Network Security

Introduction

Network security is the practice of protecting networked systems, services, communications, and data against unauthorized access, misuse, disruption, modification, and destruction. At university level, you should think of network security not as a single product but as a system of interacting technical controls, protocols, policies, identities, monitoring processes, and human decisions.

This aiMOOC helps you connect computer networking with cybersecurity, cryptography, risk management, and incident response. You will examine how traffic moves, where trust is created, how attackers can exploit assumptions, and how defenders design layered controls that continue to work when one safeguard fails.

Learning goals: By the end of the course, you should be able to explain security goals and threat models, analyze network architecture, distinguish major security controls, interpret packet and log evidence, evaluate encrypted communication, reason about identity and access decisions, design segmentation and zero-trust approaches, and justify security choices in terms of risk, usability, cost, and resilience.

Because network-security tools can affect real systems, all practical work in this course must be performed only on systems, networks, and datasets that you own or are explicitly authorized to test. Use isolated labs, synthetic traffic, university training environments, or instructor-approved captures.

Why Network Security Matters

Modern organizations depend on networks for teaching, research, finance, healthcare, industrial control, cloud computing, communication, and everyday administration. A network therefore carries both valuable data and valuable capabilities. A failure may expose confidential information, alter records, stop a service, or allow an attacker to move from one compromised system to another.

Security decisions are rarely absolute. A control that maximizes confidentiality may reduce availability or usability. A highly restrictive firewall rule may block legitimate research traffic. Deep inspection may improve detection but raise privacy concerns. Good network security requires you to make evidence-based trade-offs.

The classic CIA triad provides three core objectives. Confidentiality limits information to authorized parties. Integrity protects data and communications from unauthorized or undetected change. Availability keeps systems and services accessible when they are needed. In practice, you should also consider authenticity, accountability, privacy, safety, and resilience.

Network Foundations for Security

Layers, Protocols, and Trust Boundaries

Network security depends on understanding what each layer does and what it assumes. Ethernet and Wi-Fi move frames across local links. IP forwards packets between networks. TCP and UDP transport application data. DNS maps names to addresses. Higher-layer protocols such as HTTPS, SSH, and email protocols use the network to provide services.

A security control is most effective when you know the layer at which it observes or changes traffic. A layer-3 access rule can filter by IP address, while an application-aware gateway can make decisions using application context. Encryption can hide application contents from intermediate devices while still leaving some metadata visible.

The TCP three-way handshake illustrates a basic principle: before a reliable TCP session carries application data, endpoints establish shared connection state. Security devices that track connection state can therefore distinguish expected packets belonging to a known flow from unexpected packets that do not fit that state.

Assets, Attack Surfaces, and Threat Models

A useful threat model begins with assets and trust relationships, not with a list of tools. Ask what must be protected, who is allowed to use it, which network paths exist, which identities are trusted, what an adversary might control, and what failure would matter.

Typical network attack surfaces include exposed services, management interfaces, remote-access gateways, wireless access points, DNS infrastructure, routing systems, cloud network controls, user devices, third-party connections, and misconfigured security appliances.

A threat model should state assumptions explicitly. For example, a secure-channel design may assume that an attacker can observe and modify traffic but cannot steal a server's private key. If that assumption changes, the protection strategy must change too.

Threats and Attack Patterns

Eavesdropping, Spoofing, and Traffic Manipulation

Eavesdropping is unauthorized observation of communication. Encryption can reduce the value of captured content, but metadata such as timing, endpoints, and traffic volume may still reveal information.

Spoofing means presenting false identity or source information. Depending on the protocol, an attacker may forge an address, impersonate a service, or exploit weak authentication. Defenses include authenticated protocols, certificate validation, secure identity systems, filtering, and careful trust configuration.

A man-in-the-middle attack places an adversary between communicating parties or causes traffic to pass through an adversary-controlled position. Secure protocols must authenticate peers and protect integrity so that traffic interception does not silently become traffic modification.

The Computerphile video above is useful for discussing certificate trust and interception. Watch it critically: the video's description notes a correction about the terms public key and private key.

DNS, Address Resolution, and Naming Attacks

DNS is essential to most Internet use because people and applications usually refer to names rather than raw IP addresses. If name resolution is manipulated, a user may be directed to the wrong destination even when the typed name is correct.

DNS cache poisoning is one example of how false resolution data can be introduced into a resolver's cache. Modern defenses include randomized query parameters, careful resolver behavior, protected administration, and DNSSEC, which can provide origin authentication and integrity protection for signed DNS data.

You should distinguish DNS security from transport encryption. DNSSEC can help validate DNS data, while protocols such as HTTPS protect an application session. These mechanisms solve different parts of the trust problem.

Denial of Service and Resource Exhaustion

A denial-of-service attack attempts to make a resource unavailable. Some attacks consume bandwidth, some exhaust server or state-table resources, and some exploit application behavior. Distributed denial of service uses traffic or requests from many sources.

Defenses may include capacity planning, upstream filtering, rate limiting, content distribution, anycast, connection management, attack scrubbing services, resilient architectures, and incident procedures. No single defense guarantees availability against every scale or type of attack.

Lateral Movement and Internal Risk

Perimeter controls are not enough when a compromised device, stolen credential, insider, or cloud workload already has internal access. Attackers may search for reachable services, reuse credentials, or exploit overly broad trust to move laterally.

Segmentation, least privilege, strong identity, endpoint security, secure administration, and continuous monitoring can reduce the paths available for lateral movement. The goal is to limit both the probability and the impact of compromise.

Core Defensive Controls

Firewalls and Policy Enforcement

A firewall enforces rules about which traffic may pass between interfaces, zones, hosts, or applications. Traditional packet filters focus on fields such as source, destination, protocol, and port. Stateful firewalls track connection state. Application-aware controls can classify traffic more deeply, although classification and decryption introduce complexity and privacy questions.

A well-designed firewall policy follows a clear purpose, uses the smallest necessary access, documents exceptions, logs meaningful decisions, and is reviewed as systems change. Rules that are technically valid but no longer needed become security debt.

A firewall is only one layer. If a permitted service is vulnerable or credentials are stolen, allowed traffic can still carry harmful activity.

Segmentation, DMZs, and Defense in Depth

Segmentation divides a network into zones or smaller trust domains and controls communication between them. It reduces unnecessary reachability and can contain incidents. Segmentation may be enforced with routers, firewalls, VLANs, cloud security groups, host firewalls, software-defined controls, or combinations of these.

A demilitarized zone is a network area used to separate externally reachable services from more sensitive internal systems. The design intent is to avoid treating an Internet-facing server as if it deserves the same trust as a protected internal asset.

Defense in depth means using multiple independent or partially independent safeguards so that the failure of one does not immediately cause total compromise. Useful layers include secure configuration, patching, segmentation, authentication, encryption, endpoint controls, network monitoring, backups, and incident response.

Intrusion Detection and Prevention

An intrusion detection system observes events and raises alerts about activity that may be malicious or policy-violating. A network IDS analyzes network traffic or network-derived telemetry. An intrusion prevention system can also block or alter traffic when detection criteria are met.

Detection methods include signatures, rules, protocol validation, reputation, statistical methods, and behavioral analytics. Signature detection can be precise for known patterns but may miss new variants. Anomaly detection can reveal unusual behavior but may generate false positives. Effective detection therefore requires tuning, context, and a response process.

Cryptography in Network Security

Symmetric and Public-Key Cryptography

Symmetric cryptography uses a shared secret key for operations such as encryption and authentication. It is efficient and widely used for protecting bulk data after keys have been established.

Public-key cryptography uses mathematically related keys with different roles. In a typical public-key encryption model, a public key can be distributed, while the private key must remain secret.

Public-key techniques are also used for digital signatures and key establishment. A digital signature helps a verifier determine that a signed message was produced by the holder of the relevant private key and was not modified undetectably after signing.

Key Exchange and Forward Secrecy

Key exchange protocols allow parties to derive shared keying material without sending the final secret directly across the network. Modern secure protocols commonly use ephemeral Diffie-Hellman style exchanges. When implemented correctly, ephemeral key exchange can provide forward secrecy: compromise of a long-term authentication key later does not automatically reveal older session keys.

The mathematical details matter because security depends on more than the visible protocol sequence. Randomness, parameter validation, key reuse rules, authentication, and implementation quality all affect real security.

TLS and Secure Channels

TLS protects client-server communication by establishing shared keys, authenticating at least the server in common deployments, and protecting subsequent traffic for confidentiality and integrity. TLS does not make an application secure by itself: certificate validation, endpoint security, application logic, and deployment configuration still matter.

As of 2026, the current Internet Standards Track specification for TLS 1.3 is RFC 9846, which is a backward-compatible update that obsoletes RFC 8446 while retaining the TLS 1.3 version number.

The diagram above is a conceptual visualization of TLS 1.3 negotiation. For normative protocol details, use the current RFC because standards can be clarified or updated after an educational diagram is created.

When you analyze a TLS handshake, identify which messages establish cryptographic parameters, where authentication occurs, and which parts of the exchange are encrypted. Also remember that encrypted content does not eliminate all metadata leakage.

Certificates and Public-Key Infrastructure

A public-key infrastructure links public keys to identities through certificates and trust relationships. Web browsers and other clients use trust stores and certificate validation rules to decide whether a server certificate is acceptable.

Certificate validation normally checks factors such as the requested identity, validity period, signature chain, trust anchor, and relevant certificate constraints. Revocation mechanisms and certificate-transparency systems add further evidence, but each has operational limitations.

Secure Network Services

VPNs and Remote Access

A VPN creates a protected logical connection over another network. Site-to-site VPNs can connect networks; remote-access VPNs can connect a user device to organizational resources. Security depends on authentication, cryptographic configuration, endpoint trust, routing, split-tunneling decisions, and access policy.

A VPN should not be treated as automatic proof that every connected user or device is trustworthy. Modern architectures increasingly combine encrypted transport with explicit identity, device posture, least privilege, and resource-specific access controls.

Wireless Network Security

Wireless networks add a broadcast medium and mobility. Security therefore depends on robust link-layer protection, secure authentication, correct access-point configuration, protected management, client isolation where appropriate, and monitoring for unauthorized infrastructure.

Enterprise Wi-Fi commonly uses 802.1X with an authentication backend to provide individual authentication rather than one shared password. Whatever technology you use, the trust model should define who can join, what authenticated devices may reach, and how compromised devices are contained.

Routing and Infrastructure Security

Routers, switches, DNS servers, identity services, time services, and management networks are high-value infrastructure. Secure administration should separate management access from ordinary user traffic where practical, require strong authentication, limit management exposure, log changes, and protect configuration backups.

At Internet scale, routing security includes mechanisms that help reduce the risk of incorrect route announcements. At enterprise scale, routing controls, prefix filtering, secure management protocols, and change control help prevent accidental and malicious traffic redirection.

Monitoring and Network Forensics

Packets, Flows, Logs, and Telemetry

Network defenders work with several forms of evidence. A packet capture can show protocol fields and sometimes payload contents. Flow records summarize communication patterns without storing every byte. DNS logs, firewall logs, proxy logs, authentication events, endpoint telemetry, and cloud control-plane logs provide different views of the same incident.

When interpreting evidence, correlate timestamps, source and destination context, identities, process information, and expected application behavior. A single unusual packet rarely proves malicious intent. Good analysis tests competing explanations.

Detection Engineering

Detection engineering turns threat hypotheses into observable logic. Start with a behavior you care about, identify what telemetry could reveal it, build a rule or analytic, test it against known-good and known-bad examples, measure false positives and false negatives, and maintain the detection as systems evolve.

Useful metrics include alert precision, time to triage, detection coverage, telemetry completeness, and the operational cost of response. A high alert count is not automatically a sign of strong security.

Zero Trust and Modern Architecture

Zero Trust Principles

Zero trust does not mean that nothing is ever trusted. It means that access should not be granted merely because a user, device, or workload is located on an internal network. NIST SP 800-207 describes an approach focused on users, assets, and resources, with authentication and authorization decisions made before access to enterprise resources.

A zero-trust design typically uses strong identity, device information, least privilege, policy enforcement, resource-level controls, telemetry, and continuous evaluation. It complements segmentation rather than making network architecture irrelevant.

Cloud and Hybrid Networks

Cloud environments replace many physical network controls with software-defined constructs such as virtual networks, subnets, route tables, security groups, identity policies, gateways, and service endpoints. The security question remains the same: which subjects may reach which resources, under what conditions, and with what evidence?

Hybrid environments are especially challenging because identity, routing, logging, and policy may span campus networks, data centers, multiple cloud providers, software-as-a-service platforms, and remote users. Consistent naming, ownership, telemetry, and policy are therefore as important as individual firewall rules.

Security Governance and Risk

From Technical Controls to Risk Management

Network security exists to reduce organizational risk. You should connect every major control to a threat, asset, business or academic requirement, and measurable outcome. Controls that cannot be explained in terms of risk are difficult to prioritize and maintain.

The NIST Cybersecurity Framework 2.0 organizes high-level cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The framework is intentionally outcome-focused rather than prescribing one technical architecture.

For network security, this means governance defines responsibilities and risk appetite; identification maps assets and dependencies; protection applies controls; detection builds visibility; response contains and communicates incidents; and recovery restores services and improves resilience.

Security Architecture Trade-Offs

A strong design balances prevention, detection, response, resilience, usability, performance, cost, legal requirements, and privacy. For example, decrypting traffic at a security gateway may improve malware detection but can create sensitive-data exposure, key-management complexity, and privacy concerns.

University networks are especially diverse. They may support open research, student devices, laboratories, public services, administrative systems, high-performance computing, and sensitive research data. Good architecture therefore uses differentiated trust zones and evidence-based policy rather than one uniform security posture.

Practical Analysis Workflow

For authorized university labs, use the following defensive workflow:

Asset inventory: Identify the hosts, services, identities, data, and network paths that matter.
Threat modeling: State plausible adversary capabilities, trust boundaries, assumptions, and consequences.
Network segmentation: Reduce unnecessary communication and define permitted pathways.
Access control: Apply least privilege to users, devices, workloads, and administrative interfaces.
Encryption: Protect sensitive communications with current, well-configured protocols.
Security monitoring: Collect enough telemetry to detect and investigate meaningful events.
Incident response: Define how you will triage, contain, eradicate, recover, and learn.
Security testing: Validate controls in isolated or explicitly authorized environments.

This workflow is iterative. Architecture changes, software changes, new research projects, new devices, and new threats can all invalidate earlier assumptions.

Selected Standards and Reliable Sources

Use primary technical sources when you need authoritative details. Relevant starting points include NIST SP 800-207 on Zero Trust Architecture, NIST Cybersecurity Framework 2.0, and RFC 9846 for TLS 1.3. For protocol details, consult the current RFC and its updates rather than relying only on tutorials.

Wikimedia Commons media used in this course were selected for direct instructional relevance, including diagrams for the CIA triad, TCP connection establishment, DMZs, defense in depth, intrusion detection, public-key encryption, TLS, VPNs, and packet analysis.

Interactive Tasks

Quiz: Test Your Knowledge

Diesen aiMOOC als Battle spielen

Which property of the CIA triad concerns preventing unauthorized disclosure? (Confidentiality) (!Availability) (!Redundancy) (!Scalability)

What is the main purpose of network segmentation? (Limit unnecessary reachability between systems) (!Replace all endpoint security) (!Eliminate the need for authentication) (!Make every service publicly reachable)

Which control commonly tracks established network connections? (Stateful firewall) (!Passive optical splitter) (!Unmanaged hub) (!Static webpage)

What does a digital certificate primarily help bind? (An identity to a public key) (!A password to a subnet mask) (!A MAC address to a CPU) (!A file name to a switch port)

What security property does forward secrecy provide? (Past session keys stay protected after later key compromise) (!All traffic becomes anonymous) (!Passwords never need rotation) (!Network latency becomes zero)

Which statement best reflects zero trust? (Network location alone does not justify access) (!Every internal packet is automatically trusted) (!Firewalls are unnecessary) (!All users must share one account)

What is a key function of an intrusion detection system? (Identify suspicious or policy violating activity) (!Create physical network cables) (!Assign academic grades) (!Compress every packet)

What is the role of TLS in a typical web connection? (Protect communication between endpoints) (!Hide every traffic metadata field) (!Replace the operating system) (!Guarantee that application code has no bugs)

Why are logs from multiple sources useful during incident analysis? (They provide complementary evidence about the same activity) (!They guarantee that no attack occurred) (!They remove the need for timestamps) (!They make network design irrelevant)

Which NIST CSF 2.0 function addresses organizational cybersecurity direction and oversight? (Govern) (!Encrypt) (!Route) (!Compile)

Memory Game

Firewall	Enforces rules about permitted and blocked network traffic
Segmentation	Divides a network into controlled trust zones
TLS	Protects client server communication with authenticated encryption
DNSSEC	Adds origin authentication and integrity protection to signed DNS data
Telemetry	Observable data used to understand system and network activity
Certificate	Binds identity information to a public key through a signed structure
ZeroTrust	Requires explicit access decisions rather than trusting network location alone
Resilience	Ability to maintain or restore essential service despite disruption

Drag and Drop

Match the correct terms.	Topic
Confidentiality	Restricting information to authorized parties
Integrity	Detecting unauthorized modification
Availability	Keeping services accessible when needed
Least privilege	Granting only the access required for a task
Defense in depth	Combining multiple protective layers

...

Crossword Puzzle

Firewall	Which security control filters network traffic according to policy?
Encryption	What process transforms data to protect confidentiality with cryptographic keys?
Spoofing	What attack pattern presents false identity or source information?
Segmentation	What architectural method divides a network into controlled zones?
Telemetry	What term describes observable operational data used for monitoring?
Certificate	What signed data structure can bind an identity to a public key?

LearningApps

Cloze Text

Network security protects systems, services, communications, and data against

. The CIA triad includes confidentiality, integrity, and

. A threat model identifies assets, adversary capabilities, trust boundaries, and

. Segmentation reduces unnecessary

. A stateful firewall can track the state of a network

. TLS establishes a protected channel that supports confidentiality and

. Public-key infrastructure uses certificates to associate identities with

. Zero trust avoids granting access only because a subject is on an

. Detection engineering depends on useful

. Effective incident handling requires preparation, containment, recovery, and

.

Open-Ended Tasks

Easy

Network map: Draw a simple diagram of an authorized lab or hypothetical university network, mark at least three trust boundaries, and explain why each boundary matters.
CIA triad: Choose one university service such as a learning platform or research repository and write a short analysis of its confidentiality, integrity, and availability requirements.
Packet analysis: Capture only traffic from your own device or use an instructor-provided capture, identify one TCP connection and one DNS exchange, and annotate the evidence in a screenshot.
Security glossary: Create a one-page visual glossary that explains eight network-security terms in clear language for first-year computing students.

Standard

Firewall policy: Design a firewall policy for a hypothetical departmental web service, justify every allowed path, and identify which logs would verify that the policy works.
Security interview: Interview an authorized network administrator, security engineer, or lecturer about segmentation and monitoring, then summarize three design trade-offs they described.
TLS certificate analysis: Inspect the certificate details of a public website through your browser, explain the identity, issuer, validity, and trust-chain information, and discuss what the certificate does not prove.
Incident tabletop: Create a tabletop scenario in which one student device is suspected of compromise, then define evidence collection, containment, communication, and recovery steps without performing any intrusion.

Advanced

Zero trust architecture: Design a zero-trust access model for a hybrid university research environment, including identities, device conditions, policy decision points, protected resources, and telemetry.
Detection engineering: Build and evaluate a detection rule against synthetic or instructor-approved network data, measure false positives and false negatives, and explain how you would tune the analytic.
Resilience engineering: Model a denial-of-service scenario for a public university service, compare at least three defensive strategies, and justify a resilient architecture using risk and cost arguments.
Security architecture: Produce a capstone design for a multi-zone university network that integrates segmentation, encrypted transport, secure administration, monitoring, incident response, and privacy requirements.

Learning Assessment

Threat model assessment: Given a new research service, identify assets, trust boundaries, attacker capabilities, assumptions, and the three most important risks, then justify your priorities.
Architecture critique: Compare a flat network with a segmented network for the same university scenario and explain how each design changes blast radius, monitoring, administration, and usability.
Protocol reasoning: Explain how TLS, certificates, DNS security, and endpoint trust contribute different evidence and protections during a secure web connection.
Detection evaluation: Review a small set of synthetic alerts and supporting logs, rank the incidents by confidence and impact, and defend your triage decisions.
Zero trust transfer: Apply zero-trust principles to a cloud-hosted laboratory service and explain which decisions remain network-based and which become identity- or resource-based.
Governance argument: Recommend a network-security investment for a university department and connect the proposal to risk, measurable outcomes, privacy, response capability, and at least two NIST CSF 2.0 functions.

Evidence of Learning

Evidence of learning should show both conceptual understanding and practical judgment. Important evidence includes:

Knowledge: You can explain the CIA triad, threat modeling, segmentation, firewalls, intrusion detection, VPNs, TLS, certificates, DNS security, zero trust, monitoring, and resilience.

Skills: You can read a network diagram, identify trust boundaries, interpret packet and log evidence, compare controls, reason about encrypted communication, design least-privilege access, and evaluate detections using evidence.

Products: Strong products may include an annotated network map, threat model, firewall policy, packet-analysis report, detection rule, incident tabletop plan, zero-trust architecture, or security design review.

Transfer achievements: You can apply the same reasoning to unfamiliar environments such as cloud networks, research laboratories, administrative systems, hybrid work, or service-provider connections. You can explain not only which control you would use, but why it fits the threat, what assumptions it depends on, how you would verify it, and what limitations remain.

OERs on the Topic

Linked Learning Areas

Network Security

aiMOOC Projects

Inhalte werden geladen ...

Mediathek wird aus dem Wiki geladen ...

Frag mich zum aktuellen Lerninhalt oder wähle eine kurze Hilfe.

Textmodus bereit

Sprache