Network Security Concept

Logical Security, Physical Security, Deception Technologies, Security Terminology, Audits and Compliance, and Network Segmentation

This objective addresses the core framework of network security. Protecting an enterprise network requires a defense-in-depth strategy that spans cryptographic controls, identity governance, physical boundaries, and strict architectural segmentation.

Let’s break down these essential security building blocks.

1. Common Security Terminology & The CIA Triad

Before exploring specific technical controls, it is vital to establish the foundational language of risk and security posture management.

The CIA Triad

The ultimate goal of any security policy is to balance the three pillars of the CIA Triad:

• Confidentiality: Ensuring data is strictly shielded from unauthorized eyes (achieved via encryption, access controls, and training).
• Integrity: Guaranteeing that data has not been altered, tampered with, or corrupted during storage or transit (achieved via hashing, digital signatures, and strict write permissions).
• Availability: Ensuring that authorized users have dependable, uninterrupted access to systems and data whenever they need it (achieved via redundancy, backups, and DDoS mitigation).

Risk Equations

• Asset: Anything of value to the company (data, hardware, reputation).
• Threat: Any potential real-world force or actor that could cause harm to an asset (e.g., a hacker, a malware strain, a power outage, or a flash flood).
• Vulnerability: A weakness, flaw, or gap in your defenses that leaves an asset exposed (e.g., an unpatched software bug, a weak password policy, or a missing lock on a server room door).
• Exploit: The specific mechanism, tool, or action used to exploit a vulnerability and compromise an asset (e.g., executing malicious code against a vulnerable port).
• Risk: The statistical probability or likelihood that a threat will successfully exploit a vulnerability and cause real-world damage to an asset ({Risk} = \{Threat} \times \text{Vulnerability} \times \text{Asset Value}).

2. Logical Security & Cryptography

Logical security applies programmatic and mathematical algorithms to shield data from threats.

Encryption States

• Data in Transit: Traffic actively moving across a wire or wireless channel. It must be protected using transport encryption protocols such as HTTPS, SSH, or IPsec VPNs, so that any attacker sniffing packets in transit sees only scrambled binary gibberish.
• Data at Rest: Stationary data sitting permanently on physical media, such as hard drives, database servers, or backup tapes. It is protected with disk-level encryption (such as BitLocker) or database encryption to prevent data leaks if a physical drive is stolen.

Certificates & Public Key Infrastructure (PKI)

• PKI (Public Key Infrastructure): The entire underlying framework of hardware, software, people, and policies used to create, manage, distribute, store, and revoke digital certificates. It relies on asymmetric key pairs (a public key everyone can see, and a private key kept strictly secret) to prove identity online.
• Self-Signed Certificates: A certificate created and signed by the local administrator or the internal server itself, rather than by a globally recognized, trusted third-party Certificate Authority (such as DigiCert).
  • Usage: Ideal for internal sandbox testing environments or closed home lab systems where you explicitly trust the host, but never use on public corporate websites, as standard web browsers will display a red warning screen to users.

3. Identity and Access Management (IAM)

IAM governs the digital lifecycle of users, explicitly defining who they are, how they prove it, and exactly what resources they are permitted to touch.

Authentication vs. Authorization

• Authentication: Proving who you are (e.g., typing a username and password).
• Authorization: Defining what you are allowed to do once inside (e.g., verifying that you have permission to view payroll spreadsheets).

Advanced Authentication & Federation

• MFA (Multifactor Authentication): Requiring a user to provide at least two distinct verification factors before logging in. These factors must span different categories:
  • Something you know: A password, PIN, or security question.
  • Something you have: A hardware token, a smart card, or a temporary authenticator app code.
  • Something you are: A fingerprint, facial scan, or iris geometry.
• Time-Based Authentication: Utilizing temporary, rotating one-time passwords (TOTP) that expire every 30 or 60 seconds, or restricting a user’s login rights to specific operational business hours.
• SSO (Single Sign-On): A centralized authentication service that allows a user to log in once with a single set of credentials and automatically gain access to dozens of independent corporate applications without re-typing their password.
• SAML (Security Assertion Markup Language): An open, XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. It is the primary framework that makes secure cloud-based SSO function across separate domains.

Centralized Access Protocols

• LDAP (Lightweight Directory Access Protocol): A centralized protocol for querying and managing directory service databases (such as Microsoft Active Directory) to quickly verify user accounts and corporate structures.
• RADIUS (Remote Authentication Dial-In User Service): A centralized network access protocol used to authenticate end users connecting to shared infrastructure, such as remote-access VPNs, wireless enterprise access points, or dial-in routers.
• TACACS+ (Terminal Access Controller Access-Control System Plus): A Cisco-designed alternative to RADIUS built explicitly for device administration. It completely separates authentication, authorization, and accounting (AAA) and encrypts the entire packet payload. It is used to manage and audit network engineers who log in to core switches and routers to change configurations.
• Geofencing: Restricting access to an application or system based on a user’s real-world GPS coordinates, for example, blocking an employee from logging into a financial portal if their device is outside the corporate office boundary.

Authorization Structures

• Least Privilege: The core security principle that dictates that users and systems should be granted only the absolute bare minimum access permissions necessary to perform their specific daily job functions, and nothing more.
• RBAC (Role-Based Access Control): Managing access permissions by grouping users into corporate roles (e.g., “HR Team,” “IT Admins,” “Finance”) rather than assigning rights to individual accounts. If an employee transfers departments, you change their role group, and their entire permission footprint scales automatically.

4. Physical Security, Deception, & Compliance

Physical Security

The tightest logical encryption is worthless if a malicious actor can walk straight into a building and carry a physical server away.

• Cameras (CCTV): Deployed at building perimeters, entry gates, and server room hallways to provide continuous monitoring, psychological deterrence, and an audit trail of physical movement.
• Locks: Mechanical keys, electronic badge scanners, biometric thumbprint readers, and specialized mantraps (double-door entry cages designed to trap an unauthorized tailgater) to prevent physical access to hardware.

Deception Technologies

• Honeypot: A single, isolated decoy server intentionally configured to appear highly vulnerable and to be packed with fake data. It is placed on the network strictly as a trap to lure in hackers or internal malicious actors. Because it has no real corporate function, any traffic touching it triggers an immediate high-priority security alert.
• Honeynet: A larger, more complex decoy network comprising multiple fake servers, dummy routers, and simulated databases, designed to keep an advanced attacker distracted in a sandbox environment while security analysts study their attack techniques.

Audits and Regulatory Compliance

• Data Locality (Sovereignty): The legal requirement that digital data must be physically stored, processed, and maintained within the geographic borders of a specific country or region, forcing networks to route and store files in compliant regional data centers.
• PCI DSS: A strict, global technical security standard mandatory for any network that processes, stores, or transmits credit card data. It dictates specific firewall rules, encryption levels, and regular vulnerability audits.
• GDPR: A comprehensive European Union privacy regulation governing how personal user data is collected and protected. It carries massive financial penalties for networks that fail to safeguard consumer identity data or experience unreported data breaches.

5. Network Segmentation Enforcement

Network segmentation is the practice of splitting an enterprise network into distinct, isolated zones to prevent lateral movement—ensuring that if an attacker compromises one device, they cannot easily pivot to reach sensitive data segments.

• IoT / IIoT (Internet of Things): Smart devices like internet-connected office thermostats, smart light bulbs, and security cameras. These devices rarely receive security patches and are notorious entry points for attackers. They must be isolated on their own dedicated, firewalled VLAN with zero access to the primary corporate data network.
• SCADA / ICS / OT (Operational Technology): Industrial automation systems that run physical assembly lines, electrical grids, water treatment pumps, and heavy machinery. These legacy systems are highly fragile, utilize specialized non-IP protocols, and often run ancient operating systems. They must be placed inside tightly sealed, air-gapped, or heavily restricted network segments to guarantee safety.
• Guest Networks: A separate, unauthenticated or captive-portal-guaranteed wireless segment built strictly for visitors. It grants direct access to the public internet but completely blocks guests from scanning, seeing, or communicating with any internal company servers.
• BYOD (Bring Your Own Device): Allowing employees to connect their personal smartphones and laptops to corporate systems. Because the company does not own or control these devices, they represent a significant malware risk. BYOD traffic is isolated on a dedicated network tier and managed via Mobile Device Management (MDM) software to enforce baseline compliance checks before access to company email is granted.

Security Concepts Study Matrix

Technology / Concept	Primary Purpose	Key Identifying Phrase for the Exam
TACACS+	Device Admin	Encrypts entire packet; manages administrative switch logins.
SAML	Federation / SSO	XML-based token exchange used to authorize cloud SSO logins.
Honeypot	Deception	A decoy trap device is used to alert to unauthorized network activity safely.
Least Privilege	Authorization	Restricting user access to the absolute minimum required to do their job.
SCADA / ICS	Operational Tech (OT)	Controls physical industrial infrastructure; requires extreme isolation.
Vulnerability	Risk Metrics	A flaw, gap, or structural weakness in a network defense blueprint.