Network Security Fundamentals and Threat Landscape
Network security involves implementing controls and measures to protect network infrastructure, data, and users from unauthorized access, misuse, and attacks. Understanding the CIA triad forms the foundation for all security decisions.
Understanding the CIA Triad
Confidentiality ensures data remains private. Integrity guarantees data hasn't been altered. Availability ensures systems remain operational and accessible. These three pillars guide every network security implementation.
Common Threat Types
The threat landscape encompasses multiple attack categories:
- Malware and ransomware that encrypt or corrupt data
- Phishing attacks that exploit human psychology
- Man-in-the-middle attacks that intercept communications
- Denial-of-service (DoS) attacks that overwhelm systems
- Zero-day exploits that target previously unknown vulnerabilities
- Advanced persistent threats (APTs) that are prolonged, targeted campaigns
Layered Security Approach
Network security operates at multiple layers. Physical security involves protecting hardware and facilities. Network layer security includes firewalls and routing controls. Application layer security addresses software vulnerabilities. Security professionals must implement defense-in-depth using multiple layers of protection. No single solution provides complete protection. Instead, combine various technologies and best practices.
Attack vectors are the methods attackers use to infiltrate systems. Understanding these vectors helps you implement appropriate defensive measures for each scenario. The exam emphasizes recognizing threat types and identifying defenses that counter them.
Firewalls, Access Control Lists, and Filtering Technologies
Firewalls serve as the primary barrier between trusted internal networks and untrusted external networks. These security devices monitor and control incoming and outgoing network traffic based on predetermined security rules.
Firewall Types and Operation
Stateless firewalls examine individual packets without considering the context of existing connections. Stateful firewalls track active connections and only allow packets that belong to established sessions. Next-Generation Firewalls (NGFWs) add application-layer inspection and advanced threat prevention features.
Access Control Principles
Access Control Lists (ACLs) define which users, devices, or applications can access specific network resources. Implicit deny is a critical security principle where all traffic is blocked by default unless explicitly allowed. This approach ensures you intentionally enable only necessary traffic.
Network segmentation using VLANs, subnets, and DMZs creates logical barriers within networks. A DMZ (demilitarized zone) is a network segment that exposes external-facing services while protecting internal resources. This isolation prevents attackers from directly accessing sensitive systems.
Filtering Technologies
- Packet filtering examines packet headers
- Deep packet inspection (DPI) analyzes packet contents
- Content filtering blocks access to specific websites or application types
- Port filtering restricts traffic on specific ports
- Geofencing prevents access from specific locations
Principle of least privilege means users and systems receive only the access necessary for their roles. Understanding when to implement each filtering type depends on security requirements and network architecture. The exam requires knowledge of common ports, protocols, and appropriate firewall rules for different scenarios.
Virtual Private Networks, Encryption, and Secure Protocols
Virtual Private Networks (VPNs) create encrypted tunnels for secure communication over untrusted networks like the internet. They protect data confidentiality and enable secure remote access.
VPN Types and Protocols
Site-to-site VPNs connect entire networks together. Remote access VPNs connect individual users to networks. Common VPN protocols include:
- IPSec operates at the network layer and authenticates users
- TLS/SSL VPNs operate at the application layer
- PPTP is outdated and should be avoided
Encryption Fundamentals
Symmetric encryption uses a single shared key for both encryption and decryption. This approach is fast but requires secure key distribution. Asymmetric encryption uses public and private key pairs, enabling secure key exchange and digital signatures. Both encryption types serve different purposes in modern security implementations.
Encryption algorithms like AES-256 and 3DES protect data confidentiality. Transport Layer Security (TLS) is the modern standard for encrypting data in transit. TLS 1.2 and 1.3 are current standards, while TLS 1.0 and 1.1 are deprecated.
Secure Protocols
HTTPS is HTTP with TLS encryption, protecting web traffic. SSH (Secure Shell) provides encrypted remote access to systems, replacing the insecure Telnet protocol. SFTP (SSH File Transfer Protocol) encrypts file transfers.
Certificates and public key infrastructure (PKI) enable trust in encrypted communications. Digital certificates contain public keys and are signed by Certificate Authorities (CAs) to verify authenticity. Perfect forward secrecy ensures that compromising long-term keys doesn't compromise past session keys. The exam emphasizes understanding which protocols to use in specific scenarios and recognizing security weaknesses in outdated encryption methods.
Intrusion Detection and Prevention Systems
Intrusion Detection Systems (IDS) monitor network traffic and systems to identify suspicious activity and potential attacks. They provide visibility into threats but require human response.
IDS and IPS Types
Network-based IDS (NIDS) analyzes network traffic on network segments. Host-based IDS (HIDS) monitors individual systems for suspicious processes and file access patterns. Intrusion Prevention Systems (IPS) extend IDS capabilities by actively blocking threats in real-time. Network-based IPS (NIPS) blocks malicious traffic before it reaches protected systems. Host-based IPS (HIPS) prevents malicious actions on individual computers.
Detection Methods
IDS/IPS systems use two primary detection approaches:
- Signature-based detection compares traffic against known attack patterns
- Anomaly-based detection identifies deviations from normal behavior
Passive monitoring means IDS systems observe traffic without interfering. Active response means IPS systems take action automatically. Understanding this distinction is critical for proper deployment.
System Tuning and False Alerts
False positives occur when legitimate traffic is flagged as malicious, reducing confidence in alerts. False negatives occur when actual attacks go undetected, creating security gaps. Tuning IDS/IPS systems requires balancing security effectiveness against false positives. Common detection methods identify malware signatures, port scanning activities, brute-force login attempts, and unusual data transfers.
Honeypots are decoy systems designed to attract attackers, allowing security teams to study attack methods without risking production systems. Behavior analysis identifies anomalous patterns like unusual outbound connections or excessive bandwidth usage. The CompTIA Network+ exam requires understanding IDS/IPS architecture, deployment scenarios, and appropriate use cases for each technology.
Authentication, Authorization, and Access Control Methods
Authentication verifies user identity through credentials, while authorization determines what authenticated users can access. Both are essential for proper access control.
Authentication Methods
Multi-factor authentication (MFA) requires multiple verification methods, significantly improving security. Authentication factors include:
- Something you know involves passwords or PINs
- Something you have involves physical tokens, smart cards, or authenticator apps
- Something you are involves biometric factors like fingerprints or facial recognition
Using two or more factors dramatically reduces unauthorized access risk. Single Sign-On (SSO) allows users to authenticate once and access multiple systems without re-authenticating, improving both security and user experience.
Authorization Models
Role-Based Access Control (RBAC) assigns permissions based on job roles, simplifying administration at scale. Attribute-Based Access Control (ABAC) provides fine-grained control based on attributes like user department, location, or time of access. Access Control Lists (ACLs) define specific permissions for users or groups.
Principle of least privilege grants users only the minimum access required for their roles. This principle reduces damage from compromised accounts and insider threats.
Authentication Infrastructure
Directory services like Active Directory (AD) and LDAP (Lightweight Directory Access Protocol) centralize user and device management. RADIUS (Remote Authentication Dial-In User Service) and TACACS+ (Terminal Access Controller Access Control System) are authentication protocols for network devices. Kerberos is a network authentication protocol using ticket-based authentication, preventing password transmission across networks.
Password policies enforce complexity requirements, expiration timelines, and reuse restrictions. Conditional access blocks or grants access based on risk factors like unusual locations or unmanaged devices. The exam emphasizes understanding authentication mechanisms, authorization models, and implementing appropriate access control for different network scenarios and security requirements.