8 Network Security Basics

Purpose of network security

Network security protects networked devices, communications, and information from unauthorized access, alteration, disruption, or destruction. Effective protection combines technical safeguards with careful configuration and ongoing monitoring.

Security principles

A common foundation is the CIA triad: confidentiality, integrity, and availability. Together, these principles describe goals for protecting information and the systems that use it.

• Confidentiality: Information should be accessible only to authorized people or systems. Encryption and access controls help protect it.

• Integrity: Information and communications should remain accurate and should not be changed without authorization. Cryptographic checks and controlled access can help detect or prevent tampering.

• Availability: Systems and data should remain usable when needed. Redundancy, backups, and defenses against service disruption support availability.

Two additional principles guide practical defenses. Least privilege limits each user or service to the access needed for its task. Defense in depth combines safeguards, such as a firewall, secure device settings, and backups, so that one failed control does not leave a system unprotected.

Common network threats

Network threats can target devices, accounts, communications, or the availability of services.

• Malware, including ransomware, can infect devices, steal information, or prevent access to files and systems.

• Phishing and credential theft trick people into revealing passwords or approving unauthorized access.

• Eavesdropping and man-in-the-middle attacks seek to observe or alter communications as they travel across a network.

• Spoofing and unauthorized access involve pretending to be a trusted device or user, or exploiting weak access controls.

• Denial-of-service (DoS) attacks overwhelm a service or network with traffic, making it difficult for legitimate users to connect.

• Unpatched software and insecure settings can expose known weaknesses that attackers may exploit.

A threat is not the same as a vulnerability. A threat may exploit a vulnerability—such as an unpatched server or a poorly protected account—to cause harm.

Filtering traffic with firewalls

A firewall controls network traffic between systems or networks with different security requirements. It applies rules to determine which connections are allowed or blocked. For example, a firewall might allow a public web server to receive web requests while blocking unsolicited connections to a staff workstation.

Rules should permit only necessary traffic, and they need to be reviewed and maintained. A firewall does not prevent every attack: it may not stop an attack that arrives through an allowed connection or one that targets a vulnerable device.

Protecting data with encryption

Encryption transforms readable data into a form that cannot ordinarily be understood without the appropriate key. It can protect data in transit, such as a connection between a browser and a website secured with TLS, and data at rest, such as files stored on a device. In this way, encryption helps protect confidentiality.

Encryption does not make a compromised device or stolen account safe. Secure use also depends on sound protocols, valid certificates, and protection of cryptographic keys.

Configuration, access, and recovery

Secure configuration reduces unnecessary ways into a system. Practical measures include installing security updates, changing default credentials, disabling unused services, limiting administrative access, and using multifactor authentication (MFA), especially for remote and privileged accounts.

Network segmentation separates systems into zones and limits traffic between them. This can reduce how far an intrusion spreads. Keeping logs helps investigate suspicious activity, while tested backups allow important data to be restored.

Combining defenses

A small office can strengthen its protection by enabling MFA for remote access, updating its router and computers, configuring a firewall to allow only required services, encrypting sensitive web and remote connections, and keeping offline or otherwise protected backups. These measures provide complementary layers of defense rather than relying on a single safeguard.