automatically after the threat detection.

An Example Automated Response

NDR

↓

C2 Detection

↓

SOAR

↓

Firewall Block

NAC Quarantine

Should Automation Always Be Enabled?

No.

Confidence and business impact must be evaluated.

What Is Human-in-the-Loop?

It is analyst approval being obtained before an automated action.

What Is a Detection and Response Architecture?

It is the structure in which detection systems and response controls work in an integrated way.

A Simple Detection & Response Chain

Detect

↓

Validate

↓

Contain

↓

Investigate

↓

Remediate

What Is Incident Response?

It is the detection, containment and remediation process of a security incident.

What Does Network Incident Response Contain?

Block IP

Disable Account

Quarantine Device

Segment Network

What Is Containment?

It is the limiting of the spread of the incident.

What Is Network Containment?

It is the limiting of the communication capability of the compromised system.

Is NAC Used for Containment?

Yes.

Is the Firewall Used for Containment?

Yes.

Is EDR Used for Containment?

It can provide endpoint isolation.

Does Segmentation Make Incident Response Easier?

Yes.

The blast radius is reduced.

Is Identity Security Part of the Network Architecture?

Yes.

Modern network security cannot be thought of separately from identity.

What Is Identity-Aware Networking?

It is the access policy using user identity information.

Why Is MFA Critical for Network Security?

It protects critical entry points such as VPN, firewall administration and privileged access.

What Is Passwordless Authentication?

It is the use of mechanisms such as certificate or hardware-backed authentication instead of a password.

Where Is Certificate-Based Authentication Used?

802.1X

VPN

Wi-Fi

in areas such as these.

Is PKI Part of Network Security?

Yes.

It is important for device and user certificates.

What Is Device Identity?

It is the determination of the identity of the endpoint connecting to the network.

What Is Machine Identity?

It is the identity of a server, application or workload.

What Is Workload Identity?

It is the identity of cloud/container application components.

What Is Cloud Network Security Architecture?

It is cloud VPC/VNet and workload communication being protected with security controls.

What Is a Cloud Security Group?

It is an access control mechanism similar to a virtual firewall.

What Is a Network ACL?

It can provide subnet-level traffic control.

What Is a Cloud Firewall?

It is centralized firewall capability in the cloud environment.

What Is Hybrid Network Security?

It is on-premise and cloud networks being protected under a common security architecture.

What Is the Difficulty in a Hybrid Network?

Visibility and policy consistency.

What Is Multi-Cloud Network Security?

It is more than one cloud platform being managed with a common security model.

What Is Security Policy Consistency?

It is the same security principles being applied in different environments.

What Is Policy Drift?

It is the security configuration moving away from the approved state over time.

What Is Configuration Drift?

It is network/security device configs deviating from the baseline.

What Is Continuous Compliance?

It is the configuration being checked continuously against the approved security baseline.

What Is Network Security Governance?

It is the management of the security architecture, ownership and policy processes.

Why Is Governance Important?

Technology can change in an uncontrolled way over time.

What Is a Network Security Policy?

It is the corporate policy that defines the network access and security principles.

What Is a Network Security Standard?

It defines how the policy will be applied technically.

What Is a Security Baseline?

It is the minimum required secure configuration level.

What Is a Network Security Procedure?

It explains how operational security operations will be performed.

The Difference Between Policy, Standard and Procedure

Policy:

What must be done?

Standard:

What is the minimum technical level?

Procedure:

How must it be done?

What Is Network Security Ownership?

It is there being an accountable owner for every security control.

Who Should the Firewall Owner Be?

According to the corporate structure it can be the Network/Security team.

Who Should the NAC Owner Be?

The network, security and identity teams can work together.

Who Should the SIEM/SOC Owner Be?

It can be the Security Operations team.

What Is RACI?

Responsible

Accountable

Consulted

Informed

it is the governance model that defines these roles.

Why Is a Network Security RACI Useful?

During an incident it becomes clear who will do what.

What Is Change Management?

It is network/security configuration changes being managed with a controlled process.

Why Is Firewall Change Management Critical?

An incorrect rule can create a security gap or an outage.

What Is an Emergency Change?

It is a change made quickly during an incident or an outage.

Should an Emergency Change Be Reviewed Afterwards?

Yes.

What Is the Rule Lifecycle?

It is the life cycle of a firewall rule from its creation to its removal.

The Firewall Rule Lifecycle

Request

↓

Approve

↓

Implement

↓

Monitor

↓

Review

↓

Expire

What Is Rule Recertification?

It is the periodic verification of whether the existing firewall rule is still necessary.

What Is a Stale Rule?

It is an old rule for which there is no longer a business requirement.

What Is a Shadow Rule?

It is a rule that is never used because of another rule.

Why Is an Any-Any Rule Risky?

The access scope is very broad.

What Is a Network Security Exception?

It is a controlled deviation from the standard security policy.

Should an Exception Be Without a Time Limit?

As far as possible, no.

What Is Exception Expiration?

It is the automatic review/termination date of the exception.

What Is a Compensating Control?

It is the alternative control used to reduce the risk when the main security control cannot be applied.

How Is Legacy System Network Security Provided?

Segmentation

Restrictive Firewall

Monitoring

Compensating Controls

What Is a Network Security Risk Assessment?

It is the analysis of the threats, vulnerabilities and impacts in the network architecture.

What Is Risk-Based Security?

It is security investment and controls being applied according to risk priority.

What Is Asset Criticality?

It is the level of importance of the system in business terms.

What Is a Crown Jewel?

It is the most critical data or system for the organization.

What Is Crown Jewel Network Segmentation?

It is critical assets being kept in special security zones.

What Is a High-Value Asset?

It is the system whose compromise creates a high business impact.

Is the Domain Controller a High-Value Asset?

Yes.

Is the Backup Server a High-Value Asset?

Yes.

Is the Network Management Server a High-Value Asset?

Yes.

What Is a Critical Asset Access Matrix?

It is the list that shows which user/system can reach the critical asset.

Yes.

Internet-facing assets need to be visible and under control.

What Is the External Attack Surface?

They are the assets and services reachable from the internet.

What Is the Internal Attack Surface?

They are the accessible resources on the internal network.

What Is Attack Surface Reduction?

It is the removal of unnecessary services, ports and access paths.

What Is Exposure Management?

It is asset, vulnerability and exposure information being analyzed continuously.

What Is Network Vulnerability Management?

It is the management of router, switch, firewall and network service vulnerabilities.

Should a Vulnerability Scan Be Performed on Network Devices?

Yes.

In a controlled and safe way.

Why Is Firmware Management Important?

Security vulnerabilities can be remedied.

Is an EOL Device Risky?

Yes.

It may not receive vendor updates.

What Is Network Security Testing?

It is the technical verification of the network security controls.

What Is a Network Penetration Test?

It is network attack paths being tested in an authorized way.

What Is Segmentation Testing?

It is the verification of the question of whether unauthorized access between network security zones is possible.

What Is Firewall Rule Validation?

It is the test of whether the implemented policy really applies the expected access.

What Is NAC Testing?

It is the testing of whether an unauthorized device can connect to the network.

What Is Detection Validation?

It is the verification that the IDS/IPS, NDR and SIEM detections really work.

What Is Security Control Validation?

It is the measurement of whether the security product provides real protection rather than of its being installed.

Is Purple Team Used in Network Security?

Yes.

Red Team attack behaviour and Blue Team detections can be validated together.

What Is Breach and Attack Simulation?

It is security controls being tested continuously with controlled adversary behaviour.

What Is Detection Engineering?

It is the systematic development of security detection use cases and rules.

What Can Network Detection Engineering Contain?

C2 Detection

Lateral Movement

DNS Anomaly

Segmentation Violation

What Is MITRE ATT&CK?

It is the adversary tactics and techniques knowledge framework.

Can Network Security Controls Be Mapped to MITRE ATT&CK?

Yes.

Why Is ATT&CK Coverage Important?

The detection gaps can be seen.

What Is a Detection Gap?

It is there not being sufficient detection for a certain threat behaviour.

What Is a Control Gap?

It is the lack of a preventive or detective security control for a certain risk.

What Is Gap Analysis?

It is the analysis of the differences between the existing security state and the target state.

What Is a Network Security Maturity Assessment?

It is the evaluation of the organization's network security capability level.

What Does Security Maturity Mean?

It expresses how systematically, in an integrated way and measurably the security controls work.

Network Security Maturity Model

Level 1 - Perimeter-Centric Security

The main control is the firewall.

The internal network is largely accepted as trusted.

Level 2 - Segmented Network

VLANs, firewall zones and basic NAC are used.

Level 3 - Visible and Detectable Network

IDS/IPS, NetFlow, NDR and central logging come into play.

Level 4 - Integrated Detection and Response

NAC, NDR, SIEM, EDR, firewall and the SOC work in an integrated way.

Level 5 - Adaptive Zero Trust Network

Dynamic access and automated response are applied through identity, device, behaviour and risk.

What Is a Network Security KPI?

It is the Key Performance Indicator that measures the performance of the security program.

Important Network Security KPIs

Critical Segment Visibility

Firewall Rule Review Coverage

NAC Authentication Coverage

NDR Detection Coverage

What Is a Network Security KRI?

It is the Key Risk Indicator that shows the risk level.

Important Network Security KRIs

Flat Network Segment Count

Any-Any Rule Count

Unknown Device Count

Critical Blind Spot Count

What Is MTTD?

Mean Time to Detect.

It is the average time that passes until the threat is detected.

What Is MTTR?

Mean Time to Respond/Remediate.

It is the response or remediation time for the incident.

What Should a Network Security Dashboard Show?

Critical Incidents

High-Risk Assets

Network Anomalies

Security Control Health

What Is Security Control Health?

It is whether controls such as the firewall, NAC, NDR and SIEM are working actively and healthily.

What Is Telemetry Health?

It is whether the expected logs and network telemetry really arrive.

Why Is Telemetry Failure Critical?

If the detection system is not receiving data it can be ineffective silently.

What Is Silent Failure?

It is the security control not providing real protection/visibility while appearing to be active.

What Is a Network Security Architecture Review?

It is the architecture being re-evaluated periodically in terms of risk and business change.

When Should an Architecture Review Be Performed?

For example:

Cloud Migration

New Data Center

Merger

New Branch

Remote Work Expansion

in major changes such as these.

Why Is a Security Architecture Diagram Important?

The trust boundaries and control points become visible.

What Is a Trust Boundary?

It is the boundary between systems at different trust levels.

What Is a Security Control Point?

It is the point at which access or traffic is enforced.

What Is a Choke Point?

It is the architecture point at which traffic is forced to pass through a controlled point.

Is a Choke Point Useful for Security?

Yes.

Visibility and control can become easier.

What Is a Single Point of Failure?

It is the risk of a single component failure cutting the service.

Are a Security Choke Point and an SPOF the Same Thing?

No.

A control point can be designed redundantly.

What Is a High Availability Security Architecture?

It is connectivity continuing in the event of a security device failure.

What Is Firewall HA?

It is firewall cluster redundancy.

Why Is NAC High Availability Important?

An authentication failure can affect all user connectivity.

What Is RADIUS Redundancy?

It is the other one providing the service in the case of one authentication server failure.

Is SIEM/NDR High Availability Necessary?

In critical monitoring environments, yes.

Is Resilience Part of Network Security?

Yes.

What Is Cyber Resilience?

It is critical services being able to be sustained even if an attack takes place.

What Is Network Resilience?

It is connectivity continuing in the event of a network failure or attack.

Is DDoS Protection Part of the Architecture?

Yes.

Why Is Upstream DDoS Protection Important?

A volumetric attack can be mitigated before it reaches the internet link.

An Example of a Network Security Architecture

Internet

↓

DDoS Protection

↓

NGFW

↓

DMZ

↓

Internal Segmentation Firewall

↓

Server Zones

At the same time:

User

↓

NAC

↓

User Segment

↓

Application Access

And the whole environment:

NetFlow / PCAP / DNS / Logs

↓

NDR / SIEM

↓

SOC

↓

SOAR / Response

An Example of a Modern Zero Trust Network Architecture

Identity Provider

↓

MFA

↓

Device Trust

↓

NAC / ZTNA

↓

Least Privilege Policy

↓

Application

↓

Continuous Monitoring

Is "Trust but Verify" Enough in Network Security Architecture?

The Zero Trust approach:

Verify Before Trust

prefers this model.

What Is Continuous Verification?

It is the risk being re-evaluated continuously after access is given.

What Is Continuous Monitoring?

It is network, identity and security activity being monitored without interruption.

What Is Adaptive Security?

It is the security policy being changed dynamically when the risk changes.

An Example of Adaptive Network Access

User:

Normal

↓

Full Authorized Access

NDR:

Lateral Movement Detected

↓

Risk Score Increased

↓

NAC:

Quarantine

What Is Risk-Based Network Access?

It is the access decision being changed according to the user/device risk level.

What Is Context-Aware Security?

In the security decision:

identity,

device,

location,

behaviour,

asset criticality

it is the use of contexts such as these.

How Does the Zero Trust Maturity Model Progress?

Network-Based Trust

↓

Identity-Aware Access

↓

Device-Aware Access

↓

Application-Level Access

↓

Adaptive Risk-Based Access

The Most Frequently Made Mistakes in Network Security Architecture

The mistakes frequently seen in organizations:

Seeing the firewall as all of network security
Using a flat network
Not controlling East-West traffic
Accepting every device that connects to the network as trusted
Not using NAC
Using a shared Wi-Fi password
Giving the remote VPN user full network access
Leaving third-party access unlimited
Not performing IDS/IPS tuning
Not showing NDR East-West traffic
Not collecting DNS logs
Not using NetFlow/IPFIX
Not separating network infrastructure management
Using shared admin accounts
Not sending sufficient telemetry to the SIEM
Not creating SOC use cases
Not performing integration between the security tools
Not carrying out rule reviews
Leaving exceptions without a time limit
Not reviewing the security architecture regularly

Frequently Asked Questions

What is Network Security Architecture?

Network Security Architecture is the corporate network security model in which the firewall, NAC, segmentation, IDS/IPS, NDR, SIEM, SOC and other security controls are designed in an integrated way.

What is Enterprise Network Security?

It is corporate user, device, server, cloud and network traffic being protected with multi-layered security controls.

What is a Zero Trust Network?

It is the security approach that provides access through identity, device, context and least privilege without giving automatic trust to network location.

What is NGFW?

Next-Generation Firewall is the firewall class that adds application control, IPS and advanced inspection features to traditional firewall capabilities.

What is NAC?

Network Access Control is the security technology that applies the appropriate access policy by verifying the users and devices connecting to the network.

What is NDR?

Network Detection and Response is the security technology that provides behavioural anomaly and threat detection through network traffic and telemetry.

What is IDS/IPS?

IDS/IPS are the security controls that detect known attack patterns within network traffic and, in the case of IPS, can block them.

What is a SIEM?

Security Information and Event Management is the platform class that collects and correlates the logs coming from different security systems centrally.

What is a SOC?

Security Operations Center is the operations structure that monitors and analyzes security alerts and responds to incidents.

Are Zero Trust and ZTNA the same thing?

No. Zero Trust is a broad security strategy. ZTNA, on the other hand, is the Zero Trust based technology approach used particularly for secure application/network access.

What is the difference between a firewall and NDR?

The firewall applies access control. NDR performs anomaly and threat detection through network behaviour.

What is the difference between NAC and ZTNA?

NAC mostly controls local network access, while ZTNA controls remote/application access.

Why is network segmentation important?

It reduces lateral movement and the blast radius.

Why is network visibility important?

Network behaviour that is not seen cannot be analyzed reliably.

Which is the most important technology in Network Security?

There is no single technology. A strong security architecture is based on different controls working in an integrated way.

Conclusion: Strong Network Security Is Not a Product, It Is an Architecture

The most important truth about corporate network security is this:

A single product cannot create strong network security.

A firewall is necessary.

However, the firewall is not sufficient on its own.

NAC is necessary.

However, NAC does not analyze network behaviour.

IDS/IPS is necessary.

However, it cannot always see attacks that have no signature.

NDR is valuable.

However, it does not provide access control.

A SIEM is necessary.

However, without a telemetry source it cannot perform detection.

A SOC is necessary.

However, without the right technology and process it cannot work effectively.

For this reason a real Enterprise Network Security Architecture:

is formed by the controls complementing one another

it is formed in this way.

The modern architecture can be built on this chain:

Identify

↓

Authenticate

↓

Authorize

↓

Segment

↓

Inspect

↓

Observe

↓

Detect

↓

Respond

First of all:

Who is connecting?

this question is answered.

NAC, identity and authentication controls come into play here.

Then:

Where can they reach?

this question comes.

Segmentation, the firewall and least privilege control this.

Then:

Is there an attack inside the traffic?

this question is evaluated by IDS/IPS.

Afterwards:

Is the network behaviour normal?

NDR seeks an answer to this question.

All the events:

SIEM

are brought together on this.

The SOC:

investigates the incident.

And where necessary:

Firewall

NAC

EDR

SOAR

containment is applied through these.

This is how a strong Network Security Architecture works.

For this reason the modern network security equation:

Identity + Segmentation + Visibility + Detection + Response + Governance

can be expressed in this way.

Zero Trust, on top of this whole structure, brings this fundamental principle:

Being inside the network does not mean being trusted.

Even if the user is authenticated the device can be risky.

Even if the device is compliant the behaviour can be abnormal.

Even if the application is authorized the session can have been compromised.

For this reason trust:

must be dynamic, not fixed

it must be this.

The future of modern enterprise architecture:

Static Trust

from this model

Continuous Verification

it is moving to this model.

In this approach;

the NGFW controls the traffic.

NAC controls entry to the network.

Segmentation limits the movement.

IDS/IPS detects the attack patterns.

NDR finds the behaviour anomalies.

The SIEM correlates the telemetry.

The SOC carries out the investigation.

SOAR speeds up the response.

Zero Trust gives the trust model to this whole structure.

And if the whole series is to be summarized in a single sentence:

Strong Network Security is, instead of assuming that the attacker will never be able to enter the network, designing how far they can progress when they do enter, how quickly they will be detected and how quickly they will be stopped.

The fundamental formula of corporate network security:

Prevent + Segment + Observe + Detect + Respond

it must be this.

Because real security:

is not only blocking the attack but shrinking the area of movement when the attack takes place and making the attacker visible at the earliest possible point.

Network Security

All guides

Looking for professional support on this topic?

Our expert team will reach out for a free consultation as soon as possible.