Module-4
Network Security
Introduction
• In today’s connected world, network security is a must.
• As cyberattacks become more common and advanced, every network — from
small offices to large companies — needs strong protection.
• Good network security helps to protect data, keep services running, and
maintain user trust.
Network Security
• Network security means using rules, tools, and technologies to keep computer
networks and data safe and reliable.
• It includes both preventive steps (to stop attacks) and reactive steps (to handle
attacks if they happen).
• In simple terms, network security makes sure that only the right people and
devices can use the network — and keeps attackers out.
Why Network Security Matters?
• Stops unauthorized access – prevents hackers or unknown users from entering the
network.
• Protects important data – keeps company information and customer details safe.
• Reduces cyber risks – helps prevent attacks like viruses, ransomware, and denial-
of-service attacks.
• Meets rules and laws – follows security standards such as GDPR, HIPAA, and
ISO 27001.
• Keeps business running smoothly – avoids downtime and loss caused by security
problems.
Common Threats in Network Security
Threat Type Description
Malware Malicious software such as viruses, trojans
Phishing Fake emails or messages to steal user credentials
DoS/DDoS Denial of service attacks to disrupt availability
Man-in-the- Intercepting and altering communication
Middle
Insider Threats Misuse of access by internal users
Zero-Day Attacks Exploiting unknown software vulnerabilities(attacker
find problem)
The CIA Triad – Core of Security
Principle Description
Confidentiality Ensuring data is accessible only to authorized users
Integrity Ensuring data is accurate and unaltered
Availability Ensuring systems and data are accessible when needed
Types of Network Security Controls
Control Type Description Examples
Door locks, security guards, CCTV
Protect the physical environment and
Physical Controls cameras, server room access,
prevent unauthorized physical access.
biometric scanners
Firewalls, encryption, intrusion
Technical (Logical) Use technology to protect systems and
detection systems, access control
Controls data from cyber threats.
lists (ACLs), antivirus software
Security policies, user awareness
Administrative Define policies, procedures, and training
training, compliance audits,
Controls to enforce security practices.
incident response plans
Defense in Depth (Layered Security)
• A layered security strategy that uses multiple protections at different points in
the network to reduce attack success.
Layer What It Does Examples
Endpoint Security Protects user devices Antivirus, updates, EDR
Network Perimeter Blocks external attacks Firewalls, ACLs
Network Segmentation Limits spread of attacks VLANs, internal firewalls
Access Control Allows only authorized users Passwords, RBAC, MFA
Monitoring & Detection Finds and alerts on threats IDS, SIEM, log monitoring
Security Zones in a Network
• The firewall/router controls traffic between these zones, protecting the internal
network from external threats while allowing public access to DMZ services.
Example /
Zone Description
Purpose
High-trust User LAN,
Trusted Zone internal employee
network devices
Semi-trusted
DMZ Web servers,
zone hosting
(Demilitarize email servers,
public-facing
d Zone) FTP servers
services
Low-trust Internet,
Untrusted
external third-party
Zone
networks networks
Firewalls, ACL & NAT
Firewall
• A firewall is a security device or software that controls the data entering and
leaving a network.
• It sits between a trusted network (like your company LAN) and an untrusted
network (like the Internet).
• Its job is to allow safe traffic and block harmful or unauthorized access.
Why Firewalls Are Important?
• Stop unauthorized access to internal systems
• Protect against hacking and malware attacks
• Enforce who can access what on the network
• Record and monitor all network activities
• Support network segmentation and deeper traffic inspection
A firewall acts like a security guard for your network — it checks every
packet and decides whether to let it in or keep it out.
Type How It Works In Simple Words
Checks each data packet separately Works fast but not very smart — good for
Stateless
without remembering what happened small networks where security isn’t too
Firewall
before. strict.
Stateful Keeps track of active connections and Smarter and safer — it knows what traffic is
Firewall remembers ongoing communication. allowed to come back and what isn’t.
Zone Trust Level Example / Purpose
Inside Zone High trust Internal users and systems
Public servers – web, email,
DMZ (Demilitarized Zone) Medium trust
DNS
Outside Zone Low trust Internet or external networks
Types of Firewall
Type Simple Explanation
Looks at basic information like IP address, port number, and
Packet-Filtering Firewall protocol of each data packet to decide whether to allow or block it.
It’s simple and fast but not very advanced.
Smarter version — remembers active connections and checks if the
Stateful Inspection Firewall
traffic is part of a valid communication.
Acts like a middleman between users and the internet. It hides the
Proxy Firewall
internal network and filters web requests for safety.
Next-Generation Firewall Very advanced — can deeply inspect data, block attacks, and filter
(NGFW) traffic based on the type of application (e.g., Facebook, YouTube).
A firewall that runs in the cloud instead of a physical device. It
Cloud-Based Firewall
protects users and apps that work over the internet.
Access Control Lists (ACLs)
• An ACL is a list of rules that decide whether network traffic is allowed or blocked.
• It filters packets based on details like IP address, port number, protocol, or interface.
• Key Points
• Allow or Deny traffic based on set rules
• Used on routers, switches, and firewalls
• Helps enforce security policies
• Controls network traffic flow and routing
• Firewall → The Security Guard of the Network
• Access Control List (ACL) → The Guest List
Why ACLs?
Use Case What It Does Example
Allow or block traffic between networks or Block traffic from [Link]/8 to
Traffic Filtering
devices [Link]/24
Security Allow SSH only from a specific
Restrict access to services or subnets
Enforcement IP or subnet
Filter which routes are shared between Block specific routes from
Routing Decisions
protocols being advertised to BGP
Identify traffic for special handling (like Prioritize VoIP traffic over web
QoS & Priority
VoIP) browsing
Apply NAT only to internal
NAT Matching Decide which traffic should be translated
traffic going to the internet
Types of ACLs
Type What It Does Where to Apply Key Limitations
Filters traffic only by source Cannot filter by port or
Standard ACL Close to the destination
IP address protocol
Filters by source +
More complex, but more
Extended ACL destination IP, protocol, Close to the source
powerful
and port
ACL with a name instead of
Easier to manage and Functionally same as
Named ACL a number; can be standard or
modify standard/extended
extended
ACL Rules
Rule What It Means
ACL checks rules from top to bottom — it stops at the first
Top to Bottom
match.
If nothing matches, the traffic is blocked automatically (even
Deny by Default
if not shown).
ACL must be applied on an interface, and in a direction: in
Direction Matters
or out.
No Logs by ACLs don’t log anything unless you add the log keyword to
Default a rule.
NAT
• Network Address Translation (NAT) is a process used in networking where a device (usually a
router or firewall) modifies the IP address information in packet headers as the packets pass through
it.
• This allows private IP addresses within a local network to communicate with external networks, like
the Internet.
• How NAT Works:
• When a device inside a private network wants to communicate with the Internet:
• The router replaces the device’s private IP with its own public IP in the packet header.
• It records this translation in a NAT table.
• When a response comes back from the Internet, the router uses the NAT table to translate the
public IP and port back to the private IP and port, and sends the packet to the correct device.
Why do we need NAT?
1. IPv4 Address Exhaustion
• Problem: The IPv4 address space (approx. 4.3 billion addresses) is limited
and has been nearly exhausted.
• Solution: NAT allows multiple devices in a private network to share a single
public IP address, drastically reducing the need for unique public IPs.
• Benefit: Helps extend the life of IPv4, reducing the urgency for full IPv6
adoption.
• Example: A company with 200 devices can connect all of them to the
Internet using just one public IP address.
2. Security
• Function: NAT acts as a basic firewall by hiding internal IP addresses from external networks.
• Benefit: Prevents direct access to internal devices, reducing exposure to external attacks.
• Note: While NAT provides obfuscation, it's not a substitute for a full firewall or intrusion
prevention system.
3. Simplified Network Management
•Use Case: Internal IP addressing can remain consistent even if:
•You change ISPs
•Merge networks with another company
•Expand or restructure your network
•Benefit: No need to reconfigure all internal devices when external/public IPs change.
Internal devices can keep using 192.168.x.x or 10.x.x.x regardless of the ISP’s public IP range.
4. Translation Between Incompatible Address Spaces
•Function: NAT allows communication between networks that use different or overlapping IP
address ranges.
•Example: Two merged companies both use 192.168.1.x internally. NAT can map one range to avoid
conflict.
This is often seen in VPNs or enterprise environments where address spaces must be translated to avoid
overlap.
NAT and the OSI Model
• NAT operates at Layer 3 (Network Layer) of the OSI model.
• This is because NAT modifies the IP address information in the packet headers
(specifically, the source or destination IP addresses).
• By changing the IP headers, NAT enables the translation between private (internal) and
public (external) IP address spaces.
• It does not operate at Layer 4 (Transport Layer), but in the case of PAT (Port Address
Translation), port numbers (which are Layer 4 info) are also modified to distinguish
multiple internal hosts.
Types of NAT
Type Description
One-to-one mapping: each internal private IP is mapped to a specific public
Static NAT
IP address.
Maps internal IPs dynamically to a pool of public IP addresses; when a
Dynamic NAT
device initiates a connection, it gets assigned a free public IP from the pool.
PAT (Port Address Many-to-one mapping: multiple private IP addresses share a single public IP
Translation) / NAT by differentiating connections via unique source ports. This is the most
Overload commonly used form of NAT.