UKF COLLEGE OF ENGINEERING AND TECHNOLOGY SCHOOL OF
COMPUTER AND INFORMATION SCIENCE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
PCCCT502-NETWORK AND SYSTEM SECURITY
MODULE 1
The Core Foundations & The CIA Triad
The CIA Triad: The fundamental framework behind every security
architecture rule:
o Confidentiality: Data accessibility restricted exclusively to
authorized nodes (enforced via AES-256 ciphers or TLS 1.3
encryption).
o Integrity: Prevention of unauthorized modifications, payloads,
or message injections during transit (enforced via collision-
resistant SHA-256 hashing functions).
o Availability: Uninterrupted accessibility to system resources
for legitimate requests (sustained via load-balancing metrics,
multi-homed BGP loops, and DDoS mitigation).
Design Principles: Structural criteria laid down for secure
implementation, including Least Privilege permissions, multi-barrier
Defense in Depth, structural Separation of Duties, Fail-Safe Defaults
(defaulting to a "Fail-Closed" state during an active system crash),
and Economy of Mechanism to reduce configuration footprint.
2. Network Security Terminologies
Vulnerability: Any underlying flaw, bugs, or structural weakness
found within a code layer, protocol, or OS design.
Threat: An active agent, entity, or malware campaign capable of
exploiting a vulnerability to cause system damage.
Risk: The qualitative calculation measuring the intersection of
threat probability against business operational impact.
Exploit: Weaponized tools, payloads, or automated execution
scripts written to leverage an active vulnerability.
Attack Vector: The designated trajectory or injection channel
utilized by an attacker to reach a target platform (such as insecure
supply-chain software or targeted spear-phishing campaigns).
3. Defensive Components of Network Security
Network Firewalls: Infrastructure gateways controlling cross-zone
communication based on specific access lists:
o Stateless Packet Filtering: Evaluates individual Layer 3
packets out of context, focusing exclusively on IP headers and
port configurations.
o Stateful Inspection: Tracks connection sequences via internal
state tables to map and automatically accept legitimate return
traffic.
o Application/Proxy Firewalls: Terminates connections at Layer
7, unpacking and analyzing application data before
establishing a separate path to the recipient.
o Next-Generation Firewalls (NGFW): Modern multi-tier security
engines joining stateful inspection with deep packet inspection
(DPI), integrated inline IPS systems, and direct application
layer fingerprints.
o Personal Firewalls: Endpoint-specific software rules managing
interface ports at the OS layer, acting as a crucial defense
against lateral movement within a network subnet.
Intrusion Detection and Prevention Systems (IDS/IPS): Deep
packet engines parsing payloads for indicators of compromise:
o IDS: Implemented out-of-path via TAP or port mirrors to
passively observe traffic patterns and trigger administrative
alarms.
o IPS: Positioned inline, directly within the physical path of
traffic, to drop malicious blocks and terminate rogue TCP
sessions in real time.
o Inspection Models: Employs Signature-Based Analysis for
matching established threat fingerprints and Anomaly-Based
Analysis to catch zero-day shifts against a known network
baseline.
Advanced Threat Protection (ATP): Unified security architecture
utilizing isolated virtual infrastructure (Network Sandboxing) to
analyze and detonate unknown binary attachments before they can
execute within the production space.
Network Access Control (NAC): Network gatekeeping
frameworks requiring strict posturing and profile compliance scans
(e.g., via IEEE 802.1X protocols) before admitting local endpoints to
primary network segments.
Web Filtering: Inline proxies restricting access to malicious or
dangerous categories of the public internet using explicit category
groupings, threat intelligence feeds, and DNS filtering tricks.
4. Perimeter Defense & Infrastructure Design
Network Segments: Dividing flat physical spaces into isolated
Layer 2 Virtual Local Area Networks (VLANs) to significantly
control the blast radius of a localized system compromise.
Perimeter Defense & The DMZ: Isolating public-facing
applications (such as mail servers, web apps, and DNS components)
inside a distinct Demilitarized Zone (DMZ) bounded by separate
internal and external firewalls to safeguard core production data
blocks.
Network Address Translation (NAT): Concealing internal
structural topologies through various mapping mechanisms:
o Static NAT (1:1 mapping) for static assets.
o Dynamic NAT for outgoing client rotation.
o Port Address Translation (PAT) mapping thousands of internal
private IP ranges to a single public IP via assigned source port
tracking.
5. Security Governance & Testing
Network Security Policies: Formal operational structures
converting management risk models into actionable technical limits
(Acceptable Use Policy (AUP), Role-Based Access controls, and
multi-tier Incident Response Playbooks).
Penetration Testing: Proactive security auditing utilizing
simulated attacks to find structural weaknesses before real
adversaries can exploit them. Discusses Black Box (zero-
knowledge), White Box (full knowledge), and Gray Box testing
methodologies along the five stages of the security assessment
lifecycle.