Security Is a Property of the Whole System

Network security isn’t a product you bolt on — it’s a set of defense-in-depth controls layered across the stack. Each control stops a different class of attack; none is sufficient alone. The core model is simple: reduce the attack surface, segment the trust domains, and verify instead of trust. This topic gives you the operator’s vocabulary: firewalls, intrusion systems, segmentation, the common attacks, and where the industry is heading (Zero Trust).

Firewalls

A firewall is a gatekeeper that decides which traffic may cross a boundary, based on rules (“allow HTTP from the web tier to the app tier; deny everything else”). Three generations, each seeing more of the traffic:

The default policy matters more than any rule: default-deny (allowlist) is vastly safer than default-allow (denylist). “Block the bad ports” is a losing game — the question is always “what is explicitly allowed, and is that the smallest set?”

Cloud networking blurs this: security groups (AWS) are stateful filters attached to instances; NACLs are stateless network-level filters. The practical operator lesson — write the rules in the smallest place, make them explicit, and remember security groups evaluate allow rules only.

IDS vs IPS

Intrusion Detection Systems watch; Intrusion Prevention Systems act:

• IDS — monitors traffic (and hosts) for suspicious patterns and alerts. Passive, no inline disruption.
• IPS — sits inline, drops or blocks traffic that matches known signatures or anomaly heuristics.

Signature-based detection catches known attacks; anomaly-based catches novel behavior but produces false positives. The operational reality: alerts without a response plan are noise. An IDS that pages you at 3 a.m. for every TLS scan is worse than none. Tune thresholds, wire alerts to an actual response runbook, and treat an alert backlog as a security debt.

Segmentation: The Damage Limiter

Network segmentation divides one network into isolated zones so a compromise in one cannot reach the rest. The building blocks:

• VLANs (802.1Q) — logically split a single switch into separate broadcast domains.
• Subnets + routing rules — separate L3 segments with firewall rules between them.
• Microsegmentation — per-workload rules (e.g., “app can talk only to its DB, on 5432”) enforced by the platform rather than physical topology.

Segmentation is the difference between “attacker pwned one server” and “attacker pwned the whole estate.” The classic layering: public edge → DMZ (web tier) → app tier → data tier, with firewall rules enforcing that only the right ports cross each boundary. This is precisely the “least privilege” idea applied to networks, and it’s why the same architecture shows up in the Databases and Distributed Systems topics as “only the app tier reaches the database.”

Common Attacks (Know Your Enemy)

Two cross-cutting truths: most attacks ride on misconfiguration (default credentials, open ports, missing TLS), and identity is the new perimeter — once any host is compromised, the only thing between the attacker and your crown jewels is segmentation plus credential hygiene.

Zero Trust Network Access (ZTNA)

Traditional security assumed a trusted inside (the corporate network) and an untrusted outside. Zero Trust inverts it: never trust the network; verify every request regardless of origin. Principles:

• Never trust, always verify — every access is authenticated and authorized, even inside the office.
• Least privilege — access is per-identity, per-resource, not “joined the VPN, now you can see everything.”
• Assume breach — segment, encrypt, log, and monitor as if a host is already compromised.

ZTNA replaces the “big VPN that dumps you on the LAN” with per-application access via a gateway: you authenticate → the gateway grants access only to the specific service you’re allowed to reach, on demand. The network becomes irrelevant to the security decision — which is exactly why the industry is moving that way as applications move to the cloud.

Practice Trajectory

1. On a Linux box, iptables -L -v (or ufw status) and enumerate every currently-allowed port; ask of each: “does anything need this?”
2. nmap -sV localhost and compare the open-port list against your mental allowlist — this is what an attacker sees first.
3. Split two services onto separate subnets/VLANs with a firewall between them; verify the default-deny path fails before you open the one needed port.
4. Run a local IDS rule on a pcap of a known exploit (e.g., a Metasploit payload) and see the alert; then think about what a response plan for it would be.
5. Explain Zero Trust to someone using only the phrase “verify every request, regardless of where it came from.”

When It’s the Right Tool