1 Network Security Foundations and Threats

Security goals

Network security protects connected systems, data, and services from unauthorized access, misuse, disruption, or alteration. Effective defenses start with identifying what must be protected, what could go wrong, and which controls can reduce the risk.

The CIA triad describes three common security goals:

• Confidentiality: Information is available only to authorized people and systems. Encryption and access controls can help protect it.

• Integrity: Information and systems remain accurate and are not changed without authorization. Permissions, cryptographic checks, and change monitoring can help preserve it.

• Availability: Authorized users can access systems and information when needed. Redundancy, backups, and defenses against denial-of-service attacks support it.

Organizations may also need accountability, the ability to link actions to responsible identities, and authenticity, confidence that a user, device, or message is genuine. Security choices should support essential organizational work, rather than simply maximize restrictions.

Threats, vulnerabilities, and risk

A threat is a potential cause of harm, while a vulnerability is a weakness that could be exploited or accidentally triggered. Risk combines the chance of an event with its possible impact. A threat model makes these ideas concrete by connecting what needs protection to possible events, consequences, and controls.

A threat model considers:

1. Assets: What needs protection, such as customer records, payment services, or network equipment?

2. Actors and events: Who or what might cause harm, intentionally or accidentally?

3. Entry points and trust boundaries: Where can users, devices, or data enter or move between systems?

4. Weaknesses and consequences: What could fail, and what would the effect be?

5. Controls: Which protections could prevent, detect, limit, or help recover from an event?

For example, a small clinic might identify its patient-record system as a critical asset. A stolen employee password could let an attacker access records, and an outage could delay care. The clinic could reduce these risks with multifactor authentication, limited account permissions, network separation, monitoring, and tested backups.

Attacks can target confidentiality, integrity, availability, or several goals at once. Defenders should consider accidents and misconfiguration as well as deliberate attacks.

Common attacks

Common attacks exploit people, software, networks, or legitimate access. Stolen credentials can make an attacker appear to be a legitimate user, and an attacker who gains an initial foothold may try to reach additional accounts, devices, or data.

• Phishing and credential theft: A user is tricked into revealing a password or approving access.

• Malware and ransomware: Malicious software can steal data, disrupt services, or encrypt files to demand payment.

• Denial of service: An attacker overwhelms a service or its network capacity, making it unavailable to legitimate users.

• Eavesdropping and interception: An attacker observes communications or obtains sensitive data in transit, especially when connections are not adequately protected.

• Spoofing and man-in-the-middle attacks: An attacker impersonates a user, device, or service, or positions themselves between communicating parties to observe or alter traffic.

• Unauthorized access and lateral movement: An attacker attempts to access additional accounts, devices, or data after gaining an initial foothold.

• Insider misuse and mistakes: A person with legitimate access may misuse it, or an employee may accidentally expose data or weaken a system.

Identity and access control

Authentication checks a claimed identity; authorization decides what that identity is allowed to do. A successful login does not mean a user should be able to access every resource.

Authentication may rely on different factor types: something a person knows, such as a password; has, such as a security key or phone; or is, such as a biometric characteristic. Multifactor authentication uses two or more different types of factor. It can make stolen passwords less useful, but organizations should also protect account recovery, devices, and sessions.

Access control should follow least privilege: give each user or service only the permissions needed for its task, and remove them when they are no longer required. For example, a help-desk worker may need to reset accounts but should not automatically be able to read every customer record. Regularly review permissions, use separate administrative accounts, and disable accounts that are no longer needed.

Network defenses and layered protection

Network segmentation divides a network into separate zones and controls which traffic can cross between them. A business might separate guest Wi-Fi, employee devices, public-facing web services, and sensitive databases. If a guest device is compromised, carefully limited connections can make it harder to reach internal systems. Segmentation limits unnecessary paths and can contain the impact of a breach, but it does not replace authentication or endpoint security.

Other defenses complement segmentation:

• Firewalls and filtering rules: Allow required connections and block unnecessary ones. Review rules and keep them understandable.

• Secure configuration and updates: Remove unneeded services, replace default credentials, and apply security updates in a timely, tested way.

• Encryption: Protect sensitive data in transit and, where appropriate, at rest. Encryption does not decide who is authorized to use data after access is granted.

• Monitoring and logging: Record relevant activity and review alerts for suspicious patterns, such as unexpected login locations or unusual connections between zones.

• Backups and recovery plans: Keep protected backups and test that systems and data can be restored.

• Layered defenses: Combine prevention, detection, containment, and recovery so that one failed control does not expose everything.

A zero-trust approach rejects the assumption that a user or device is trustworthy merely because it is inside a corporate network. Access decisions should verify identity and authorization for the requested resource, and may also consider device condition and other context.

Applying security reasoning

For a suspicious email, such as an unexpected invoice link that asks an employee to sign in, the employee should avoid using the link, verify the request through a known channel, and report the message. The organization can reduce harm with multifactor authentication, email protections, limited permissions, and a clear reporting process.

If a visitor’s laptop joins guest Wi-Fi, the guest network should provide internet access without unrestricted access to staff computers or the records system. Segmentation and firewall rules limit possible paths if the laptop is infected.

If a public website becomes unreachable during a traffic surge, defenders should distinguish an attack from a legitimate demand spike. They should use appropriate traffic-management protections, communicate service status, and preserve alternate ways to provide critical services. Monitoring and recovery plans help reduce disruption.

For each situation, ask what asset is at risk, which security goal is threatened, what the likely entry point is, and which control could prevent the event, detect it, limit its spread, or support recovery. This turns security into a repeatable way of reasoning rather than a list of products.