Network security basics

Every week, networks seem to grow in size and complexity. New SaaS services come online, while innovative communication tools make remote working easier. Data storage methods shift, with new assets to secure. And new malware threats constantly emerge. In an ever-changing digital world, network security has never been more crucial.

Network security is not a fixed constant. Methods to protect networks change all the time. In this glossary article, we will explain network security basics. We will introduce the CIA concept, and we will also look at contemporary security techniques. This article overviews the topic, but you can fine-tune your knowledge with detailed texts about related concepts.

Key takeaways

• Networks are vital ecosystems with interconnected devices and applications, including workstations and servers, that form networks that perform key business functions.
• Network edge security is critical for defending against external threats, it involves securing digital and physical connections to the internet.
• Network types range from LANs for small areas to WANs and SD-WANs for larger regions and cloud security.
• Operating as Layer 3 of the OSI model, networks manage data transmission by creating and routing packets, often secured through encryption.
• Diverse network hardware includes servers, routers, switches, and firewalls, each integral to network functionality.
• Network monitoring and security involves tracking traffic and behavior to protect data and infrastructure, using various tools like firewalls and intrusion prevention systems.
• Comprehensive network security measures are a combination of strategies, including web gateways, email security, behavior monitoring, and VPNs, to fortify network security.
• The CIA triad model focuses on confidentiality, integrity, and availability of information in network security strategies.

What is a network?

Networks are collections of devices and applications. When linked together, these assets serve core business functions. Network managers can place devices on different network segments, while they may also be geographically distant. But they are all part of the same workstations, servers, switches, and SaaS gateways community.

What are the main network types?

Networks come in a variety of types. Security measures required vary depending on network configurations. Common variants include:

• LAN – Local Area Networks or intranets are small community devices connected via one or more routing nodes. Router tools handle all network traffic and may also include internet interface modems. LAN networks can include many different devices. A LAN could feature computers, smartphones, printers, IoT devices, televisions, and gaming consoles. Routers assign IP addresses to all devices, which identify them on the network.
• WAN – Wide Area Networks are more common in modern business. They constitute collections of LANs and cover wide geographical areas. For instance, companies with several branches will usually connect them via WAN technology. The internet itself is defined as a WAN. Every ISP is also technically a WAN.
• SD-WAN – Software-defined Wide area networks are laid over WAN networks. Agents on connected devices link users to network resources. Managers can control access via secure gateways, and SD-WAN allows in-depth traffic monitoring. Companies also tend to use SD-WAN to secure cloud assets effectively.

How do networks work?

Networks operate at level 3 of the OSI model. The network layer is where data is transmitted. Servers create packets of information, which they send to network devices via routing devices. Packets are then rendered readable at the other end.

Numerical IP addresses usually identify network devices. But more advanced network architecture uses text labels for the same purpose. Systems may also apply encryption to data passing over the network. Encryption conceals the contents of packets, protecting them against external observers.

What are network devices?

Network devices are any items of hardware connected to the network architecture. Every network should be documented and mapped. Mapping enables managers to understand which devices require protection. Company networks generally rely on several device types:

• Servers – store information and software.
• Hubs – link several devices together within the network.
• Routers - communicate information across the network.
• Switches – supplement the router and divert traffic efficiently.
• Bridges – connect network sections together.
• Workstations - connect to router devices and allow staff secure access.
• Gateways – connect areas of the network with different protocols or security profiles.
• Firewall equipment - guards network edges against malicious traffic.
• Access points – provide wireless access for authorized devices.

What is network monitoring?

Monitoring tools track traffic and user behavior inside the network perimeter. It also checks the status of network devices such as servers or switches and informs network managers when faults occur.

Monitoring can be reactive or proactive. Proactive monitoring is preferable, anticipating problems and seeking threats before they cause damage. Monitoring can also be agent-based or agentless:

Agent-based monitoring

This form of monitoring installs software agents on every network client. Agents connect to centralized monitoring software. They provide a stream of data about the status of the device. This data could include memory usage and processes running on the device. Agents may track user connections or assess general performance.

Agent-based monitoring delivers granular information and enhances network visibility. However, the proliferation of agents poses problems. Security teams must set aside time to update and log agents. Managing large communities of agents can be difficult for smaller organizations.

Agentless monitoring

This type of monitoring focuses on data passing across external and internal network connections. It involves packet inspection to discover information about data and network usage. And it can also involve app monitoring to ensure only authenticated users have access.

Agentless monitoring is non-intrusive and requires few resources. It provides a data stream that can be used to improve security setups. But this information is generally not granular. Network managers may lack complete awareness of threats.

Monitoring intervals

Monitoring is not always constant. Instead, security managers schedule inspections of digital assets to assess functionality and security status. The gap between security inspections is the monitoring interval.

Intervals vary depending on device type and situation. Technicians schedule constant inspections of the internal network. However, general network performance measurements may have longer monitoring intervals. This reduces the load placed on the network.

What is network security and why is it important?

Network security is the process of protecting networks against potential threats. It includes software and hardware designed to detect and block malicious agents. Securing networks also extends to access control, network organization, and security policies.

Networking security is closely related to cybersecurity and information security. Cybersecurity guards against digital threats. InfoSec focuses on data protection. Both feed into protecting a single computer connected to the network infrastructure against outside threats.

Network security matters because data and apps need protection. Businesses depend on reliable access to workloads and databases. However, they must secure confidential data from external observers via information security techniques. A well-thought-out security strategy balances access and protection while also meeting compliance goals.

The main types of network security

There are several networking security policy ingredients. Common approaches include:

• Firewalls – firewalls are the foundation of most security setups. They create a barrier between internal traffic flows and the external internet. Firewalls can also operate internally to create zones of trust, enforcing segmentation strategies that limit east-west traffic inside the perimeter.
• Access control – access control tools check all entry requests. Access management gateways ensure only users with the correct credentials can access network assets. Security policies define access levels. These policies describe the privileges of each user. They apply automatically when users try to access the system. Firewall protections also prevent illicit access.
• Application security – app security ensures the proper configuration of applications running on the network. The code of apps can be vulnerable to external attacks. For example, attackers exploit vulnerabilities in app code to access network resources. Application security tests all apps and applies patches to update code.
• Data loss prevention - proactively seeks to protect sensitive data. Data loss prevention tools log the location of critical data. They apply segmentation to guard that data against cybercriminals.
• Malware protection – anti-malware tools scan all incoming traffic for malicious code. Scanning can include network threats like spyware and ransomware. Both variants can extract data and lead to significant costs.
• Web gateways – Secure Web Gateways filter traffic entering and leaving the network. They use tools like DNS filtering to block unsafe websites and allow access to core web-based resources.
• Email security – specialist email security tools scan emails sent from work accounts. This includes emails passing through on-premises workstations as well as remote devices. Email clients also feature tools to filter spam messages from phishers.
• Behavior monitoring – security tools can monitor user behavior within the network perimeter. AI-assisted tools scan for abnormal traffic and access requests. Or they may check for access requests from unusual geographical locations.
• Virtual private networks – VPNs apply encryption to network traffic. Encryption guards data passing between remote workstations and network servers.
• Intrusion Prevention Systems (IPS) – IPS allow managers to take a pre-emptive security approach. IPS tools check network traffic flows for malicious agents and suspicious activity, quarantining and recording threats that emerge and remove threats when detected. IPS tools generally use packet inspection, including protocol analysis. Signature Matching also helps to prevent exploit kit attacks.

Network security controls

Levels of control make securing networks easier to understand. There are three control levels. Companies should factor them all into their security strategies:

• Physical – physical security measures deal with the physical status of devices. Office devices may demand several credentials before permitting access. Companies must physically secure servers and other data storage devices via locks and access controls. Security setups may include cameras and biometric scanners to add extra assurance.
• Technical – these controls protect data flows across the computer network. They also guard data resting on network devices. Technical controls cover locally connected servers and workstations. But they also include remote working devices and SaaS services used by employees. They seek to prevent external attacks without harming network performance.
• Administrative – these controls deal with user behavior. Administrative controls include Identity and Access Management systems that check all access requests. Security policies set out privileges for each user. Systems onboard new hires and delete obsolete accounts to prevent credential theft. Staff training is also a major administrative challenge.