What Is Network Security? Cyber Security in Corporate Networks

Almost every digital system communicates over a network.

User computers, servers, databases, mobile devices, cloud services, security cameras, IoT devices, production systems and applications continuously exchange data with one another.

The infrastructure on which this communication takes place is the organization's network, that is, its network infrastructure.

However, network connectivity does not only allow systems to communicate.

At the same time it creates the paths along which attackers can move between systems.

When an attacker compromises an internet-facing system, the target is most often not that system alone.

The attacker may attempt;

to discover the internal network,

to identify other systems,

to capture credentials,

to escalate privileges,

to move between servers,

to reach critical data

in turn.

In cyber security terminology this process is most often called:

Lateral Movement

as it is known.

One of the fundamental aims of modern network security is to prevent the attacker from moving freely inside the organization after compromising the first system.

For this reason Network Security does not simply mean installing a firewall.

A modern Network Security architecture;

Firewall / NGFW

Network Segmentation

Micro-Segmentation

Network Access Control - NAC

IDS / IPS

Network Detection and Response - NDR

VPN

Zero Trust Network Access - ZTNA

DNS Security

Secure Wi-Fi

Network Monitoring

SIEM

SOC

and Threat Intelligence

requires many security layers such as these to work together.

The aim is simple:

To ensure that only the right users and devices reach the network, to keep access at a minimum level, to make traffic visible and to detect attacker movements as early as possible.

What Is Network Security?

Network security, or Network Security as it is known in English, is the body of technical and administrative controls used to protect an organization's network infrastructure, the data carried over the network and the systems connected to the network against unauthorized access, misuse, attack, data leakage and service interruption.

Network Security has three fundamental security objectives:

Confidentiality

Integrity

Availability

In information security these three concepts are known as:

CIA Triad

as they are called.

What Is Confidentiality in Network Security?

Confidentiality aims to ensure that the data carried over the network cannot be read by unauthorized persons.

For example, if the traffic between the user and the application is not encrypted, an attacker on the same network may under certain conditions try to observe that traffic.

For this reason;

TLS,

VPN,

IPsec,

SSH

and similar secure protocols can be used.

What Is Network Integrity?

Integrity means the assurance that the data carried over the network has not been altered in an unauthorized way.

If an attacker interposes themselves in the communication and modifies the data, not only confidentiality but data integrity too is placed at risk.

What Is Network Availability?

Availability means that network services are usable when they are needed.

For example;

a DDoS attack,

a switch failure,

a routing problem,

a firewall problem,

a network loop,

an incorrect ACL

can render the organization's services unreachable.

For this reason network security is at the same time a matter of network resilience.

Why Is Network Security Critical?

An organization's systems are not independent of one another.

A user computer may;

Active Directory,

DNS,

file server,

ERP,

database,

internet,

cloud

communicate with many systems such as these.

Therefore, if the network architecture is weak, the compromise of a single endpoint can become the starting point of a much larger attack.

What Is the Network Attack Surface?

The attack surface is the total attack surface an attacker can use in order to reach the target system.

From the network point of view the attack surface may contain;

Public IP

Open Port

VPN Gateway

Firewall

Router

Switch

Wireless Network

Remote Access

Cloud Network

DNS

components such as these.

How Is the Network Attack Surface Reduced?

The basic principle is this:

No service that is not needed should be reachable.

For example, if a database is only going to be used by the application server, there is no need for the whole network to be able to reach the database port.

What Is an Open Port?

It is a service port on a system that accepts network connections.

For example;

TCP/443 - HTTPS

TCP/22 - SSH

TCP/3389 - RDP

and so on.

Is an Open Port a Security Vulnerability?

On its own, no.

However, an unnecessary open port enlarges the attack surface.

Why Is Network Port Exposure Important?

Attackers may try to discover open services on the internet or on the internal network.

For this reason:

Minimum Exposure

this approach should be applied.

What Is Network Discovery?

It is the process of identifying the devices, IP addresses, services and ports on the network.

Network administrators may use it for inventory purposes.

Attackers, on the other hand, may use it for target discovery.

What Is Network Reconnaissance?

It is the process in which an attacker gathers information about the target network.

In this process;

IP range,

host,

port,

service,

network topology

information such as this may be researched.

The First Principle of Network Security: You Cannot Protect What You Cannot See

If an organization does not know which devices are present on its own network, protecting those devices effectively is difficult.

For this reason asset discovery is the foundation of network security.

What Is a Network Asset Inventory?

It is the central inventory of the systems connected to the network.

For example:

Firewall

Switch

Router

Server

Laptop

Printer

IP Camera

IoT

Access Point

devices such as these should be kept on record.

Why Is an Unknown Device Risky?

A device of unknown identity could be;

an unauthorized user device,

a legacy system,

a rogue device

or a compromised system.

Any of these is possible.

What Is a Rogue Device?

It is a device connected to the corporate network without permission.

Why Is the OSI Model Important in Network Security?

Network security is applied at different communication layers.

The OSI model makes it easier to understand these layers.

What Are the Layers of the OSI Model?

There are seven fundamental layers:

• Physical
• Data Link
• Network
• Transport
• Session
• Presentation
• Application

What Is Layer 2 Security?

These are the security controls at the Data Link layer.

Switching and MAC address based risks can be addressed at this level.

What Is Layer 3 Security?

It is security at the IP and routing level.

ACL and network segmentation can play an important role at this layer.

What Is Layer 4 Security?

It is network control carried out over TCP/UDP ports.

What Is Layer 7 Security?

It is traffic analysis and security control at the application level.

Modern NGFW systems can analyze not only IP and port but application behaviour as well.

What Is a Firewall?

A firewall is the system that controls the traffic between different network segments according to security rules.

What Does a Firewall Do?

For example, the following policy can be applied:

User Network

→

Database Network

→

DENY

Application Server

→

Database Network

→

ALLOW

In this way users can be prevented from reaching the database directly.

What Is a Stateful Firewall?

It is a firewall architecture that tracks the state of the connection.

What Is a Stateless Firewall?

It can evaluate every packet independently of the connection context.

What Is NGFW?

NGFW:

Next-Generation Firewall

can offer advanced traffic and application security features in addition to traditional firewall capabilities.

What Features Can an NGFW Have?

For example:

Application Control

IPS

URL Filtering

SSL Inspection

Anti-Malware

Threat Intelligence

What Is Application Control?

It is the control of network traffic not only according to the port number but according to the application being used.

Why Is Port Control Alone Not Enough?

Modern applications may use the same ports.

For example, many services run over TCP/443.

Saying only:

443 is open

does not show that the traffic is secure.

What Is Deep Packet Inspection - DPI?

It is a technique aimed at analyzing not only the header information of network packets but deeper protocol or content characteristics.

What Is SSL/TLS Inspection?

It is the performance of inspection in a suitable architecture so that encrypted traffic can be passed through security controls.

Should SSL Inspection Be Used on All Traffic?

No.

Privacy, certificate, performance and regulatory requirements must be evaluated.

What Is Network Segmentation?

It is the separation of the network into different sections according to security and business requirements.

What Is a Flat Network?

It is a network structure in which devices can largely reach one another and segmentation is weak.

Why Is a Flat Network Risky?

When one endpoint is compromised the attacker can reach other systems more easily.

What Is the Main Purpose of Network Segmentation?

It is to block unnecessary communication between systems.

An Example of Network Segmentation

User VLAN

Server VLAN

Database VLAN

Management VLAN

Guest VLAN

IoT VLAN

Backup VLAN

it can be separated in this way.

What Is a VLAN?

VLAN:

Virtual Local Area Network

makes it possible to create logical network segments on top of the physical switch infrastructure.

Does a VLAN Provide Security on Its Own?

No.

Traffic between segments must be controlled with a firewall or ACL.

What Is Inter-VLAN Routing?

It is the routing operation that allows different VLANs to communicate with one another.

Should Inter-VLAN Traffic Be Controlled?

Yes.

What Is Micro-Segmentation?

It is the application of network segmentation at a more granular level.

Why Is Micro-Segmentation Important?

It can prevent even workloads in the same data centre or cloud environment from reaching one another unnecessarily.

What Is East-West Traffic?

It is the horizontal traffic between systems inside the organization.

For example:

Application Server → Database

Server → Server

Workload → Workload

What Is North-South Traffic?

It is the traffic between the corporate network and external systems or the internet.

Which Traffic Did Traditional Security Focus On?

Mostly North-South Traffic.

Why Is East-West Traffic Critical in Modern Attacks?

After passing the perimeter the attacker may try to move between internal systems.

For this reason protecting only the internet boundary is not enough.

What Is Perimeter Security?

It is the security approach based on protecting the boundary between the corporate network and the outside world.

Is Perimeter Security Enough on Its Own?

No.

In modern networks;

cloud,

remote worker,

SaaS,

mobile,

third-party

because of these the classical network boundary has become blurred.

What Is Lateral Movement?

It is the attacker's progress from the first system compromised to other systems.

Why Is Lateral Movement Dangerous?

The first compromise may be a low-value laptop.

However, from there the attacker;

server,

Active Directory,

database,

backup

may try to reach critical systems such as these.

How Does Network Segmentation Reduce Lateral Movement?

It closes the unnecessary network paths between systems.

What Is Blast Radius?

It is the scope of the systems a security incident can affect.

Does Segmentation Reduce the Blast Radius?

Yes.

The aim is to prevent a compromised device from reaching the whole network.

What Is a DMZ?

DMZ:

Demilitarized Zone

is the security segment in which internet-facing services are separated from the internal network.

Which Systems Can Be Located in the DMZ?

Web gateway,

reverse proxy,

mail gateway

internet-facing services such as these can be located there.

Should All Traffic From the DMZ to the Internal Network Be Opened?

No.

The minimum necessary connections must be defined.

What Is an ACL?

ACL:

Access Control List

is the control of network traffic with permit or deny rules according to characteristics such as source, destination, port or protocol.

What Is Default Deny?

It is the blocking by default of traffic that has not been explicitly permitted.

Why Is Default Allow Risky?

New systems or services can become reachable without being noticed.

How Is Least Privilege Applied in Network Security?

It can be applied not only to user privileges but to network connections as well.

A system should be able to reach only the destinations and ports it needs.

What Is Network Least Privilege?

For example, if an application server needs only:

Database Server → TCP/5432

this access, it may not need to reach other database systems.

What Is NAC?

NAC:

Network Access Control

is the security approach that controls which users and devices can connect to the network.

Why Is NAC Necessary?

A firewall controls traffic.

However, NAC can control which device connects to the network.

Which Questions Does NAC Answer?

Who is this device?

Who is the user?

Is the device corporate?

Is the security posture suitable?

Which VLAN should it be placed in?

What Is 802.1X?

It is one of the standards used for network access authentication.

What Is RADIUS?

It is the protocol used in network authentication and authorization processes.

What Is Dynamic VLAN Assignment?

It is the automatic assignment of a VLAN according to user or device identity.

Why Should the Guest Network Be Separated?

In order to prevent guest devices from reaching the corporate network.

What Is BYOD?

BYOD:

Bring Your Own Device

is employees using their personal devices in the work environment.

What Is the Network Security Risk of BYOD?

The security posture of the device may not be under the organization's control.

What Is a Device Posture Check?

It is the checking of the security state of the device.

For example:

Is EDR active?

Is the OS up to date?

Is the disk encrypted?

What Is a Quarantine VLAN?

It is the network segment in which devices that do not meet the security requirements are isolated.

What Is IDS?

IDS:

Intrusion Detection System

tries to detect suspicious network activity.

What Is IPS?

IPS:

Intrusion Prevention System

can block the traffic as well as detecting suspicious network activity.

What Is the Difference Between IDS and IPS?

In simplified form:

IDS → Detect

IPS → Detect + Prevent

What Is Signature-Based Detection?

It is the detection of known attack patterns through signatures.

What Is Anomaly-Based Detection?

It is the detection of deviations from normal network behaviour.

Can Signature Detection Find Zero-Day Attacks?

Not always.

For unknown attacks behavioural and anomaly detection can gain importance.

What Is a Network Baseline?

It is the reference profile of the normal traffic behaviour of the network.

What Can a Baseline Contain?

Normal bandwidth

Protocol usage

Connection count

Communication pairs

Traffic direction

What Is NDR?

NDR:

Network Detection and Response

is the security approach that helps detect suspicious behaviour by analyzing network traffic and telemetry data.

Why Is NDR Important?

Some movements that are not visible on the endpoint can be seen at network level.

What Can NDR Detect?

Depending on the technology;

Lateral Movement

Command & Control

Unusual Connections

Data Exfiltration

Scanning

Anomalous Traffic

behaviours such as these can be analyzed.

What Is Network Telemetry?

It is technical data that provides information about network behaviour.

What Are the Sources of Network Telemetry?

For example:

NetFlow

IPFIX

Packet Metadata

DNS Logs

Firewall Logs

Proxy Logs

What Is NetFlow?

It is a telemetry approach that provides metadata about network communication such as source, destination, port, protocol and traffic volume.

What Is IPFIX?

It is one of the standards used for flow information export.

What Is PCAP?

PCAP:

Packet Capture

is the detailed recording of network packets.

Are PCAP and NetFlow the Same?

No.

PCAP provides more detailed packet data.

NetFlow offers more summarized traffic metadata.

What Is a SPAN Port?

It is the mechanism that allows switch traffic to be copied to an analysis system.

What Is a Network TAP?

It is the mechanism that helps carry network traffic to the monitoring system physically or logically.

What Is Network Visibility?

It is being able to see which devices inside the network communicate with whom and how.

Why Is Network Visibility the Foundation of Security?

Traffic that is not seen cannot be analyzed.

Behaviour that cannot be analyzed cannot be detected.

Why Is Encrypted Traffic Visibility Difficult?

When traffic is encrypted with TLS the payload cannot be read directly.

Can Threat Detection Be Performed on Encrypted Traffic?

Yes.

Metadata,

connection behaviour,

destination reputation,

certificate information

signals such as these can be analyzed.

What Is DNS Security?

It is the monitoring of DNS queries from a security point of view and the blocking of malicious domain access.

Why Is DNS Critical for Cyber Security?

Many malware families and attack infrastructures can communicate through domain names.

What Is DNS Filtering?

It is the blocking of known malicious or out-of-policy domains.

What Is DNS Tunneling?

It is the possibility of the DNS protocol being abused for data communication outside its normal purpose of use.

Are DNS Logs Valuable for the SOC?

Yes.

The communication of a compromised endpoint with suspicious domains can be seen.

What Is DHCP?

It is the protocol that provides automatic IP configuration to devices.

What Is Rogue DHCP?

It is an unauthorized DHCP server running on the network.

What Is DHCP Snooping?

It is the security feature that helps control trusted and untrusted DHCP sources at switch level.

What Is ARP Spoofing?

It is the attacker trying to manipulate the ARP relationships on the local network.

What Is Dynamic ARP Inspection?

It is the switch security feature that helps reduce the spoofing risk by validating ARP messages.

What Is Port Security?

It is the security mechanism that limits which devices or which MAC address behaviour can connect to a switch port.

Why Is Switch Security Important?

Switches are the cornerstone of internal network traffic.

Compromised network infrastructure can create serious visibility and access risk.

Why Is Router Security Important?

Routers determine the traffic paths between networks.

Incorrect routing or a compromise can affect all network traffic.

What Is the Management Plane?

It is the control surface on which network devices are managed.

Should the Management Plane Be Separated?

In critical environments separating the management network from user traffic is a strong security approach.

Should Telnet Be Used for Network Device Management?

As far as possible, no.

Encrypted management protocols such as SSH should be preferred.

What Is SNMP?

It is the protocol used in the monitoring and management processes of network devices.

Why Is SNMP Security Important?

The use of a weak community string or an old protocol can create information leakage and management risk.

What Is TACACS+?

It is an AAA protocol that can be used particularly in network device administrator authentication and authorization processes.

What Is AAA?

AAA:

Authentication

Authorization

Accounting

is what it means.

Should Network Administrator Operations Be Audited?

Yes.

It must be known who changed which firewall, switch or router configuration.

Why Is Configuration Backup Important?

Secure backups of firewall, router and switch configurations must be kept.

What Is Network Configuration Drift?

It is the deviation of network devices over time from the approved security baseline.

What Is a Firewall Rule Review?

It is the periodic examination of firewall policies.

Why Is an Any-Any Rule Risky on a Firewall?

The absence of a source, destination or service restriction can create unnecessarily broad access.

What Is a Shadow Rule?

It is a rule that is in practice never used because of another firewall rule.

What Is a Stale Firewall Rule?

It is a rule that has been left active even though there is no longer a business need for it.

What Is Firewall Rule Recertification?

It is the periodic revalidation of the owner of the rule and of the business need.

What Is a VPN?

VPN:

Virtual Private Network

allows remote users or systems to reach corporate resources over an encrypted connection.

What Is Remote Access VPN?

It is the type of VPN that allows employees to connect to the corporate network from outside.

What Is Site-to-Site VPN?

It provides an encrypted connection between two networks.

Does Using a VPN Mean Zero Trust?

No.

A VPN most often includes the user in the network.

Zero Trust, on the other hand, tries to limit access on a resource basis.

What Is ZTNA?

ZTNA:

Zero Trust Network Access

is the approach that aims to provide the user with controlled access to the application or resource they need instead of to the whole network.

What Is Zero Trust?

The basic principle:

Never Trust, Always Verify

can be summarized in this way.

However, Zero Trust is not merely a slogan.

Identity,

device posture,

least privilege,

continuous verification

it requires controls such as these.

What Does Zero Trust Change in Network Security?

The classical approach:

Inside = Trusted

Outside = Untrusted

The modern approach:

Every access must be verified.

What Is DDoS?

DDoS:

Distributed Denial of Service

is the type of attack that aims to make a service unreachable by sending intense traffic to the target system from a large number of sources.

Is DDoS Part of Network Security?

Definitely.

Availability is one of the fundamental goals of network security.

What Is Volumetric DDoS?

These are high-volume attacks aimed at consuming network bandwidth.

What Is a Protocol Attack?

These are attacks aimed at consuming network or transport protocol resources.

What Is Application Layer DDoS?

It is an attack aimed at consuming application services with intense requests.

Where Should DDoS Protection Be Performed?

Not at a single layer.

ISP,

cloud scrubbing,

CDN/WAF,

firewall,

application

layers such as these can be evaluated together.

What Is Network Resilience?

It is the network's ability to continue providing service in the event of a failure or an attack.

What Is a Redundant Network?

It is the redundant design of critical network components.

What Is Firewall HA?

It is the high availability structure that allows the other device to continue the service when one firewall fails.

What Is Dual ISP?

It is the organization using more than one internet service provider.

Does Network Redundancy Provide Security?

It is strong in terms of availability but does not take the place of access control and threat detection.

Why Is Wireless Network Security Important?

A wireless network is reachable from a certain coverage area without requiring a physical cable.

For this reason authentication and encryption are critical.

What Is WPA3?

It is one of the modern Wi-Fi security standards.

What Is Enterprise Wi-Fi?

It is the wireless network architecture in which corporate authentication and central management mechanisms are used.

What Is a Rogue Access Point?

It is an access point that does not belong to the organization or has been installed without permission.

What Is Evil Twin?

It is the creation of a fake access point that resembles the real Wi-Fi network.

Should Guest Wi-Fi Be Separated From the Corporate Network?

Yes.

Should the IoT Network Be Separated?

Using a separate segment on a risk basis is a strong approach.

Why Are IoT Devices a Network Security Risk?

Patch support may be limited.

They may use default credentials.

Their security capabilities may be low.

Should the Printer Be on a Separate Network?

A separate segment can be evaluated according to risk and network architecture.

Why Is IP Camera Network Security Important?

Camera and NVR systems are also endpoints connected to the network and can create an attack surface.

What Is an OT Network?

It is the network on which Operational Technology systems are located.

Should IT and OT Networks Be Separated?

In critical production environments segmentation is one of the fundamental security approaches.

Why Is IT/OT Segmentation Important?

It can reduce the direct spread of a compromise in the IT environment to production systems.

What Is Network Security Monitoring?

It is the continuous monitoring of network security events.

Which Logs Should Be Monitored?

For example:

Firewall Logs

VPN Logs

NAC Logs

IDS/IPS Logs

NDR Alerts

DNS Logs

Proxy Logs

What Is Syslog?

It is the logging mechanism widely used for network and security devices to send their logs to central systems.

What Is SIEM?

SIEM:

Security Information and Event Management

helps to collect and analyze security logs from different systems centrally.

Should Network Logs Be Sent to the SIEM?

Critical network security events must be transferred to the central SIEM.

How Can a SIEM Detect a Network Attack?

For example:

Firewall denied connection spike

VPN unusual login

NDR lateral movement alert

DNS malicious domain

by being evaluated together a more meaningful incident can be created.

What Does the SOC Do in Network Security?

SOC:

Security Operations Center

investigates possible attacks by continuously monitoring network and endpoint security events.

What Is an IOC?

IOC:

Indicator of Compromise

is a technical indicator that points to the possibility of a compromise.

For example:

Malicious IP

Domain

URL

Hash

How Is Threat Intelligence Used in Network Security?

Network connections can be compared with known malicious infrastructure information on the firewall, DNS, NDR or SIEM.

What Is Command and Control - C2?

It is the compromised system communicating with the attacker's infrastructure.

Can C2 Traffic Be Detected on the Network?

In some cases, yes.

Destination reputation,

beaconing,

DNS behaviour,

traffic pattern

can be analyzed.

What Is Beaconing?

It is the compromised system establishing a connection to the C2 infrastructure at certain intervals.

What Is Data Exfiltration?

It is data being taken outside the organization in an unauthorized way.

How Can Data Exfiltration Over the Network Be Seen?

For example, a device that normally performs low upload producing very high outbound traffic during the night hours can be suspicious.

What Is Egress Filtering?

It is the control of the network traffic leaving the organization.

Why Is an Inbound Firewall Alone Not Enough?

After getting inside, the attacker may try to connect to an external C2 server or to take data out.

For this reason:

Outbound / Egress Security

is important too.

What Is Ingress Filtering?

It is the control of the traffic coming into the network.

Are North-South and East-West Visibility Needed Together?

Yes.

Modern Network Security should not look only at perimeter traffic.

What Is Defense in Depth?

It is the application of security in many layers instead of a single control.

An Example of Network Defense in Depth

Internet

↓

DDoS Protection

↓

NGFW

↓

DMZ

↓

Segmentation

↓

NAC

↓

NDR

↓

Server Security

↓

Application Security

↓

Database Security

This approach aims for the other layers to provide protection in the event that a single security control fails.

Are Network Security and Endpoint Security the Same?

No.

Endpoint Security protects the device.

Network Security protects the communication between devices.

However, they need to work together.

What Is the Difference Between EDR and NDR?

EDR provides visibility on the endpoint.

NDR focuses on network behaviour.

Why Are EDR + NDR Powerful?

Process behaviour on the endpoint and connection behaviour on the network can be analyzed together.

What Is XDR?

XDR aims to unify detection and response by collecting telemetry from different security layers.

Network Security and MITRE ATT&CK

MITRE ATT&CK can be used to model the tactics and techniques used by attackers.

Network telemetry can provide important visibility particularly at stages such as;

Discovery

Lateral Movement

Command and Control

Exfiltration

stages such as these.

What Is Network Hardening?

It is the configuration of network devices according to a secure configuration standard.

What Can Network Hardening Contain?

Default accounts

Management protocols

Unused services

SNMP

AAA

Logging

Firmware

ACL

Is a Default Password Risky on Network Devices?

Definitely.

Should Network Device Firmware Be Updated?

Yes.

The patch and firmware lifecycle must be managed in order to close security vulnerabilities.

What Is an EOL Network Device?

It is a network device whose vendor support has ended.

Is an EOL Firewall Risky?

Yes.

It may no longer receive new security updates.

What Is Configuration Management?

It is the controlled management of firewall, router and switch configurations.

Why Is Network Change Management Important?

A single incorrect firewall or routing change can create a large outage.

Should Network Configuration Changes Be Audited?

Yes.

What Is Network Backup?

It is the taking of configuration backups of network devices.

Should the Firewall Configuration Backup Be Encrypted?

Since it may contain sensitive configuration and secrets, it must be stored securely.

What Is a Network Security Assessment?

It is the evaluation of network architecture and security configurations in terms of risk.

What Does a Network Security Assessment Examine?

Segmentation

Firewall rules

Network exposure

Device configuration

Management access

Logging

What Is a Network Penetration Test?

It is the controlled investigation of vulnerabilities in network systems from the attacker's perspective.

What Is an Internal Network Penetration Test?

It is the testing of the internal attack surface on the assumption that the attacker has gained access to the internal network.

What Is an External Network Penetration Test?

It is the evaluation of internet-facing systems from the perspective of an external attacker.

What Is a Network Vulnerability Assessment?

It is the identification of known vulnerabilities and misconfigurations in network systems.

Are Vulnerability Assessment and Pentest the Same?

No.

A vulnerability assessment identifies possible vulnerabilities.

A pentest can evaluate their impact in real attack scenarios in a controlled way.

What Is Network Security Architecture?

It is the holistic design of network security controls.

What Does a Strong Network Security Architecture Look Like?

For example:

Internet

↓

DDoS Protection

↓

NGFW

↓

DMZ

↓

Internal Segmentation Firewall

↓

Server Network

↓

Application Network

↓

Database Network

and in parallel:

NAC

NDR

SIEM

SOC

PAM

EDR

security layers such as these can operate.

Zero Trust Network Architecture

At a more advanced level access:

User + Device + Identity + Context + Resource

can be evaluated over these.

Is Identity Part of Network Security?

Yes.

Modern Network Security is increasingly becoming identity-aware.

What Is an Identity-Aware Firewall?

It is the ability to apply policy not only according to the IP address but according to user or group identity.

Is an IP Address an Identity?

No.

An IP can change and does not always show with certainty the person using a device.

What Is a Network Security Policy?

It is the policy document that defines the organization's network access and security rules.

What Should a Network Security Policy Contain?

Network Segmentation

Firewall

Remote Access

Wireless

NAC

Monitoring

Logging

Network Device Management

What Can Network Security KPIs Be?

For example:

Unknown Device Count

Firewall Rule Review Completion

Critical Network Vulnerabilities

NAC Coverage

NDR Coverage

Network Availability

What Can Network Security KRIs Be?

For example:

Publicly Exposed Services

Any-Any Firewall Rules

Unsupported Network Devices

Unsegmented Critical Systems

Unmanaged Devices

What Should a Network Security Dashboard Show?

Internet Exposure

Network Asset Coverage

Firewall Health

NAC Status

NDR Alerts

Critical Vulnerabilities

Segmentation Risks

The Most Frequently Made Mistakes in Network Security

The mistakes frequently encountered in organizations are these:

• Thinking that the network is protected by the firewall alone
• Using a flat network
• Believing that a VLAN is a security control on its own
• Accepting internal traffic as trusted
• Not monitoring East-West traffic
• Leaving Any-Any firewall rules in place
• Not carrying out firewall rule reviews
• Not separating the guest and corporate networks
• Keeping IoT devices on the user network
• Opening network device management interfaces to everyone
• Using insecure management protocols such as Telnet
• Leaving default credentials in place
• Neglecting firmware and patch management
• Not using NAC
• Not monitoring unknown devices
• Not collecting DNS logs
• Not providing NDR or network visibility
• Automatically accepting the VPN user as trusted
• Not controlling outbound traffic
• Not taking network configuration backups
• Using EOL firewalls and switches

Network Security Checklist

In a corporate network security assessment the following questions can be asked:

• Is a network asset inventory available?
• Is the network topology up to date?
• Have critical systems been separated into segments?
• Have the user and server networks been separated?
• Is the database network isolated?
• Has the backup network been separated?
• Is the guest Wi-Fi isolated?
• Is there IoT segmentation?
• Are firewall rule reviews carried out?
• Are there any Any-Any rules?
• Is NAC being used?
• Is 802.1X being applied?
• Are IDS/IPS active?
• Is there NDR visibility?
• Is DNS security being applied?
• Is there MFA on VPN access?
• Has ZTNA been evaluated?
• Do the network devices use central AAA?
• Are configuration changes being audited?
• Do network logs go to the SIEM?
• Are there any EOL network devices?
• Are network penetration tests carried out?

Network Security Maturity Model

Level 1 - Perimeter Security

A firewall is in place.

The internal network is largely flat.

Level 2 - Segmented Network

VLANs and basic segmentation are applied.

Level 3 - Controlled Access

NAC, strong authentication and central network management are applied.

Level 4 - Continuous Detection

NDR, SIEM, SOC and network telemetry are actively used.

Level 5 - Zero Trust Network

Identity-aware access, micro-segmentation and continuous verification are applied.

Frequently Asked Questions

What is network security?

Network security is the protection of the network infrastructure and of the data carried over the network against unauthorized access, attack, data leakage and service interruption.

What is Network Security?

Network Security is the security field that covers many controls such as firewall, segmentation, NAC, IDS/IPS, NDR, VPN, ZTNA, DNS Security and monitoring.

Is a firewall enough for network security?

No. Modern network security requires multi-layered defence.

What is Network Segmentation?

It is the separation of the network into different security zones and the control of the traffic between those zones.

Does a VLAN provide security?

A VLAN can be used for segmentation but it is not a security control on its own. The traffic between segments must be controlled separately.

What is NAC?

Network Access Control is the approach that checks the identity and security state of the users and devices connecting to the network.

What is the difference between IDS and IPS?

IDS focuses on detecting attacks, while IPS also focuses on blocking the malicious traffic that has been detected.

What is NDR?

Network Detection and Response helps to detect and analyze suspicious behaviour through network traffic and telemetry.

What is Lateral Movement?

It is the attacker trying to progress from the first system they have taken over to other systems.

What is East-West Traffic?

It is the traffic between servers, endpoints and workloads inside the organization.

What is North-South Traffic?

It is the traffic between the corporate network and the internet or external systems.

What is ZTNA?

Zero Trust Network Access is the secure access approach that aims for the user to reach only the resource or application they are authorized for rather than the whole network.

What is Zero Trust?

It is the security model in which the presence of the user or device inside the network is not accepted as an automatic reason for trust and access is continuously verified.

What is Network Hardening?

It is the configuration of firewalls, routers, switches, wireless controllers and other network devices according to a secure configuration standard.

What is a network security test?

It is the evaluation of network systems in terms of vulnerabilities, misconfiguration, unnecessary services, access control and attack surface.

Conclusion: Modern Network Security Is Much More Than a Firewall

For many years the first technology that came to mind when network security was mentioned was the firewall.

The firewall is still one of the most important components of network security.

However, the network structure of modern organizations is no longer only:

Internet → Firewall → LAN

in this form.

In today's organizations;

remote workers,

cloud workloads,

SaaS applications,

mobile devices,

IoT,

third-party connections,

multiple data centers,

hybrid cloud

are parts of the same digital ecosystem.

For this reason the network security approach has changed too.

The basic model of modern network security can be thought of in this way:

Asset Visibility

↓

Secure Configuration

↓

Network Segmentation

↓

Least Privilege

↓

NAC

↓

NGFW

↓

IDS/IPS

↓

NDR

↓

DNS Security

↓

SIEM

↓

SOC

↓

Zero Trust

The aim is not to assume that the attacker will never be able to get inside.

The more realistic question is this:

If a system is compromised, how far can the attacker progress?

If the compromise of a single user computer allows the attacker;

to the server network,

to the databases,

to the backup systems,

to Active Directory

to reach these, then the network architecture is not secure enough.

For this reason modern Network Security must answer three fundamental questions:

Who is connecting?

Where can they reach?

What are they doing on the network?

The answer to the first question:

Identity + NAC

The answer to the second question:

Segmentation + Firewall + Zero Trust

The answer to the third question:

Network Visibility + NDR + SIEM + SOC

can be these.

As a result, a strong corporate network security architecture:

Prevent + Segment + Observe + Detect + Respond

applies these principles together.

Network security is not merely protecting the outer boundary of the organization.

The real aim;

is to shrink the attack surface, to limit trust relationships, to make lateral movement difficult, to isolate critical systems and to detect abnormal behaviour within the network as early as possible.