Chapter 9
Network Security and Zero-Trust Architecture
Bachelors Program in IT
Advanced Networking
•
Bachelor
Network Security and Zero-Trust Architecture
Introduction
Modern networks connect users, applications, cloud services, operational technology, mobile devices, suppliers, and unmanaged endpoints. This connectivity creates business value but also enlarges the attack surface. Network security is therefore not simply the deployment of a firewall at the Internet edge. It is the coordinated protection of identities, devices, communications, applications, data, and operational processes against unauthorized access, misuse, disruption, and deception.
A secure network must preserve three fundamental properties: confidentiality, integrity, and availability. Confidentiality prevents unauthorized disclosure; integrity protects information and configurations from unauthorized alteration; and availability ensures that authorized users can access services when required. Authentication, authorization, accountability, resilience, and privacy extend this basic triad.
This chapter develops a practical security architecture based on threat modeling, defense in depth, segmentation, access control, monitoring, cryptography, secure routing, network access control, incident response, vulnerability management, and zero-trust principles.
Learning Objectives
After studying this chapter, a student should be able to:
Construct a basic threat model for a networked system.
Explain defense in depth and apply segmentation appropriately.
Configure and evaluate ACLs, firewalls, IDS/IPS, NAC, and secure routing controls.
Distinguish the purposes of PKI, TLS, and IPsec.
Explain zero-trust architecture and its relationship to identity, device posture, and least privilege.
Design an incident-response and vulnerability-management process.
Evaluate secure configuration, governance, ethical, and operational considerations.
1. Security as a Systems and Risk Problem
Security controls are selected to reduce risk, not merely to satisfy a checklist. Risk arises when a threat can exploit a vulnerability and produce an adverse impact. A useful qualitative model is:
Risk ≈ Likelihood × Impact
Likelihood estimates how probable exploitation or failure is, while impact estimates the resulting harm to confidentiality, integrity, availability, safety, legal compliance, or reputation. This expression is a decision-making model rather than a precise physical law. Its variables are usually ordinal or estimated, so multiplying scores does not produce an objectively measured probability.
A threat model identifies assets, trust boundaries, threats, vulnerabilities, existing controls, and acceptable residual risk. STRIDE is a commonly used classification: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Attack trees represent how an attacker could combine actions to reach a goal. Data-flow diagrams are especially useful because they show where data crosses trust boundaries.
A practical threat-modeling sequence is:
Define scope, business purpose, and security objectives.
Inventory assets, identities, interfaces, protocols, and dependencies.
Draw data flows and mark trust boundaries.
Identify plausible threat actors and attack paths.
Analyze vulnerabilities and existing safeguards.
Rank risks and select treatment: reduce, transfer, avoid, or accept.
Validate assumptions through testing and revise the model as the system changes.
Threat modeling is not a one-time document. New software, suppliers, routes, credentials, and cloud services can change the attack surface.
2. Defense in Depth and Segmentation
Defense in depth uses multiple partially independent controls. A typical sequence may include secure configuration, identity verification, endpoint protection, network segmentation, firewalls, encrypted communications, logging, backup, and incident response. The objective is not to make compromise impossible; it is to prevent easy compromise, limit movement, detect abnormal behavior, and recover quickly.
Controls can be administrative, technical, or physical. Administrative controls include policy, training, supplier requirements, and separation of duties. Technical controls include ACLs, firewalls, cryptography, and monitoring. Physical controls include locked network rooms, power protection, and access badges.
Segmentation divides a network into security zones with explicitly controlled communication. Examples include:
User zone: employee workstations and ordinary office devices.
Server zone: application and database services.
Management zone: administrative interfaces and infrastructure tools.
Guest zone: Internet-only visitor access.
DMZ: externally reachable services isolated from internal systems.
Operational technology zone: industrial or safety-relevant systems requiring specialized controls.
VLANs provide logical separation, but a VLAN alone is not a security boundary if routing between VLANs is unrestricted. Inter-zone traffic should pass through a policy enforcement point, such as a firewall or layer-3 ACL, and should be denied by default where operationally feasible.
Microsegmentation applies policy at a finer level, potentially between workloads, applications, or identities. It is valuable in cloud and virtualized environments but increases policy complexity and requires accurate asset inventories.
3. ACLs, Firewalls, and Policy Design
An access control list evaluates traffic attributes such as source address, destination address, protocol, and port. Rules are generally processed in order, and the first matching rule is applied. Many systems include an implicit deny at the end; administrators should never rely on an undocumented behavior.
A sound ACL policy follows these principles:
Specify the narrowest source and destination possible.
Permit only required protocols and ports.
Place specific rules before broad rules.
Document business ownership and expiration dates.
Log important denies without overwhelming monitoring systems.
Review rules regularly and remove obsolete entries.
A firewall may be stateless, stateful, application-aware, or implemented as a web application firewall. Stateless filtering evaluates each packet independently. Stateful inspection tracks connection state, allowing return traffic for an authorized session. Application-aware controls can inspect protocol behavior, user identity, or content, but encrypted traffic and evasive applications reduce visibility.
A policy should distinguish inbound, outbound, inter-zone, and management traffic. Egress filtering is important because it limits command-and-control traffic and data exfiltration. A secure design does not assume that internal traffic is trustworthy.
4. IDS, IPS, and Security Monitoring
An intrusion detection system (IDS) observes and alerts; an intrusion prevention system (IPS) can block or alter traffic. Network-based systems inspect traffic at strategic points, while host-based systems observe processes, files, and local events. Signature detection is effective for known patterns. Anomaly detection identifies deviations from a baseline but may produce false positives.
Detection quality depends on placement, time synchronization, visibility, tuning, and response capability. Logs should be centralized in a security information and event management platform (SIEM), where events can be correlated. Useful telemetry includes authentication events, DNS activity, firewall decisions, endpoint alerts, configuration changes, and privileged actions.
Monitoring must address both false positives and false negatives. A high alert volume can conceal serious incidents, while overly aggressive suppression can hide attacks. Detection rules should have an owner, rationale, severity, response procedure, and review date.
5. Secure Routing and Network Infrastructure
Routing infrastructure is a high-value target because manipulation can redirect, intercept, or blackhole traffic. Security practices include:
Authenticate routing peers where supported.
Restrict routing adjacencies to approved interfaces and addresses.
Apply route filtering and prefix limits.
Use passive interfaces where adjacency is unnecessary.
Reject unauthorized default routes.
Protect management planes with dedicated networks and strong authentication.
Back up and monitor configurations.
Use infrastructure ACLs and control-plane policing.
Routing protocol authentication protects the relationship between peers, but it does not guarantee that every advertised route is legitimate. Prefix filtering, route origin validation where applicable, and operational monitoring provide additional protection. Management protocols should use encrypted versions such as SSH and HTTPS rather than Telnet or unencrypted HTTP.
Network time is also a security dependency. Logs from devices with inconsistent clocks are difficult to correlate. Authenticated time synchronization, centralized logging, and reliable backups improve forensic quality.
6. Network Access Control and Identity
Network access control (NAC) decides whether a device may connect and what access it receives. It can evaluate user identity, device identity, operating-system version, endpoint protection status, certificates, and location. A noncompliant device may be denied, placed in a quarantine network, or granted restricted remediation access.
NAC should not be treated as a substitute for segmentation. A device that passes an admission check may later become compromised. Continuous or repeated assessment is therefore preferable to a single connection-time decision.
Identity and access management should implement least privilege: users and services receive only the permissions required for legitimate tasks. Multifactor authentication reduces the value of stolen passwords. Privileged access should use separate accounts, short-lived authorization, approval workflows, command logging, and periodic review.
Service accounts require particular care. They should have a defined owner, narrowly scoped permissions, credential rotation, noninteractive restrictions where possible, and monitoring for unusual use.
7. PKI, TLS, and IPsec
Public key infrastructure (PKI) binds identities to public keys through digital certificates. A certificate authority (CA) issues certificates after validating an identity according to a defined policy. The certificate chain typically extends from a trusted root CA through intermediate CAs to an end-entity certificate.
Important PKI operations include certificate issuance, renewal, revocation, key protection, trust-store management, and incident response to CA compromise. Certificate validity alone does not prove that an application is safe; hostname validation, correct chain validation, appropriate algorithms, and secure private-key storage are also required.
TLS protects application communications by providing server authentication, optional client authentication, confidentiality, and integrity. A simplified TLS exchange negotiates cryptographic parameters, authenticates the server, establishes shared session keys, and then protects application data. Modern deployments should use current protocol versions, disable obsolete algorithms, protect private keys, and automate certificate renewal.
IPsec operates at the network layer. It can protect traffic between hosts, gateways, or remote-access clients. Tunnel mode commonly encapsulates an entire original IP packet, while transport mode protects the payload of an IP packet. Site-to-site VPNs frequently use IPsec tunnel mode; TLS-based VPNs operate at a different layer and may provide more application-oriented access.
Encryption is not a complete security solution. It does not prevent endpoint compromise, misuse by authorized users, traffic-analysis leakage, denial of service, or incorrect authorization.
8. Zero-Trust Architecture
Zero trust rejects implicit trust based solely on network location. Its central principle is to verify explicitly, use least privilege, and assume breach. A request is evaluated using identity, device posture, resource sensitivity, session context, and policy rather than simply asking whether the request originated inside the corporate network.
A zero-trust architecture commonly contains:
Policy engine: evaluates contextual information and organizational policy.
Policy administrator: creates or terminates the communication path.
Policy enforcement point: allows, denies, or limits the actual session.
Identity provider: supplies authentication and identity attributes.
Device and asset systems: provide posture and inventory data.
Telemetry systems: provide risk signals and behavioral evidence.
Zero trust is not a single product and does not mean “authenticate every packet” in a simplistic sense. It is an architectural and governance approach. Network segmentation, NAC, MFA, endpoint detection, encrypted transport, and continuous monitoring can all support it.
A mature implementation begins with high-value applications and explicit access policies. It maps users, workloads, devices, data flows, and dependencies; removes broad network permissions; introduces application-specific access; and measures outcomes such as reduced lateral movement and improved policy visibility.
The approach has limitations. Legacy systems may lack strong identity support, device signals may be inaccurate, policy engines can become unavailable, and excessive prompts can encourage unsafe workarounds. Availability, privacy, and usability must therefore be designed alongside security.
Zero trust request evaluation architecture
Figure: Zero trust request evaluation architecture
Figure: A zero-trust request is evaluated using context, policy, enforcement, and telemetry rather than network location alone.
9. Incident Response and Vulnerability Management
Incident response is a disciplined process rather than an improvised technical exercise. Common phases are preparation; detection and analysis; containment; eradication; recovery; and lessons learned. Preparation includes contact lists, authority to isolate systems, evidence procedures, backups, exercises, and relationships with legal, communications, and external response organizations.
Containment must balance security and business continuity. Isolating a compromised endpoint may stop spread but can destroy volatile evidence or interrupt safety-critical operations. Investigators should preserve relevant logs, record actions and times, maintain chain of custody where necessary, and avoid altering evidence unnecessarily.
Vulnerability management includes asset discovery, vulnerability identification, risk-based prioritization, remediation, validation, and reporting. Severity scores are useful but incomplete. Exploitability, exposure, asset criticality, compensating controls, and business impact must also be considered. Patching without asset inventory and verification leaves significant blind spots.
Secure configuration practices include hardened baselines, removal of unnecessary services, default-credential elimination, management-plane restriction, configuration version control, automated compliance checks, backup testing, and controlled change management. Configuration drift should generate an alert or remediation workflow.
10. Applied Case: Illustrative University Zero-Trust Transition
Background. A fictional university operates student laboratories, administrative systems, research servers, a learning-management platform, and building-control systems. Its traditional design allows broad internal reachability after VPN authentication.
Problem. A stolen password is used to access the VPN. The attacker reaches a laboratory workstation, discovers file shares, and attempts to move toward research servers. Logging is fragmented, and many devices have inconsistent patch levels.
Analysis. Threat modeling identifies credential theft, lateral movement, exposed management interfaces, weak segmentation, and inadequate detection. High-value assets include research data, identity services, payment records, and building controls. The building-control network requires especially cautious treatment because availability and safety are important.
Approach. The university first inventories assets and data flows. It separates student, administrative, research, guest, management, and building-control zones. MFA is required for VPN and privileged access. Application-specific policies replace broad VPN reachability. NAC checks managed devices and assigns unmanaged devices to restricted networks. TLS protects web applications; IPsec protects selected site-to-site links. Firewalls enforce inter-zone rules, while SIEM correlation combines identity, endpoint, DNS, and firewall events. Incident playbooks define isolation and recovery procedures.
Outcome. The attacker’s stolen password alone no longer provides broad access. A noncompliant endpoint receives limited connectivity, and unusual access to research services triggers an alert. The university retains exceptions for legacy systems but documents them, monitors them, and schedules modernization.
Learning points. Zero trust is achieved through coordinated identity, segmentation, device assessment, encryption, monitoring, and governance. It is an incremental risk-reduction program, not a single replacement product. Legacy exceptions must be treated as explicit risks rather than invisible assumptions.
11. Governance, Ethics, and Contemporary Developments
Security monitoring can collect sensitive information about employees, students, customers, and visitors. Organizations should define purpose, retention, access, transparency, and proportionality. Monitoring should not become indiscriminate surveillance. Legal requirements may include privacy, breach notification, records retention, sector-specific controls, and data-transfer restrictions; exact obligations depend on jurisdiction and sector.
Security teams also face ethical decisions when scanning systems, conducting penetration tests, or using deception. Authorization, scope, safety controls, and responsible disclosure are essential. Artificial intelligence can assist anomaly detection, alert triage, malware analysis, and policy review, but generated conclusions require human validation. AI systems may inherit biased data, expose confidential logs, produce false positives, or be manipulated by adversarial inputs.
Contemporary network security increasingly incorporates software-defined policy, cloud-native workload identity, secure access service edge (SASE), extended detection and response, post-quantum cryptography planning, and automated configuration validation. These developments do not eliminate foundational requirements: accurate inventory, least privilege, secure defaults, tested recovery, and accountable governance.
Best-Practice Checklist
Maintain an accurate inventory of assets, identities, software, and data flows.
Model threats before selecting controls.
Segment users, servers, management systems, guests, and sensitive technology.
Use deny-by-default policies where practical and document justified exceptions.
Protect routing and management planes with authentication and restricted access.
Require MFA for privileged and remote access.
Use current TLS and carefully managed PKI; protect private keys.
Apply IPsec or other secure tunnels where network-layer protection is appropriate.
Assess device posture and avoid treating internal location as proof of trust.
Centralize logs, synchronize time, tune detections, and rehearse response.
Prioritize vulnerabilities according to exposure and business impact, not severity alone.
Test backups, recovery procedures, and security configurations.
Review policies, certificates, ACLs, accounts, and exceptions regularly.
Preserve privacy, obtain authorization, and document governance decisions.
Chapter Summary
Network security is a risk-management discipline that protects confidentiality, integrity, availability, identity, and resilience. Threat modeling identifies assets, trust boundaries, attack paths, and required safeguards. Defense in depth combines administrative, technical, and physical controls, while segmentation limits lateral movement and makes policy enforceable. ACLs and firewalls regulate traffic; IDS and IPS provide detection and prevention; secure routing protects infrastructure control planes; and NAC evaluates users and devices before granting access.
PKI establishes trust in public keys, TLS protects application communications, and IPsec protects traffic at the network layer. Zero-trust architecture removes implicit trust based on location and evaluates requests using identity, device posture, resource sensitivity, and contextual risk. Effective security also requires centralized monitoring, incident response, vulnerability management, secure configuration, tested recovery, privacy protection, and continuous review. No individual technology is sufficient: security emerges from coherent architecture, disciplined operations, and accountable governance.
Key Terms
Threat model: Structured representation of assets, threats, vulnerabilities, trust boundaries, and controls.
Attack surface: The set of points through which a system may be attacked.
Defense in depth: Use of multiple complementary security controls.
Segmentation: Division of a network into zones with controlled communication.
ACL: Ordered rules that permit or deny network traffic.
Stateful firewall: Firewall that tracks connection state when evaluating traffic.
IDS: System that detects and reports suspicious activity.
IPS: System that detects and can actively block suspicious activity.
NAC: Technology that controls network access using identity and device posture.
PKI: Framework for issuing, validating, and revoking digital certificates.
TLS: Cryptographic protocol for authenticated and protected application communication.
IPsec: Suite of protocols for protecting IP traffic.
Zero trust: Architecture based on explicit verification, least privilege, and assumed breach.
Least privilege: Granting only the access necessary for an authorized task.
MFA: Authentication using two or more independent factor types.
SIEM: Platform that aggregates and correlates security events.
Vulnerability management: Process of identifying, prioritizing, remediating, and validating weaknesses.
Configuration drift: Unapproved divergence from an established secure baseline.
Incident response: Coordinated process for detecting, containing, eradicating, and recovering from incidents.
Review Questions
Short Answer Questions
What are the three properties of the CIA triad?
Why is a VLAN alone not necessarily a security boundary?
Distinguish an IDS from an IPS.
What problem does PKI solve?
State the central principle of zero-trust architecture.
Long Answer Questions
Explain how threat modeling supports the design of defense in depth.
Compare stateless filtering, stateful firewalls, and application-aware firewalls.
Explain how NAC, MFA, segmentation, and least privilege work together.
Compare TLS and IPsec in terms of layer, use cases, and limitations.
Describe the phases of incident response and the role of evidence preservation.
Analytical / Application Questions
Design security zones and inter-zone policies for a company containing guest Wi-Fi, employee devices, public web servers, databases, and a management network.
A stolen VPN credential is used from an unmanaged device. Propose a zero-trust response using identity, device posture, segmentation, monitoring, and incident-response controls.
A routing device begins advertising an unauthorized default route. Analyze possible consequences and specify preventive, detective, and corrective controls.
Multiple Choice Questions with Answers
Question 1
Which principle is most central to zero-trust architecture?
A. Trust all traffic from internal networks
B. Verify explicitly and apply least privilege
C. Permit traffic after one successful login
D. Replace encryption with segmentation
Correct Answer: B. Verify explicitly and apply least privilege
Question 2
What is the primary purpose of network segmentation?
A. Increase broadcast traffic
B. Eliminate the need for authentication
C. Limit communication and lateral movement
D. Guarantee that hosts cannot be compromised
Correct Answer: C. Limit communication and lateral movement
Question 3
Which technology primarily provides authenticated, encrypted application communication?
A. TLS
B. DNS
C. NTP
D. ARP
Correct Answer: A. TLS
Question 4
Which statement best describes an IPS?
A. It only stores backups
B. It can detect and block suspicious traffic
C. It issues digital certificates
D. It assigns IP addresses
Correct Answer: B. It can detect and block suspicious traffic
Question 5
What does NAC commonly evaluate before granting network access?
A. Only cable length
B. User identity and device posture
C. Only destination port numbers
D. The number of installed printers
Correct Answer: B. User identity and device posture
Question 6
Which control most directly protects routing adjacencies from unauthorized peers?
A. Routing authentication and neighbor restriction
B. Open guest access
C. Disabling all logs
D. Using longer Ethernet cables
Correct Answer: A. Routing authentication and neighbor restriction
Question 7
What is the correct purpose of a certificate authority in PKI?
A. Compress network packets
B. Issue and validate certificates according to policy
C. Replace all firewalls
D. Detect every malware sample
Correct Answer: B. Issue and validate certificates according to policy
Question 8
Which incident-response activity belongs primarily to containment?
A. Isolating a compromised endpoint
B. Writing the original security policy
C. Issuing a server certificate
D. Increasing Wi-Fi bandwidth
Correct Answer: A. Isolating a compromised endpoint
Question 9
Why should vulnerability prioritization consider more than a severity score?
A. Severity scores are always meaningless
B. Exposure, exploitability, and asset impact also affect risk
C. Patching is unrelated to assets
D. All vulnerabilities have identical consequences
Correct Answer: B. Exposure, exploitability, and asset impact also affect risk
Question 10
A firewall rule permits TCP traffic only from an approved application subnet to a database on its required service port. Which principle does this illustrate?