What Is Network Security?

Network security is the set of practices, controls, and tools that protect a network and its data from unauthorized access, misuse, and attacks. Network security combines hardware, software, and policies to defend the devices, connections, and traffic that make up a network. The National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO) publish the frameworks that define how these protections apply.

This article defines network security, explains the CIA triad as it applies to networks, describes the core controls including firewalls, encryption, access control, virtual private networks, and intrusion detection, sets out the physical, technical, and administrative layers, lists common threats, and explains defense in depth. Each section states one part of the topic and connects it to the protection of the network and its data at the center of the definition. The result is a complete account of what network security is, the controls that enforce it, and how the layers combine to resist attacks.

What Is Network Security?

Network security is the practice of protecting a network and its data from unauthorized access, misuse, modification, and attacks through hardware, software, and policy controls. Network security defends the devices, links, and traffic of a network so that only authorized users reach resources and data stays intact. The defining traits of network security are listed below:

• Protection of data keeps information confidential and unaltered as it moves across the network.
• Access control restricts the network to authorized users and authorized devices.
• Threat defense blocks, detects, and responds to attacks aimed at the network.
• Combined controls use hardware, software, and administrative policy together to enforce protection.

Network security protects the devices and traffic that form a network, building on the broader principles set out in the fundamentals of computer security. The attacks these controls defend against are catalogued in the overview of common network attacks.

What Is the CIA Triad in Network Security?

The CIA triad is the model of confidentiality, integrity, and availability that defines the three goals network security protects. The CIA triad, published in NIST guidance, states that a secure network keeps data private, unaltered, and reachable by authorized users. The three principles of the CIA triad are listed below:

• Confidentiality keeps data private, so only authorized users and devices read it, enforced through encryption and access control.
• Integrity keeps data unaltered, so it reaches the destination exactly as sent, enforced through hashing and authentication.
• Availability keeps the network and its data reachable for authorized users, defended through redundancy and attack mitigation.

The CIA triad sets the objectives every network security control serves, according to NIST Special Publication 800-53. Confidentiality, integrity, and availability together describe a secure network, and an attack succeeds when it breaks one of the three.

What Are the Core Network Security Controls?

The core network security controls are firewalls, encryption, access control, virtual private networks, intrusion detection and prevention systems, and network segmentation. A network security control enforces one part of the CIA triad, from blocking traffic to encrypting data. The core controls are listed below:

• Firewalls filter traffic against a rule set, allowing authorized connections and blocking the rest.
• Encryption converts data into ciphertext so intercepted traffic stays unreadable without the key.
• Access control limits the network to authenticated users and devices, often through network access control (NAC).
• Virtual private networks (VPNs) encrypt traffic across untrusted networks to protect data in transit.
• Intrusion detection and prevention systems (IDS/IPS) monitor traffic for attack signatures and block matching activity.
• Network segmentation divides a network into zones so a breach in one zone does not reach the others.

A firewall filters traffic at the network boundary and on individual devices, compared in the analysis of hardware and software firewalls. A virtual private network encrypts traffic across untrusted links, explained in the guide to how a VPN works.

What Are the Layers of Network Security?

Network security operates across three layers: physical security, technical security, and administrative security, each protecting the network from a different angle. A security layer addresses one category of risk, from physical access to a device to the policies that govern user behavior. The three layers of network security are listed below:

• Physical security protects the hardware, controlling who reaches routers, switches, servers, and cabling.
• Technical security protects data and traffic through firewalls, encryption, access control, and monitoring.
• Administrative security sets the policies, procedures, and training that govern how users and staff handle the network.

Physical, technical, and administrative layers cover the hardware, the data, and the human procedures of a network, according to the control families in NIST Special Publication 800-53. A gap in one layer weakens the others, since an attacker who reaches a device physically can bypass technical controls.

What Are Common Network Security Threats?

Common network security threats include malware, distributed denial-of-service attacks, man-in-the-middle interception, phishing, and unauthorized access. A network threat is any event that can breach confidentiality, integrity, or availability. The common threats are listed below:

• Malware includes viruses, worms, and ransomware that infect devices and spread across the network.
• Distributed denial-of-service (DDoS) attacks flood a target with traffic to exhaust its resources and block legitimate users.
• Man-in-the-middle attacks intercept traffic between two parties to read or alter the data.
• Phishing tricks users into revealing credentials that grant attackers network access.
• Unauthorized access uses stolen credentials or unpatched flaws to reach restricted resources.

These threats target the confidentiality, integrity, and availability that the CIA triad protects, and each maps to a defense among the core controls. The mechanics of each attack and its countermeasure are detailed in the guide to common network attacks.

What Is Defense in Depth?

Defense in depth is the strategy of layering multiple network security controls so that if one control fails, others continue to protect the network. Defense in depth assumes no single control is sufficient, so it stacks firewalls, encryption, access control, and monitoring to create overlapping barriers. The principles of defense in depth are listed below:

• Layered controls place several independent defenses between an attacker and the protected data.
• Redundancy ensures a breach of one control does not grant access to the whole network.
• Segmentation divides the network so an attacker who passes one barrier still faces the next.
• Monitoring detects activity that slips past preventive controls, enabling a response.

Defense in depth combines the boundary firewall, internal segmentation, encryption, and continuous monitoring into one strategy, recommended by NIST and the Cybersecurity and Infrastructure Security Agency (CISA). Continuous observation of traffic for anomalies is the role of network monitoring, and isolating exposed services uses a demilitarized zone.

How Does Access Control Secure a Network?

Access control secures a network by verifying the identity of users and devices and granting each only the access its role requires. Access control combines authentication, which confirms identity, with authorization, which sets permissions. The elements of network access control are listed below:

• Authentication confirms a user or device identity through passwords, certificates, or multi-factor methods.
• Authorization assigns each authenticated identity the specific permissions its role requires.
• Network access control (NAC) checks a device for compliance before allowing it onto the network.
• Least privilege grants the minimum access needed, limiting the damage from a compromised account.

Access control enforces the confidentiality and integrity goals of the CIA triad by keeping unauthorized users out, following the least-privilege principle in NIST guidance. A firewall enforces access control at the network boundary, the subject of the explanation of what a firewall is.

How Does Encryption Protect Network Data?

Encryption protects network data by converting it into ciphertext that only a holder of the correct key can read, securing data both in transit and at rest. Encryption defends confidentiality, so intercepted traffic stays unreadable. The key facts about network encryption are listed below:

• Symmetric encryption uses one shared key for both encryption and decryption, as in the Advanced Encryption Standard (AES).
• Asymmetric encryption uses a public and private key pair, as in the protocols that secure key exchange.
• Transport Layer Security (TLS) encrypts web and application traffic in transit across a network.
• Wi-Fi encryption protects wireless traffic through protocols such as WPA2 and WPA3.

Encryption secures data in transit through TLS and virtual private networks and secures wireless traffic through Wi-Fi protocols. The wireless protocols that encrypt Wi-Fi traffic are compared in the comparison of WPA2 and WPA3, and a VPN and proxy comparison explains how each tool routes traffic.

How Does Network Segmentation Improve Security?

Network segmentation improves security by dividing a network into separate zones so a breach in one zone cannot spread to the others. Segmentation isolates groups of devices, limiting the reach of an attacker who compromises one part of the network. The benefits of network segmentation are listed below:

• Breach containment keeps an attacker who enters one zone from reaching devices in another zone.
• Reduced attack surface exposes fewer services to any single segment, lowering the paths an attacker can take.
• Sensitive-data isolation places critical systems in a restricted zone with tighter access rules.
• Traffic control applies firewall rules between zones, filtering the connections allowed across segments.

Segmentation divides a network with internal firewalls and virtual LANs, a core part of the defense-in-depth strategy NIST recommends. A demilitarized zone is one form of segmentation that isolates public-facing servers, detailed in the guide to a demilitarized zone, while continuous traffic observation across segments uses network monitoring.

Key Takeaways

• Network security protects a network and its data from unauthorized access and attacks.
• The CIA triad sets the goals of confidentiality, integrity, and availability.
• Core controls include firewalls, encryption, access control, VPNs, IDS/IPS, and segmentation.
• Three layers, physical, technical, and administrative, cover hardware, data, and policy.
• Common threats include malware, DDoS, man-in-the-middle attacks, phishing, and unauthorized access.
• Defense in depth layers controls so a single failure does not expose the network.

Last Thoughts on Network Security

Network security protects a network and its data from unauthorized access, misuse, and attacks through combined hardware, software, and policy controls. The CIA triad sets the goals of confidentiality, integrity, and availability, and the core controls, firewalls, encryption, access control, virtual private networks, intrusion detection, and segmentation, enforce them.

Physical, technical, and administrative layers cover the hardware, data, and procedures, while defense in depth stacks these controls so a single failure does not expose the network. Readers can continue with the comparison of hardware and software firewalls, the guide to common network attacks, the comparison of WPA2 and WPA3, or the guide to how networks work.