12. Network Security and Resilience

Introduction and Context

Computer networks support financial transactions, industrial operations, healthcare services, public administration, scientific collaboration, and data-intensive applications. Their value also makes them attractive targets. A network may be compromised through stolen credentials, vulnerable software, malicious insiders, misconfigured cloud services, supply-chain attacks, or failures of power and connectivity. Network security therefore cannot be reduced to installing a firewall. It is the coordinated protection of communication, computation, identity, data, and operational continuity.

Security and resilience are related but distinct. Security seeks to prevent, detect, and limit unauthorized or harmful activity. Resilience is the ability of an organization and its technical systems to continue essential operations, absorb disruption, recover reliably, and adapt after an incident. A resilient network assumes that some controls will fail and designs for containment, redundancy, recovery, and learning.

For data science professionals, this subject has particular importance. Data pipelines depend on trusted sources, secure APIs, reliable infrastructure, and controlled access to sensitive datasets. An insecure network can corrupt training data, expose personally identifiable information, manipulate analytical results, or interrupt model deployment. Network security is consequently both a technical discipline and a strategic organizational capability.

Learning Objectives

After completing this chapter, the learner should be able to:

1. Explain the security objectives of confidentiality, integrity, availability, authenticity, and accountability.

2. Identify assets, threats, vulnerabilities, risks, and controls using a threat-modelling approach.

3. Distinguish major cryptographic mechanisms and select appropriate uses for encryption, hashing, digital signatures, and certificates.

4. Describe authentication, authorization, TLS, VPNs, firewalls, intrusion detection, segmentation, and zero-trust access.

5. Design a layered security and resilience strategy for a networked organization.

6. Evaluate operational, ethical, governance, and regulatory implications of security decisions.

7. Apply incident-response and recovery principles to a realistic network compromise.

Security as a Risk and Design Problem

The classical security objectives are often summarized as the CIA triad. Confidentiality prevents unauthorized disclosure; integrity protects information and systems from unauthorized alteration; and availability ensures that authorized users can access services when required. Modern practice adds authenticity—the confidence that an entity or message is genuine—and accountability, which links actions to responsible identities through reliable records.

A risk exists when a threat can exploit a vulnerability and produce an undesirable impact. A simplified expression is:

Risk = likelihood of an event × consequence of the event.

This expression is not a precise probability formula in every organizational setting, but it encourages explicit reasoning. For example, an exposed administrative interface may have a high likelihood of attack and a severe consequence, whereas a non-critical test server may have lower business impact. Risk assessment should consider not only technical damage but also legal obligations, safety, reputation, financial loss, and interruption of essential services.

Important terminology includes the following. An asset is something valuable, such as a database, identity service, application, or communication link. A threat is a potential cause of harm. A vulnerability is a weakness that can be exploited. An attack is an actual attempt to exploit a weakness. A control is a safeguard intended to reduce likelihood or impact. Residual risk is the risk remaining after controls are applied.

Threat modelling

Threat modelling is a structured method for anticipating how a system could be attacked or fail. A practical process begins by defining scope and business objectives. The analyst then identifies assets, trust boundaries, data flows, entry points, dependencies, and privileged operations. Threats are classified, risks are prioritized, and mitigations are selected. The model should be revised when architecture, suppliers, applications, or threat conditions change.

The STRIDE model is useful for classifying threats: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Attack trees provide another approach by representing an attacker’s objective and the combinations of actions needed to achieve it. The cyber kill chain and MITRE ATT&CK are commonly used to describe adversary behaviour from initial access through execution, persistence, lateral movement, and exfiltration. These models are complementary rather than competing; the appropriate choice depends on whether the organization is analysing design weaknesses, attack sequences, or observed behaviour.

Threat modelling is most valuable early in system design, but it should continue throughout the lifecycle. A model that ignores identity providers, cloud control planes, remote workers, application programming interfaces, and third-party services will give a false sense of security.

Cryptography: Protection Through Mathematical Controls

Cryptography transforms information so that only authorized parties can use or verify it. It does not compensate for weak identity management, poor key protection, or insecure endpoints. The central operational problem is often not the choice of algorithm but the generation, storage, rotation, revocation, and recovery of keys.

Symmetric encryption uses the same secret key to encrypt and decrypt data. It is computationally efficient and is therefore used for bulk traffic and storage encryption. Algorithms such as AES are examples of symmetric encryption. A secure mode of operation must also provide integrity, as in authenticated encryption modes such as AES-GCM or ChaCha20-Poly1305. Encryption without integrity may allow an attacker to alter ciphertext without immediate detection.

Asymmetric cryptography uses a mathematically related public and private key. The public key may be distributed, while the private key must remain protected. Public-key systems support secure key exchange, digital signatures, and certificate-based authentication, although they are generally slower than symmetric encryption. In practice, secure protocols use asymmetric techniques to establish or authenticate a session and symmetric techniques to protect the resulting traffic.

Hash functions produce fixed-length digests of data. A secure cryptographic hash is designed to make it computationally difficult to recover the original input or find another input with the same digest. Hashes support integrity checking and digital signatures, but a plain hash is not encryption and does not provide secrecy. Passwords should not be stored as ordinary hashes. They should be processed with a deliberately slow, salted password-hashing function such as Argon2, scrypt, or an appropriately configured bcrypt implementation.

A digital signature is created with a private key and verified with the corresponding public key. It provides evidence of integrity, origin, and—subject to the surrounding identity and legal framework—non-repudiation. A certificate binds a public key to an identity through a certificate authority. Public key infrastructure manages certificates, trust chains, issuance, renewal, revocation, and policy. Certificate compromise, weak validation, and failure to monitor expiry can undermine an otherwise sound design.

Key management deserves explicit governance. Keys should have owners, defined lifetimes, restricted access, backup and recovery procedures, and auditable use. Secrets should not be embedded in source code or shared through informal messaging. Hardware security modules or managed key services may protect high-value keys, but they introduce dependency, cost, and configuration considerations.

Identity, Authentication, and Authorization

Network security increasingly depends on identity rather than physical location. Authentication answers “Who or what is requesting access?” Authorization answers “What is that identity permitted to do?” Accounting records what occurred. Confusing authentication with authorization is a common design error: successfully proving identity must not automatically grant broad privileges.

Authentication factors are commonly grouped as something the user knows, has, or is. Passwords are knowledge factors; hardware security keys and authenticator applications are possession factors; fingerprints and facial characteristics are inherence factors. Multi-factor authentication combines independent factors. A second password or a security question is not a strong independent factor because both are knowledge-based. Phishing-resistant methods, particularly cryptographic security keys and passkeys, reduce the risk of credential replay.

Authorization models should reflect business responsibility and data sensitivity. Role-based access control grants permissions according to job roles. Attribute-based access control evaluates attributes such as user, resource, location, device health, time, and transaction context. The principle of least privilege grants only the access needed for a defined task. Separation of duties prevents one person or process from controlling an entire sensitive workflow. Privileged access management adds approval, time limitation, session recording, and stronger authentication to administrative operations.

Identity systems must include lifecycle management. Joiner, mover, and leaver processes should create, modify, and remove access promptly. Service accounts require owners, restricted permissions, non-interactive use where possible, and credential rotation. Identity federation can simplify access across organizations, but trust relationships and token validation must be carefully governed.

Securing Communication: TLS and VPNs

Transport Layer Security protects application communication against eavesdropping, tampering, and impersonation when correctly configured. During a TLS handshake, the parties negotiate protocol parameters, authenticate a server through a certificate, and establish shared session keys. After the handshake, symmetric encryption protects application data. TLS does not make a compromised endpoint trustworthy, nor does it guarantee that the user is interacting with a legitimate business service if application-level fraud or a malicious browser extension is involved.

Secure TLS deployment requires current protocol versions, strong cipher suites, valid certificates, correct hostname validation, secure private-key storage, and removal of obsolete algorithms. Certificate automation reduces expiry failures, but automated issuance must be monitored and constrained. Mutual TLS may authenticate both client and server and is useful for service-to-service communication, although certificate distribution and revocation become more complex.

A virtual private network creates an authenticated and encrypted tunnel across an untrusted network. Remote-access VPNs connect users or devices to organizational resources; site-to-site VPNs connect network locations. IPsec and modern VPN protocols can provide strong protection, but a VPN is not a substitute for authorization or endpoint security. If a compromised device receives broad network access through a VPN, the tunnel may increase the attacker’s reach. Modern designs therefore combine VPNs with device posture checks, segmentation, least privilege, and continuous monitoring.

Firewalls, Detection, and Segmentation

A firewall enforces traffic policy between network zones. Packet-filtering firewalls evaluate addresses, ports, and protocols. Stateful firewalls track connection state. Next-generation firewalls may add application identification, user context, and content inspection. Web application firewalls focus on HTTP-based attacks, while cloud-native controls may operate through security groups, network policies, and service meshes.

A firewall rule should have a business justification, a defined owner, a narrow scope, logging requirements, and a review or expiry date. “Allow any” rules and obsolete exceptions create hidden attack paths. Logging every packet is not automatically useful; logs should support detection, investigation, and compliance without overwhelming analysts or exposing unnecessary personal information.

Intrusion detection systems monitor for suspicious activity, while intrusion prevention systems can block or disrupt it. Network-based detection observes traffic, whereas host-based detection observes processes, files, and system events. Signature-based detection is effective for known patterns but may miss novel attacks. Behavioural and anomaly-based detection can identify deviations, but it may generate false positives and requires a meaningful baseline. Security information and event management platforms correlate events from firewalls, identity systems, endpoints, applications, and cloud services.

Segmentation limits blast radius. Traditional segmentation uses subnets, routing, and firewalls. Microsegmentation applies policy at a finer level, often between workloads or services. A well-designed segment is based on trust and business function rather than merely physical location. For example, a payment database, analytical sandbox, employee workstation network, and public web tier should not share unrestricted connectivity. Segmentation is effective only when management paths, backup systems, name resolution, and administrative credentials are also considered.

Zero Trust and Resilient Architecture

Zero trust is an architectural principle, not a single product. It rejects implicit trust based solely on network location and requires explicit verification of users, devices, applications, and requests. Common principles include verify explicitly, use least privilege, assume breach, and continuously evaluate access.

A zero-trust decision may consider identity assurance, device health, requested resource, data sensitivity, behavioural signals, and risk. Access can be limited to a specific application rather than an entire network. Policies should be understandable and testable; excessive dependence on opaque risk scores can create unfair denial, operational confusion, or undetected bypasses.

Resilience requires more than prevention. Critical services should have redundancy, tested backups, alternative communication paths, graceful degradation, capacity planning, and documented recovery objectives. The recovery time objective specifies how quickly a service should be restored; the recovery point objective specifies the acceptable amount of data loss measured in time. Backups must be protected from ransomware, regularly tested, and separated from ordinary administrative credentials. A backup that has never been restored is an assumption rather than a proven recovery capability.

Availability design involves trade-offs. Redundancy increases cost and operational complexity. Strong isolation can slow collaboration. Aggressive inspection can add latency. Centralized identity simplifies policy but creates a high-value dependency. Strategic security decisions should therefore align controls with business criticality and explicitly accept, transfer, reduce, or avoid risk.

Incident Response as an Operational Capability

Incident response begins before an incident. Preparation includes defined roles, contact lists, logging, forensic readiness, communication procedures, legal guidance, and rehearsals. A commonly used lifecycle is preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

Detection should establish whether an alert represents malicious activity, determine scope, preserve evidence, and identify affected identities, systems, and data. Containment may be short-term, such as isolating a host, or strategic, such as disabling a vulnerable service. Eradication removes malicious persistence and addresses the exploited weakness. Recovery restores systems in a controlled order, validates integrity, and increases monitoring. Post-incident review should examine control failures and process weaknesses without turning the investigation into blame allocation.

Evidence handling matters when disciplinary, contractual, or legal action is possible. Investigators should document times, sources, actions, chain of custody, and the limitations of conclusions. Communication should be accurate, timely, and coordinated. Concealing material breaches or making unsupported public claims can increase harm and regulatory exposure.

Illustrative Case: Ransomware in a Data Analytics Organization

Background

A fictional regional logistics company operates a central data platform that receives shipment information from warehouses, mobile applications, and external partners. Analysts use a cloud-based environment, while operational systems remain connected through a corporate network. Remote administrators access infrastructure through a VPN.

Situation and problem

An employee’s password is obtained through phishing. The account lacks phishing-resistant multi-factor authentication and has access to a broad internal address range. The attacker enters through the VPN, discovers an unpatched file server, steals service-account credentials, and encrypts shared storage. Some analytical dashboards become unavailable, and the attacker threatens to publish copied personnel and customer data.

Analysis

The incident reflects several interacting weaknesses rather than one isolated failure. Authentication relied on a reusable password; VPN access was treated as a trusted gateway; network segmentation was weak; service-account privileges were excessive; patch management had no effective exception process; and backups were reachable using ordinary administrative credentials. Monitoring detected unusual encryption activity only after many systems were affected.

Strategy and solution

The response team first isolated affected hosts, disabled the compromised account, blocked suspicious VPN sessions, and preserved relevant logs and disk images. It separated operational systems from the analytical environment and used clean administrative workstations for recovery. Legal, executive, privacy, and communications teams assessed notification and contractual obligations.

Recovery proceeded from offline, tested backups after malware persistence was investigated. The organization rotated service credentials, patched the vulnerable server, enforced phishing-resistant multi-factor authentication for administrators, and reduced VPN access to approved applications. It introduced privileged access management, microsegmentation between data services, continuous monitoring for abnormal encryption, and quarterly restoration exercises.

Outcome

The company restored priority reporting and operational services in stages. It could not eliminate all disruption or conclusively prove that no data had been copied, so it treated the possibility as a significant incident and followed its notification procedures. A post-incident review changed performance measures from “number of blocked attacks” to recovery time, privileged-access coverage, backup restoration success, and time to revoke compromised identities.

Learning points

The case demonstrates that resilience depends on the interaction of identity, segmentation, detection, backup protection, and governance. A VPN, firewall, or backup system can each be present while the overall architecture remains fragile. Effective improvement addresses attack paths and recovery assumptions rather than merely adding isolated tools.

Challenges, Ethics, and Governance

Security controls can create surveillance, exclusion, and privacy risks. Continuous monitoring may collect location, behavioural, or personal information beyond what is necessary. Organizations should define purpose, minimize collection, restrict access, retain data for justified periods, and provide oversight. Biometric authentication requires particular care because compromised biometric traits cannot be replaced like passwords.

Security decisions can also distribute harm unevenly. Automated access scoring may deny legitimate users, while aggressive fraud controls may disadvantage people with limited connectivity or disabilities. Human review, transparency, appeal mechanisms, and testing for disparate effects are important governance measures.

Regulatory obligations vary by sector and jurisdiction, but commonly include protection of personal data, breach notification, access control, retention, auditability, and supplier oversight. Compliance is not equivalent to security. A compliant control may be poorly implemented, and a valuable control may not be explicitly required by a regulation. Boards and senior managers should assign accountability, fund risk reduction, review critical dependencies, and receive meaningful measures rather than technical activity counts.

Third-party and software supply-chain risks require contractual security requirements, dependency inventories, vulnerability disclosure processes, code-signing controls, and assurance evidence proportionate to criticality. Cloud responsibility must also be understood: providers secure parts of the underlying service, while customers remain responsible for identity, configuration, data, and often workload security.

Contemporary Developments and Best Practices

Current security practice is moving toward passwordless authentication, software-defined and identity-aware perimeters, confidential computing, automated certificate and secret management, and security operations supported by machine learning. Artificial intelligence can help correlate events, summarize investigations, detect unusual behaviour, and prioritize vulnerabilities. It can also produce false positives, amplify biased signals, expose sensitive logs, or be manipulated by adversaries. Human validation and controlled data handling remain necessary.

Organizations should maintain an asset and dependency inventory; model threats before major deployments; enforce strong, phishing-resistant authentication; apply least privilege; encrypt data in transit and at rest; segment critical services; patch according to risk; centralize and protect logs; test detection; maintain immutable or offline backups; rehearse incident response; and measure restoration, not merely prevention. Policies should be reviewed after architectural change, near misses, incidents, and changes in legal or business requirements.

Chapter Summary

Network security and resilience require a layered, risk-informed approach. Threat modelling identifies assets, trust boundaries, attack paths, and appropriate controls. Cryptography protects confidentiality and integrity when algorithms, certificates, and keys are managed correctly. Authentication and authorization must be separated, strongly verified, and governed through the identity lifecycle. TLS and VPNs protect communication but do not replace endpoint security, segmentation, or least privilege.

Firewalls, intrusion detection, logging, and segmentation reduce exposure and help identify attacks. Zero-trust architecture removes implicit location-based trust and evaluates each request according to identity, device, resource, and context. Resilience adds redundancy, protected backups, recovery objectives, incident response, and organizational learning. Strategic practice balances security, availability, privacy, cost, usability, regulation, and ethical responsibility.

Key Terms

Confidentiality: Protection against unauthorized disclosure of information.

Integrity: Assurance that data and systems are not altered improperly.

Availability: Ability of authorized users to access services when needed.

Threat: A potential source or cause of harm to an asset.

Vulnerability: A weakness that may be exploited by a threat.

Risk: The combination of the likelihood and consequence of an adverse event.

Threat modelling: Structured analysis of assets, attack paths, threats, and mitigations.

Symmetric encryption: Encryption using the same secret key for encryption and decryption.

Asymmetric cryptography: Cryptography using related public and private keys.

Hash function: A function that produces a fixed-length digest from input data.

Digital signature: A cryptographic mechanism for verifying origin and integrity.

Certificate authority: A trusted entity that issues and validates digital certificates.

Multi-factor authentication: Authentication using independent categories of evidence.

Least privilege: Granting only the access necessary for an authorized task.

Transport Layer Security: A protocol suite that authenticates endpoints and protects communication.

Virtual private network: An authenticated, encrypted tunnel across an untrusted network.

Network segmentation: Dividing a network into zones with controlled communication.

Zero trust: A security approach requiring explicit, continuous verification rather than implicit trust.

Recovery time objective: The target time for restoring a service after disruption.

Recovery point objective: The maximum acceptable time-based loss of data.

Review Questions

Short Answer Questions

1. Distinguish confidentiality, integrity, and availability with one network example for each.

2. What is the difference between authentication and authorization?

3. Why is a cryptographic hash not a substitute for encryption?

4. State two purposes of network segmentation.

5. Define recovery time objective and recovery point objective.

Long Answer Questions

1. Explain the threat-modelling process and show how STRIDE can support analysis of a data platform.

2. Compare symmetric encryption, asymmetric cryptography, hashing, and digital signatures in terms of purpose and use.

3. Discuss how TLS, VPNs, firewalls, and segmentation contribute to layered network protection.

4. Explain zero-trust principles and evaluate their strategic advantages and implementation difficulties.

5. Describe the complete incident-response lifecycle, including the relationship between containment, recovery, and post-incident learning.

Analytical / Application Questions

1. A university grants all VPN users access to its entire internal network. Analyse the risks and propose a redesigned access model using identity, segmentation, and device verification.

2. A company has encrypted backups but stores the decryption keys on the same administrative server used to manage production systems. Evaluate the resilience of this arrangement and recommend improvements.

3. A security operations team receives thousands of anomaly alerts but rarely investigates them. Design a practical improvement plan that addresses detection quality, logging, staffing, metrics, and incident-response readiness.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. The risk that exists before any controls are applied

B. The risk remaining after controls have been implemented

C. The risk caused only by external attackers

D. The risk that can never produce business impact

Correct Answer: B. The risk remaining after controls have been implemented

Question 2

A system uses encryption but accepts modified ciphertext without detecting the modification. Which security property is most directly missing?

A. Availability

B. Integrity

C. Anonymity

D. Non-repudiation

Correct Answer: B. Integrity

Question 3

Which practice most directly provides phishing-resistant authentication?

A. Using two different passwords

B. Using a security key based on public-key cryptography

C. Increasing password length only

D. Answering personal security questions

Correct Answer: B. Using a security key based on public-key cryptography

Question 4

What is the primary purpose of a digital certificate in TLS?

A. To compress application data

B. To bind a public key to an authenticated identity

C. To replace all firewall rules

D. To store a user's password

Correct Answer: B. To bind a public key to an authenticated identity

Question 5

Why should a VPN not automatically be treated as a trusted internal network?

A. VPNs cannot encrypt traffic

B. VPNs work only on local networks

C. A compromised endpoint could use the tunnel to reach excessive resources

D. VPNs prevent all forms of authentication

Correct Answer: C. A compromised endpoint could use the tunnel to reach excessive resources

Question 6

Which design best reflects zero-trust principles?

A. Allowing all traffic from the corporate subnet

B. Granting permanent administrator access to VPN users

C. Evaluating identity, device condition, resource, and context for each request

D. Disabling monitoring after successful login

Correct Answer: C. Evaluating identity, device condition, resource, and context for each request

Question 7

An organization wants to limit the spread of ransomware from an employee workstation to a payment database. Which control is most directly relevant?

A. Network segmentation with restricted inter-zone policies

B. A longer company name

C. Removing all system logs

D. Using one shared administrator account

Correct Answer: A. Network segmentation with restricted inter-zone policies

Question 8

Which recovery measure most strongly protects backups from ransomware that compromises ordinary administrator credentials?

A. Keeping backups on the same writable production share

B. Using offline or immutable backups with separate administrative control

C. Disabling backup testing

D. Publishing backup credentials in documentation

Correct Answer: B. Using offline or immutable backups with separate administrative control

Question 9

During incident response, what is the most appropriate reason to preserve logs and forensic images before extensive system changes?

A. To increase the attacker's persistence

B. To support scope analysis, evidence handling, and reliable conclusions

C. To avoid notifying relevant stakeholders

D. To eliminate the need for containment

Correct Answer: B. To support scope analysis, evidence handling, and reliable conclusions

Question 10

Which metric most directly demonstrates resilience rather than merely preventive activity?

A. Number of security posters displayed

B. Number of firewall rules created

C. Successful restoration time from a tested protected backup

D. Number of employees who changed offices

Correct Answer: C. Successful restoration time from a tested protected backup