Network and Infrastructure Security

Introduction and Context

Modern organisations depend on networks to connect users, applications, cloud services, industrial systems, suppliers, and customers. This connectivity creates efficiency but also expands the attack surface. A compromise of a single workstation may allow an attacker to move laterally toward file servers, identity systems, databases, or operational technology. Network and infrastructure security therefore focuses not only on preventing unauthorised access, but also on limiting movement, detecting abnormal activity, maintaining reliable services, and recovering safely.

Network security is the protection of data, devices, communications, and services as they move across or operate within interconnected systems. Infrastructure security includes the secure design and administration of routers, switches, firewalls, servers, wireless access points, virtual networks, cloud environments, and supporting management systems.

A useful security design follows the principles of defence in depth, least privilege, secure defaults, separation of duties, fail-safe operation, and continuous monitoring. No individual control is sufficient. A firewall can be misconfigured, credentials can be stolen, and endpoint software can be bypassed. Effective security combines technical controls with governance, trained personnel, documented procedures, and tested response plans.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the role of important network protocols and identify common protocol weaknesses.
2. Describe network segmentation and select suitable segmentation controls.
3. Explain how firewalls, secure configurations, VPNs, intrusion detection, and wireless security protect infrastructure.
4. Apply a risk-based approach to designing a secure network.
5. Analyse a practical infrastructure-security scenario and recommend improvements.
6. Recognise ethical, legal, governance, and operational responsibilities in network defence.

1. Network Models and Security Boundaries

The Open Systems Interconnection (OSI) model divides communication into seven conceptual layers: physical, data link, network, transport, session, presentation, and application. The model is useful for locating faults and controls, although real protocols do not always fit perfectly into one layer. The Internet protocol suite is commonly described using four or five layers: link, internet, transport, and application, with physical functions sometimes treated separately.

Security controls operate at different layers. Physical security protects cabling, server rooms, and network equipment. Data-link controls include switch port security and virtual LANs (VLANs). Network-layer controls include IP routing, access-control lists, and network firewalls. Transport-layer controls restrict ports and connections. Application-layer controls inspect protocols such as HTTP, DNS, and email and may identify malicious content that a basic packet filter cannot understand.

A security boundary is a point at which traffic, identity, trust, or administrative authority changes. Typical boundaries exist between the internet and an organisation, between user and server networks, between corporate and guest wireless networks, and between information technology (IT) and operational technology (OT). Boundaries should be explicit, monitored, and governed by documented rules.

Common Protocols and Their Security Implications

Encryption is not the same as security. HTTPS can protect data in transit, but it does not make a vulnerable web application safe. SSH encrypts administration sessions, but stolen administrator keys still create risk. Security analysis must consider confidentiality, integrity, availability, authentication, authorisation, and accountability together.

2. Threats and Vulnerabilities in Networked Infrastructure

A vulnerability is a weakness that could be exploited. A threat is a potential cause of harm, while risk combines the likelihood of exploitation with its potential impact. Examples include unpatched software, default passwords, excessive network reachability, insecure protocols, exposed management interfaces, poor logging, and unsupported devices.

Common network attacks include:

• Reconnaissance: scanning addresses, ports, services, and versions to identify targets.
• Credential attacks: password spraying, brute force, credential stuffing, and theft of authentication tokens.
• Man-in-the-middle attacks: intercepting or altering communication, especially on untrusted networks.
• Denial-of-service attacks: exhausting bandwidth, CPU, memory, connection tables, or application resources.
• Spoofing: forging an address, identity, or protocol message.
• Lateral movement: using one compromised system to reach additional systems.
• Command-and-control communication: maintaining an attacker’s connection to compromised hosts.
• Misconfiguration exploitation: abusing overly broad firewall rules, exposed storage, or insecure cloud settings.

Risk assessment should identify assets, threats, vulnerabilities, existing controls, and consequences. A simple qualitative model classifies likelihood and impact as low, medium, or high. Quantitative estimates may be useful for larger organisations, but apparent numerical precision should not replace sound evidence and expert judgement.

3. Segmentation and Network Architecture

Segmentation divides a network into security zones so that compromise in one zone does not automatically provide access to all others. Segmentation reduces attack paths, limits broadcast traffic, supports different trust requirements, and makes monitoring more meaningful.

Typical zones include:

• Internet-facing services or a demilitarised zone (DMZ).
• User endpoints.
• Server and application networks.
• Database networks.
• Administrative or management networks.
• Guest wireless networks.
• Voice, building-management, or IoT networks.
• Industrial or OT networks.
• Backup and recovery networks.

A VLAN separates broadcast domains at the switching layer, but a VLAN alone is not a complete security boundary. Routing between VLANs must be controlled by a firewall or access-control policy. Microsegmentation applies more granular rules, often based on workload identity, application role, user identity, or device posture. Software-defined networking and cloud security groups can implement these controls in virtual environments.

A sound segmentation policy follows the principle “deny by default, permit by exception.” For every permitted flow, document the source, destination, protocol, port, business purpose, owner, and review date. Rules should be specific rather than broad. For example, an application server may be permitted to query a particular database service, while direct user access to the database is denied.

Segmentation has limitations. Poorly designed zones can disrupt legitimate operations, encourage workarounds, or create a false sense of safety. Administrators must map dependencies before changing rules and should test changes in stages. Segmentation must also include administrative paths, backups, monitoring systems, and emergency access.

4. Firewalls and Access Control

A firewall enforces traffic rules between networks or hosts. Common types include:

1. Packet-filtering firewalls, which evaluate addresses, protocols, and ports.
2. Stateful firewalls, which track connection state and distinguish expected responses from unsolicited traffic.
3. Application-aware or next-generation firewalls, which may inspect applications, users, content, and encrypted traffic subject to lawful and privacy-respecting controls.
4. Web application firewalls, which protect web applications from selected application-layer attacks.
5. Host-based firewalls, which enforce policy on individual servers or endpoints.
6. Cloud-native controls, such as security groups, network access-control lists, and managed firewall services.

A firewall policy should have a documented purpose, an explicit direction, a narrow scope, logging appropriate to the risk, and an owner. Unused rules should be removed. Temporary rules should have an expiry date. The final rule should normally deny unauthorised traffic, although emergency and availability requirements must be considered carefully.

Firewall logs should record enough information to support detection and investigation, including timestamp, source, destination, protocol, action, and rule identifier. Logs must be protected from alteration, time-synchronised, retained according to policy, and reviewed. Logging everything without analysis can create cost and noise rather than security.

Firewalls cannot reliably prevent attacks delivered through authorised channels, stolen credentials, malicious insiders, or vulnerable applications. They are one layer in a broader control system.

5. Secure Configuration and Infrastructure Hardening

Hardening reduces unnecessary functionality and strengthens required services. A practical hardening process is:

1. Establish an approved baseline for each device or operating system.
2. Remove or disable unnecessary services, accounts, ports, protocols, and software.
3. Change default credentials and use individual administrative identities.
4. Apply security patches through a prioritised and tested process.
5. Enforce secure authentication, including multifactor authentication for privileged access.
6. Restrict management interfaces to dedicated administrative networks or approved jump hosts.
7. Enable encryption, secure logging, time synchronisation, and configuration backup.
8. Validate the configuration using automated checks and periodic review.
9. Monitor drift from the approved baseline.

Configuration management databases, infrastructure-as-code, version control, and change-management records improve consistency. Backups should be protected against unauthorised alteration and ransomware; at least one recovery copy should be logically or physically separated from ordinary administrative access. Restoration must be tested, because an untested backup is only an assumption.

Secure administration should use separate privileged accounts, just-in-time access where feasible, strong authentication, session logging, and least privilege. Network equipment should not be managed directly from the public internet. Administrative credentials must never be embedded in scripts or shared informally.

6. Virtual Private Networks and Remote Access

A virtual private network (VPN) creates an authenticated and encrypted logical connection across an untrusted or shared network. Site-to-site VPNs connect networks, whereas remote-access VPNs connect individual users or devices.

A VPN provides confidentiality and integrity for the protected tunnel, but it does not guarantee that the endpoint is trustworthy. A compromised laptop can carry malware through a VPN into internal systems. Secure remote access therefore combines VPN encryption with identity verification, MFA, device compliance checks, limited routes, segmentation, logging, and session controls.

VPN design decisions include:

• Strong, supported cryptographic protocols and current implementations.
• Certificate or key management with timely revocation.
• Full-tunnel or split-tunnel routing based on risk and operational need.
• Restriction of users to only the systems required for their role.
• Protection against credential replay and automated login attempts.
• Capacity planning and redundancy for availability.

Zero Trust Architecture complements or, in some cases, reduces dependence on broad network VPN access. Its central idea is to verify explicitly, use least privilege, assume breach, and make access decisions using identity, device, resource, and context rather than network location alone.

7. Intrusion Detection and Prevention

An intrusion detection system (IDS) identifies suspicious activity and generates alerts. An intrusion prevention system (IPS) can block or disrupt selected activity inline. Network-based systems inspect traffic at strategic points; host-based systems observe processes, files, logs, and system behaviour on individual devices.

Detection methods include:

• Signature detection: matches known patterns. It is efficient but may miss new variants.
• Anomaly detection: identifies deviations from a baseline. It can detect novel behaviour but may produce false positives.
• Stateful protocol analysis: compares traffic with expected protocol behaviour.
• Behavioural and threat-intelligence correlation: combines events, context, and known indicators.

A detection capability is useful only when alerts are triaged and acted upon. Security teams should define severity, ownership, escalation paths, evidence requirements, and response actions. Baselines should account for legitimate changes such as backups, software deployment, and seasonal workloads.

Encrypted traffic creates a visibility challenge. Organisations may use endpoint telemetry, metadata, secure termination points, or carefully governed inspection. Inspection must respect privacy, legal requirements, and the security of decryption keys. Artificial intelligence and machine learning can help prioritise events and identify unusual patterns, but they do not replace skilled analysts. Models can inherit biased data, be evaded, or generate inaccurate conclusions; human validation remains essential for high-impact decisions.

8. Wireless Network Security

Wireless networks extend the attack surface beyond the physical building. Risks include rogue access points, evil-twin networks, weak encryption, unauthorised devices, credential theft, radio interference, and poor separation between guests and internal systems.

Recommended practices include:

• Use current enterprise-grade wireless security, preferably WPA3-Enterprise where supported; use WPA2-Enterprise as a managed fallback when necessary.
• Prefer 802.1X authentication with a suitable identity infrastructure rather than shared passwords for staff access.
• Separate corporate, guest, IoT, and administrative wireless networks.
• Place guest traffic on an internet-only path with client isolation where appropriate.
• Disable insecure legacy protocols and replace default administrator credentials.
• Manage access points centrally and update their firmware.
• Monitor for rogue devices and unauthorised associations.
• Use certificates carefully, validating server identity to reduce evil-twin attacks.
• Treat wireless security as an access-control problem, not merely a radio configuration problem.

Wireless controls cannot eliminate risks created by compromised clients or insecure applications. Endpoint protection, identity controls, segmentation, and monitoring remain necessary.

9. Applied Case: Regional Health Services Network

Background

This illustrative case concerns a regional healthcare provider with three clinics. Staff use electronic health-record systems, medical devices, cloud email, remote administration, guest Wi-Fi, and a shared file service. The original network placed workstations, printers, servers, and medical devices on a small number of flat networks. Several remote desktop services were reachable from the internet.

Problem

A phishing campaign resulted in the theft of an employee password. The attacker accessed a remote desktop service, installed tooling on a workstation, scanned internal addresses, and reached a file server containing sensitive records. Logging was inconsistent, backups were connected to the production domain, and guest wireless traffic was not clearly separated from internal systems.

Analysis

The primary weaknesses were exposed administration, insufficient MFA, excessive lateral reachability, weak segmentation, poor monitoring, and inadequate backup isolation. The incident also demonstrated that perimeter defence alone was insufficient: once inside, the attacker encountered few barriers.

Approach and Solution

The provider first disabled direct internet exposure of remote administration and required remote access through a monitored VPN with MFA. It created separate zones for clinical systems, user endpoints, servers, medical devices, administration, guest wireless, and backups. Firewall rules were rewritten using documented business flows and a default-deny approach.

The provider then implemented privileged accounts, secure configuration baselines, patch prioritisation, centralised time-synchronised logging, endpoint detection, and alerts for unusual scanning and authentication. Backups were redesigned so that recovery copies were isolated from ordinary domain administration. Wireless networks were separated and enterprise authentication was introduced for staff.

Changes were tested with clinical representatives to avoid disrupting patient care. An incident-response exercise verified that the organisation could isolate a device, preserve evidence, restore essential services, and communicate with regulators and affected individuals if required.

Outcome

The redesigned architecture reduced direct exposure, limited the paths available for lateral movement, improved detection, and increased confidence in recovery. It did not eliminate risk. The organisation continued vulnerability management, access reviews, tabletop exercises, and supplier assessments.

Learning Points

1. Security architecture must reflect business and safety requirements.
2. MFA is especially important for remote and privileged access.
3. Segmentation limits consequences after an initial compromise.
4. Monitoring must be connected to an operational response process.
5. Backups require isolation and restoration testing.
6. Technical controls must be introduced with stakeholder participation and change management.

10. Governance, Ethics, and Professional Practice

Network monitoring can collect personal information, communications metadata, location data, and employee activity. Monitoring must have a legitimate purpose, be proportionate, be communicated through appropriate policies, and comply with applicable privacy and employment law. Access to logs should be restricted and audited.

Security professionals must obtain authorisation before scanning or testing systems. Unauthorised penetration testing may disrupt services or violate computer misuse laws. Responsible disclosure requires reporting vulnerabilities to the appropriate owner, allowing reasonable remediation time, and avoiding unnecessary exposure of sensitive details.

Organisations should align controls with recognised frameworks and obligations relevant to their environment, such as the NIST Cybersecurity Framework, ISO/IEC 27001, sector-specific requirements, and data-protection law. Frameworks support consistent governance but do not replace risk assessment. Suppliers and cloud providers should be evaluated for identity management, logging, incident notification, data location, resilience, and secure decommissioning.

11. Contemporary Developments and Best Practices

Infrastructure is increasingly hybrid, combining on-premises systems, public cloud, SaaS, containers, mobile devices, and edge computing. This makes identity, API security, workload protection, and continuous configuration assessment increasingly important. Network policy may be expressed through software and automatically deployed, which improves consistency but makes testing and code review essential.

A practical programme should:

• Maintain an accurate asset and dependency inventory.
• Classify data and systems by sensitivity and operational importance.
• Use secure architecture reviews before deployment.
• Apply least privilege, MFA, segmentation, and secure defaults.
• Patch according to risk and verify remediation.
• Protect and analyse centralised logs.
• Test backups, failover, and incident-response procedures.
• Review firewall, VPN, wireless, and privileged-access rules regularly.
• Measure meaningful outcomes, such as time to detect, time to contain, exposure of critical services, and recovery performance.
• Train staff and improve controls after exercises and incidents.

Chapter Summary

Network and infrastructure security protects communication, devices, services, and the trust relationships that connect them. Protocol knowledge helps professionals recognise risks such as clear-text credentials, spoofing, exposed services, and insecure management. Segmentation divides infrastructure into controlled zones and limits lateral movement, while firewalls enforce explicit traffic policies. Secure configuration, patching, privileged-access management, protected backups, and logging strengthen individual systems and the wider environment. VPNs secure remote connections but must be combined with MFA, endpoint assurance, and least privilege. IDS and IPS technologies support detection and prevention, provided alerts are analysed and connected to response. Wireless security requires strong authentication, network separation, central management, and monitoring. Effective practice also includes privacy, authorisation, governance, supply-chain oversight, and continuous improvement.

Key Terms

Asset: A device, service, data set, or capability that has value to an organisation.

Attack surface: The collection of points through which a system may be attacked.

DMZ: A controlled network zone for services that must be reachable from less-trusted networks.

Firewall: A control that permits or blocks traffic according to security rules.

Hardening: Reducing weaknesses by removing unnecessary functions and applying secure settings.

IDS: An intrusion detection system that identifies and reports suspicious activity.

IPS: An intrusion prevention system that can block selected suspicious activity.

Lateral movement: An attacker’s progression from one compromised system to additional systems.

Least privilege: Providing only the access required for an authorised task.

Microsegmentation: Fine-grained separation based on workload, identity, application, or context.

MFA: Authentication requiring two or more independent factors.

Network segmentation: Dividing a network into zones with controlled communication between them.

Rogue access point: An unauthorised wireless access point connected to or imitating an organisational network.

Security baseline: An approved minimum configuration for a system or device.

Stateful inspection: Firewall analysis that tracks the state of network connections.

VPN: An authenticated, encrypted logical connection across an untrusted network.

VLAN: A logical local-area network that separates broadcast domains on switching infrastructure.

Zero Trust: An approach that verifies access explicitly, applies least privilege, and assumes that compromise is possible.

Review Questions

Short Answer Questions

1. What is the purpose of network segmentation?
2. Why is a VLAN alone not necessarily a complete security boundary?
3. Distinguish an IDS from an IPS.
4. State two security benefits of MFA for remote access.
5. Why should backups be isolated and restoration-tested?

Long Answer Questions

1. Explain how the OSI model helps a security professional analyse network controls and vulnerabilities.
2. Compare packet-filtering, stateful, application-aware, host-based, and web application firewalls.
3. Describe a secure hardening process for a network device or server.
4. Explain the security and operational considerations in designing a remote-access VPN.
5. Discuss how wireless security should combine authentication, segmentation, endpoint security, and monitoring.

Analytical / Application Questions

1. A company has user workstations, finance servers, development systems, printers, and guest Wi-Fi on one flat network. Design a zone structure and explain the traffic that should be permitted between zones.
2. An IDS generates many alerts whenever the backup system runs. Analyse possible causes and propose a process for reducing false positives without disabling useful detection.
3. A small organisation wants to expose RDP directly to the internet because employees need remote access. Evaluate the proposal and recommend a safer architecture, including authentication, segmentation, monitoring, and contingency arrangements.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the main purpose of network segmentation?

A. To increase the physical length of network cables

B. To limit reachability and reduce lateral movement after compromise

C. To eliminate the need for endpoint security

D. To ensure every device uses the same security policy

Correct Answer: B. To limit reachability and reduce lateral movement after compromise

Question 2

Which protocol is the preferred replacement for Telnet for secure remote administration?

A. FTP

B. HTTP

C. SSH

D. SNMPv1

Correct Answer: C. SSH

Question 3

What is the defining capability of a stateful firewall?

A. It tracks the state of network connections

B. It physically disconnects all wireless devices

C. It replaces the need for authentication

D. It encrypts every file stored on a server

Correct Answer: A. It tracks the state of network connections

Question 4

Which control most directly reduces the risk of stolen remote-access passwords being used alone?

A. Network address translation

B. Multifactor authentication

C. A larger IP address range

D. Disabling system logging

Correct Answer: B. Multifactor authentication

Question 5

What is a major limitation of signature-based intrusion detection?

A. It cannot inspect any network traffic

B. It always blocks legitimate activity

C. It may miss previously unknown attack variants

D. It requires all traffic to be wireless

Correct Answer: C. It may miss previously unknown attack variants

Question 6

Which wireless design is most appropriate for visitors?

A. Place guest devices on the database VLAN

B. Give guests administrative credentials

C. Use an internet-only guest network separated from internal systems

D. Allow guests to access network-management interfaces

Correct Answer: C. Use an internet-only guest network separated from internal systems

Question 7

Why is a firewall rule with a documented owner and review date preferable to a permanent broad rule?

A. It supports accountability and removal of unnecessary access

B. It guarantees that no attack can succeed

C. It removes the need for firewall logs

D. It makes all traffic anonymous

Correct Answer: A. It supports accountability and removal of unnecessary access

Question 8

Which statement about a VPN is most accurate?

A. A VPN guarantees that a connecting endpoint is malware-free

B. A VPN provides an authenticated and encrypted logical connection but still requires endpoint and access controls

C. A VPN makes segmentation unnecessary

D. A VPN prevents all denial-of-service attacks

Correct Answer: B. A VPN provides an authenticated and encrypted logical connection but still requires endpoint and access controls

Question 9

Which practice best protects network-device administration?

A. Expose management interfaces directly to the internet

B. Use shared administrator passwords

C. Restrict management to an administrative network and use individual privileged accounts

D. Disable configuration backups

Correct Answer: C. Restrict management to an administrative network and use individual privileged accounts

Question 10

What is the principal security value of an isolated backup copy?

A. It guarantees unlimited storage capacity

B. It reduces the chance that production compromise will destroy recovery data

C. It removes the need to test restoration

D. It makes data classification unnecessary

Correct Answer: B. It reduces the chance that production compromise will destroy recovery data