Security Networking & Infrastructure

1. Network Segmentation

The Problem: "Flat networks" are dangerous. If a receptionist's PC is compromised via phishing in a flat network, the attacker has direct, unimpeded access to the financial servers.

The Solution: Segmentation divides the network into isolated zones based on trust and function.

Security Benefit: It forces attackers to pass through heavily monitored choke points (routers/firewalls) to move laterally, increasing the chance of detection.

2. VLAN Security (Layer 2)

A VLAN (Virtual Local Area Network) provides logical segmentation inside physical switches. You can have the HR department and the IT department plugged into the exact same switch, but they cannot talk to each other directly.

Common Attacks & Defenses

• VLAN Hopping: Attackers send forged 802.1Q tags to trick the switch into putting them on a restricted VLAN.
• Defense: Hardcode switch ports as "Access Ports", disable auto-trunking (DTP), and place all unused ports into a "dead" VLAN.

3. NAT & Security Perspective

Network Address Translation translates internal private IPs into a single public IP. While designed to save IPv4 space, it has security implications.

• ✔ Internal IP Hiding: External attackers cannot map your internal topology.
• ✔ Reduced Exposure: Internal devices cannot be directly routed to from the internet.

4. Firewalls Deep Dive

Firewalls are the decision engines placed at the borders of your network segments.

5. IDS vs IPS

Detection Methods

• Signature-Based: Looks for specific, known bytes of malware (like antivirus).
• Behavior-Based: Looks for actions (e.g., a PDF trying to run a shell command).
• Anomaly Detection: Learns the baseline of the network. Alerts if a server suddenly sends 50GB of data at 3 AM.

6. Secure Network Architecture & DMZ

The Demilitarized Zone (DMZ) is a heavily restricted subnetwork holding public-facing services (Web Servers, Email, DNS). It acts as a buffer zone.

If an attacker hacks the Web Server in the DMZ, they are still blocked by firewall rules from reaching the Internal LAN where the databases live.

7. VPN & Secure Communication

Virtual Private Networks create encrypted tunnels across untrusted networks (like the internet or a coffee shop Wi-Fi).

• Remote Access VPN: An employee at home securely connecting to the office internal network.
• Site-to-Site VPN: Connecting the New York office router directly to the London office router so they act as one secure network.

8. Continuous Network Monitoring

You cannot stop what you cannot see. Blue Teams rely on telemetry to hunt for attackers.

• NetFlow: Like a phone bill. Shows who talked to whom, when, and for how long (but not what was said). Great for spotting data exfiltration.
• SIEM (Security Information and Event Management): A central brain (like Splunk or Elastic) that collects logs from all firewalls, servers, and switches to correlate events.

9. Zero Trust Networking

The modern standard pioneered by Google (BeyondCorp) and Microsoft. It destroys the old idea that the "Internal Network is safe."

• No Default Trust: Even if you are plugged into the office wall, you are treated as a threat.
• Identity Based: Access is granted based on who the user is and the health of their device, not just their IP address.
• Micro-segmentation: Firewalls exist between individual apps, not just network borders.

10. The Defensive Attack Chain View

How security networking disrupts the attacker at every stage:

🧠 Knowledge Check