Network and Infrastructure Security

Introduction

Modern organizations depend on interconnected networks, cloud platforms, data centers, wireless systems, and remote-access technologies. This connectivity creates value but also expands the attack surface. Network and infrastructure security is the discipline of protecting the confidentiality, integrity, availability, authenticity, and accountability of communications and computing resources.

A secure network is not simply one that blocks unauthorized packets. It is an engineered system that identifies assets, separates trust zones, authenticates users and devices, limits privileges, detects abnormal behavior, withstands disruption, and supports investigation after an incident. Security controls must therefore be selected in relation to business requirements, threat models, architecture, and applicable law.

Learning Objectives

After completing this chapter, students should be able to:

• explain the security properties and roles of major network protocols;
• analyze common network attacks and their prerequisites;
• describe the design and limitations of firewalls, secure routing, VPNs, and IDS/IPS;
• recommend protections for DNS, email, wireless networks, and remote access;
• design a conceptual segmented network using zones and policy boundaries;
• evaluate operational, ethical, governance, and availability implications of infrastructure controls.

1. Network Security Foundations

1.1 Security properties

The traditional CIA triad consists of:

• Confidentiality: information is disclosed only to authorized parties.
• Integrity: information and system states are not altered improperly.
• Availability: authorized users can access resources when required.

Practical security also requires authenticity, non-repudiation, accountability, and resilience. For example, encryption may provide confidentiality, but it does not by itself prove that the communicating endpoint is genuine. Authentication and certificate validation are also necessary.

1.2 Trust boundaries and attack surface

A trust boundary is a point where data or authority moves between systems with different security assumptions. Examples include an Internet-to-corporate boundary, a user-to-server boundary, and a cloud-to-on-premises boundary. The attack surface is the collection of reachable interfaces, services, accounts, protocols, dependencies, and physical access points that could be abused.

A useful design principle is least privilege: users, processes, and network flows should receive only the access necessary for a defined purpose. Another is fail-safe behavior: when a control cannot make a trustworthy decision, it should normally deny access or reduce privilege, while preserving safety and essential availability.

2. Protocols and Their Security Characteristics

2.1 Layered communication

The OSI model is a conceptual framework consisting of physical, data-link, network, transport, session, presentation, and application layers. The TCP/IP model commonly groups these into link, Internet, transport, and application layers. Layering simplifies design, but security failures can arise when an attacker exploits assumptions between layers.

At the Internet layer, IP provides addressing and packet delivery but does not inherently provide confidentiality or endpoint authentication. TCP provides reliable, ordered transport; UDP provides lightweight datagrams without TCP’s connection guarantees. Neither protocol should be treated as an authentication mechanism.

At the application layer, HTTP should generally be protected with HTTPS, which uses TLS. SSH is preferred over Telnet for secure administration. SFTP or secure file-transfer mechanisms are preferred over unprotected FTP. SNMPv3 provides stronger authentication and privacy than earlier SNMP versions. NTP should be authenticated where time integrity is important, because inaccurate time can disrupt certificates, logs, and authentication systems.

2.2 Encryption and authentication

Encryption transforms plaintext into ciphertext using a key. Symmetric encryption uses the same secret key for encryption and decryption and is efficient for bulk traffic. Asymmetric cryptography uses a public/private key pair and supports key exchange and digital signatures, but is computationally more expensive. Modern protocols combine both: asymmetric methods establish or authenticate a session key, and symmetric cryptography protects the resulting data stream.

TLS security depends on more than selecting an algorithm. It requires certificate validation, protection of private keys, secure protocol versions, suitable cipher suites, correct hostname checking, and timely revocation or replacement. A certificate that is expired, issued to the wrong name, or trusted without validation does not provide reliable authentication.

2.3 Common insecure protocols

Legacy protocols such as Telnet, FTP, HTTP, POP3, and IMAP without TLS may expose credentials or content. Address Resolution Protocol (ARP) lacks strong authentication on many local networks, allowing spoofing attacks. DNS was originally designed for availability and naming rather than confidentiality or authenticated responses; modern extensions and encrypted DNS improve particular properties but do not eliminate all DNS threats.

3. Common Network Attacks

3.1 Reconnaissance and scanning

Attackers first gather information through passive observation, public records, search engines, DNS queries, and leaked credentials. Active scanning probes ports, services, versions, and operating-system behavior. Defensive measures include asset inventories, reduction of unnecessary exposure, rate monitoring, secure configuration, and responsible vulnerability management. Scanning itself can be legitimate administration or unauthorized reconnaissance; authorization and scope are essential.

3.2 Spoofing and man-in-the-middle attacks

Spoofing occurs when an attacker falsifies an identity or address, such as a source IP, MAC address, DNS response, email sender, or wireless access point. In a man-in-the-middle attack, the adversary positions itself between communicating parties and relays or modifies traffic. TLS certificate validation, mutual authentication, secure switching features, authenticated routing, and user awareness reduce this risk.

3.3 Denial of service

A denial-of-service attack attempts to exhaust bandwidth, connection tables, CPU, memory, application resources, or a dependency such as DNS. Distributed denial-of-service attacks use many source systems. Defenses include rate limiting, upstream filtering, anycast or distributed service design, caching, resilient capacity, traffic scrubbing, and tested continuity plans. Filtering alone cannot solve an attack that exceeds the organization’s Internet link capacity; upstream assistance may be required.

3.4 Credential and application attacks

Password spraying tries a small number of common passwords against many accounts, reducing lockout visibility. Credential stuffing reuses credentials exposed in another breach. Phishing deceives users into revealing credentials or approving malicious actions. Web attacks may exploit injection, broken access control, insecure deserialization, or vulnerable components. Network controls are valuable, but secure application development, multifactor authentication, patching, and monitoring are equally important.

3.5 Malware, lateral movement, and command-and-control

After initial compromise, attackers may move laterally through excessive trust, stolen administrator credentials, weak segmentation, or unpatched services. They may communicate with command-and-control infrastructure through DNS, HTTPS, cloud services, or custom protocols. Endpoint detection, privileged-access management, egress filtering, segmentation, and behavioral monitoring help contain such activity.

4. Firewalls and Policy Enforcement

A firewall controls traffic between interfaces or security zones according to policy. A traditional packet-filtering firewall evaluates addresses, protocols, and ports. A stateful firewall also tracks connection state, allowing return traffic for an established permitted connection. A next-generation firewall may add application identification, user context, intrusion prevention, and content inspection.

A sound firewall policy follows these principles:

1. deny by default where operationally feasible;
2. allow only documented business flows;
3. restrict both source and destination, not merely port number;
4. place specific rules before broad rules;
5. log meaningful denied and permitted events without overwhelming monitoring systems;
6. review rules periodically and remove obsolete exceptions;
7. separate administrative access from ordinary user traffic.

Firewalls have limitations. They may not detect attacks inside permitted protocols, malicious activity encrypted end-to-end, compromised trusted hosts, or abuse by authorized users. A firewall is therefore one layer in defense in depth, not a substitute for secure hosts and applications.

A web application firewall focuses on HTTP and HTTPS behavior, such as suspicious request patterns. It can reduce exposure to common web attacks, but poor tuning may create false positives, and it cannot correct insecure business logic.

5. Secure Routing and Switching

Routing protocols exchange reachability information. Security concerns include route injection, unauthorized neighbors, incorrect redistribution, and manipulation of routing policy. Controls include authenticated routing sessions, strict neighbor definitions, prefix filtering, route validation, maximum-prefix limits, control-plane policing, and monitoring of route changes.

At the switching layer, common controls include:

• 802.1X: port-based network access control using an authentication server;
• DHCP snooping: identification of trusted DHCP sources and reduction of rogue-server attacks;
• Dynamic ARP Inspection: validation of ARP messages against trusted bindings;
• IP source guard: restriction of source addresses on access ports;
• port security: limitation or validation of permitted MAC addresses;
• BPDU Guard and storm control: protection against selected switching and broadcast abuses.

These controls require accurate configuration. For example, improperly marking an untrusted port as trusted can defeat the protection, while excessive restrictions can interrupt legitimate devices.

6. Virtual Private Networks

A VPN creates a protected logical connection across an untrusted or shared network. A remote-access VPN connects an individual device to an organization. A site-to-site VPN connects networks or gateways. IPsec commonly operates at the network layer, while TLS-based VPNs operate through application or transport mechanisms.

A VPN normally provides confidentiality and integrity for traffic in transit, and may authenticate users, devices, gateways, or combinations of them. It does not automatically make an endpoint safe. A compromised laptop can carry malware through a VPN into internal systems. Strong deployments therefore use multifactor authentication, device posture checks, least-privilege routes, segmentation, modern cryptography, logging, and short-lived or revocable credentials.

Split tunneling sends only selected traffic through the VPN; it can improve performance but may allow Internet traffic to bypass organizational inspection. Full tunneling sends broader traffic through the organization; it improves centralized control but increases bandwidth and availability requirements. The choice depends on risk, performance, privacy, and operational architecture.

7. Intrusion Detection and Prevention

An IDS observes traffic or host activity and raises alerts. An IPS is placed inline or otherwise acts to block, reset, quarantine, or rate-limit suspected activity. Detection methods include:

• signature-based detection: matches known patterns;
• anomaly-based detection: identifies deviations from a learned or defined baseline;
• stateful protocol analysis: evaluates whether behavior conforms to protocol expectations;
• behavioral and threat-intelligence analysis: correlates indicators and context.

Signatures are often precise for known attacks but weak against novel variants. Anomaly detection may identify new behavior but can generate false positives. Detection quality depends on sensor placement, visibility, time synchronization, tuning, and skilled investigation. Alerts should be prioritized using asset criticality, confidence, evidence, and potential impact.

A useful operational cycle is: collect telemetry, normalize events, correlate indicators, investigate, contain, eradicate, recover, and improve controls. Logs must be protected from unauthorized alteration and retained according to legal, contractual, and investigative requirements.

8. DNS and Email Protection

8.1 DNS security

DNS translates names into resource records. Attacks include cache poisoning, unauthorized zone transfer, domain hijacking, malicious domains, tunneling, and availability attacks. DNSSEC adds origin authentication and integrity through digitally signed records; it does not encrypt DNS queries or make a maliciously registered domain legitimate. Secure zone-transfer controls, registrar multifactor authentication, registry locks where appropriate, monitoring, and carefully configured recursive resolvers are important.

Protective DNS services can block known malicious domains, but classification may be incomplete or incorrect. DNS logs are valuable for detection, yet collection must respect privacy and retention requirements.

8.2 Email security

Email protection combines authentication, filtering, user education, and operational controls. SPF specifies authorized sending hosts for a domain. DKIM attaches a cryptographic signature to selected message headers and content. DMARC allows a domain owner to publish handling and reporting policies based on SPF and/or DKIM alignment.

These mechanisms reduce spoofing but do not prove that a message is desirable or that a trusted sender is not compromised. Secure email gateways, attachment and link analysis, sandboxing, external-sender indicators, phishing-resistant multifactor authentication, and payment-change verification provide additional defenses.

9. Wireless Security

Wireless networks extend the attack surface beyond physical walls. Risks include rogue access points, evil-twin networks, weak passwords, deauthentication abuse, misconfigured guest access, and unpatched client devices.

Enterprise wireless networks should use WPA3-Enterprise where supported, or an appropriately configured WPA2-Enterprise deployment, with strong authentication and certificate validation. Shared personal passphrases are difficult to revoke and audit. Guest networks should be isolated from internal resources, and management interfaces should not be exposed to ordinary clients. Wireless surveys, access-point inventory, firmware updates, protected management frames where supported, and monitoring for rogue devices are useful controls.

10. Segmentation and Zero-Trust Access

Segmentation divides infrastructure into zones with controlled communication paths. A typical design may include an Internet edge, public-facing demilitarized zone (DMZ), user network, server network, management network, backup environment, development environment, and guest wireless network.

Segmentation can be physical, virtual, or policy-based. VLANs alone are not a complete security boundary because routing, administrative access, and misconfiguration may undermine them. Inter-zone traffic should pass through enforcement points with explicit policy and monitoring.

Zero trust is an architectural approach in which no user, device, or network location receives implicit trust. Access decisions consider identity, device state, resource sensitivity, session context, and policy. Zero trust does not mean eliminating networks or trusting nothing absolutely; it means continuously limiting and evaluating access rather than relying primarily on perimeter location.

11. Secure Remote Access and Administration

Remote administration should use dedicated management paths, bastion hosts or jump servers, strong authentication, role-based authorization, session logging, and time-limited access. Direct exposure of administrative interfaces to the public Internet should be avoided where possible. Privileged credentials should be stored and rotated through controlled systems, and emergency access should be documented and reviewed.

Remote workers require secure endpoint configuration, automatic updates, disk encryption, screen-lock policies, malware protection, and clear procedures for lost devices. Bring-your-own-device arrangements require explicit decisions about data separation, monitoring, privacy, and support responsibilities.

12. Applied Case: Segmentation for a Regional Clinic

Background

This illustrative case concerns a regional clinic with electronic health records, medical devices, staff workstations, guest Wi-Fi, cloud email, and remote maintenance vendors. The clinic originally used a flat network. A stolen staff password allowed an attacker to access a workstation and scan several medical-device systems.

Problem and analysis

The flat architecture allowed unnecessary lateral movement. Medical devices had differing patch capabilities, vendors required occasional remote access, and patient information required confidentiality and availability. The clinic also lacked centralized logging and had weak control over third-party accounts.

Approach

The security team designed separate zones for clinical devices, servers, staff endpoints, guest access, backups, and management. A firewall controlled inter-zone traffic using documented allow rules. Clinical devices could reach only required application servers; guest devices received Internet-only access; management interfaces were reachable through a hardened jump host. Vendor access required approval, multifactor authentication, device checks, time-limited accounts, and session logging.

The clinic deployed endpoint detection, DNS filtering, email authentication, centralized time synchronization, vulnerability tracking, and tested offline backups. Because some medical devices could not support modern agents, compensating controls included strict network policy, monitoring, vendor coordination, and physical safeguards.

Outcome

The architecture reduced unnecessary paths and improved investigation. A later compromised guest device could not reach clinical systems. The design did not eliminate risk: vulnerable devices remained, and availability requirements limited aggressive blocking. Regular review, incident exercises, and vendor governance remained necessary.

Learning points

Security architecture must account for safety and continuity, not only confidentiality. Segmentation is effective when policies are explicit, monitored, and maintained. Legacy technology requires compensating controls rather than unrealistic assumptions. Third-party access is part of the organization’s attack surface.

13. Limitations, Governance, and Ethical Issues

Network monitoring can expose personal communications, location information, health data, or employee behavior. Organizations should define a lawful purpose, collect proportionate data, restrict access, protect logs, publish appropriate notices, and establish retention and deletion rules. Inspection of encrypted traffic may improve threat detection but can create privacy, key-management, and sensitive-data risks.

Security controls also create availability and equity concerns. Aggressive filtering can block legitimate research, accessibility tools, or critical services. Automated systems, including AI-assisted anomaly detection, may prioritize alerts efficiently but can reproduce bias, misclassify benign behavior, or be manipulated by adversarial activity. Human review, testing, documented accountability, and safe override procedures remain essential.

Regulatory duties vary by jurisdiction and sector. Organizations may need to address breach notification, protection of personal data, payment information, health information, critical infrastructure, and contractual security requirements. Governance should connect technical controls to risk owners, policies, audit evidence, incident response, and business continuity.

14. Best-Practice Design Method

A practical infrastructure-security process is:

1. inventory assets, data flows, identities, dependencies, and owners;
2. identify threats, vulnerabilities, business impacts, and safety constraints;
3. define trust zones and security objectives;
4. select layered controls using least privilege and deny-by-default principles;
5. configure secure protocols, authentication, logging, and time synchronization;
6. test normal operation, failure modes, bypasses, and recovery;
7. monitor continuously and investigate meaningful alerts;
8. patch, review rules, rotate credentials, and remove obsolete access;
9. rehearse incident response and restore from tested backups;
10. measure improvement and revise the architecture as systems change.

Useful measures include percentage of assets inventoried, age of critical vulnerabilities, multifactor-authentication coverage, mean time to detect and contain incidents, percentage of firewall rules with owners and review dates, backup restoration success, and unauthorized exposure findings. Metrics should support decisions rather than reward superficial activity.

Chapter Summary

Network and infrastructure security protects communication systems and services through layered technical and organizational controls. Protocol knowledge is essential because IP, TCP, UDP, ARP, DNS, email, and wireless technologies have different security properties. Common attacks include reconnaissance, spoofing, man-in-the-middle activity, denial of service, credential abuse, malware, and lateral movement.

Firewalls enforce traffic policy but cannot replace secure endpoints or applications. Secure routing and switching reduce unauthorized control-plane and local-network manipulation. VPNs protect traffic in transit but require strong endpoint and identity controls. IDS and IPS technologies provide detection and prevention with important trade-offs between visibility, false positives, and operational burden.

DNSSEC, SPF, DKIM, and DMARC address distinct DNS and email risks. Wireless security requires strong authentication, isolation, monitoring, and careful configuration. Segmentation limits lateral movement, while zero-trust architecture evaluates identity, device, resource, and context rather than trusting network location. Effective security also requires privacy protection, governance, incident response, continuity planning, and continual review.

Key Terms

Attack surface: The reachable interfaces, services, accounts, and dependencies that may be attacked.

Authentication: Verification of an entity’s claimed identity.

CIA triad: Confidentiality, integrity, and availability.

DMARC: A domain-based email policy and reporting mechanism using SPF and DKIM alignment.

DMZ: A controlled network zone for services exposed to less-trusted networks.

DNSSEC: Extensions that provide origin authentication and integrity for DNS data.

Firewall: A control that permits or blocks traffic according to policy.

IDS: An intrusion detection system that monitors and alerts on suspected activity.

IPS: An intrusion prevention system that can actively block suspected activity.

Least privilege: Granting only the access required for an authorized purpose.

Man-in-the-middle attack: Interception or manipulation of communication between parties.

Network segmentation: Division of a network into zones with controlled communication.

SPF: A DNS-based declaration of authorized email-sending hosts.

Stateful inspection: Firewall analysis that tracks connection state.

TLS: A protocol that protects communications through encryption and authentication.

VPN: A protected logical connection across an untrusted network.

Zero trust: An approach that avoids implicit trust and continually evaluates access.

802.1X: Port-based network access control using an authentication framework.

Review Questions

Short Answer Questions

1. What are the three elements of the CIA triad?
2. How does a stateful firewall differ from a basic packet filter?
3. What security properties does a VPN commonly provide?
4. Why is DNSSEC not equivalent to encrypted DNS?
5. What is the purpose of network segmentation?

Long Answer Questions

1. Explain how TLS, certificates, and authentication work together to protect an application session.
2. Compare signature-based and anomaly-based intrusion detection, including their principal limitations.
3. Describe a secure architecture for a network containing public web servers, employees, servers, and guests.
4. Explain how SPF, DKIM, and DMARC complement one another and identify what they do not guarantee.
5. Discuss the operational and privacy implications of inspecting encrypted network traffic.

Analytical / Application Questions

1. A company permits remote access using a VPN but has no multifactor authentication or device checks. Analyze the risks and propose a prioritized improvement plan.
2. A hospital must protect legacy medical devices that cannot receive endpoint agents. Design compensating network, monitoring, access, and continuity controls.
3. During an incident, DNS queries from a workstation show frequent connections to newly registered domains, while the firewall shows permitted HTTPS traffic. Explain how you would investigate and contain the activity without unnecessarily disrupting business operations.

Multiple Choice Questions with Answers

Question 1

Which property is provided by integrity controls?

A. Preventing all service outages

B. Ensuring data is not altered improperly

C. Ensuring every user is anonymous

D. Increasing network bandwidth

Correct Answer: B. Ensuring data is not altered improperly

Question 2

What is a principal limitation of a firewall?

A. It cannot enforce any traffic policy

B. It cannot inspect addresses or ports

C. It may not detect malicious activity inside permitted traffic

D. It always blocks encrypted communications

Correct Answer: C. It may not detect malicious activity inside permitted traffic

Question 3

Which technology validates DNS data origin and integrity through digital signatures?

A. DNSSEC

B. DHCP snooping

C. SPF

D. 802.1X

Correct Answer: A. DNSSEC

Question 4

What is the main purpose of network segmentation?

A. To eliminate the need for authentication

B. To limit unnecessary communication and lateral movement

C. To guarantee that malware cannot enter a network

D. To replace all endpoint security controls

Correct Answer: B. To limit unnecessary communication and lateral movement

Question 5

Which statement best describes an IPS?

A. It only translates domain names

B. It detects activity and may actively block it

C. It provides physical protection for servers

D. It authenticates email senders exclusively

Correct Answer: B. It detects activity and may actively block it

Question 6

What is a major risk of split tunneling in a VPN?

A. All traffic must use a slower satellite connection

B. Selected Internet traffic may bypass organizational inspection

C. It prevents endpoint authentication

D. It makes encryption mathematically impossible

Correct Answer: B. Selected Internet traffic may bypass organizational inspection

Question 7

Which control helps reduce attacks from rogue DHCP servers on a switched network?

A. DHCP snooping

B. DMARC

C. TLS certificate pinning

D. Full-tunnel VPN

Correct Answer: A. DHCP snooping

Question 8

What does least privilege require?

A. Giving every employee administrator access

B. Allowing access only as needed for an authorized purpose

C. Trusting all devices inside the perimeter

D. Disabling all remote access

Correct Answer: B. Allowing access only as needed for an authorized purpose

Question 9

Which email technology publishes a policy for handling messages based on SPF and DKIM alignment?

A. NTP

B. DMARC

C. IPsec

D. ARP

Correct Answer: B. DMARC

Question 10

Why is a compromised endpoint still dangerous after connecting through a VPN?

A. A VPN automatically disables encryption

B. The endpoint may carry malware into reachable internal systems

C. VPNs cannot authenticate users

D. VPNs work only for public websites

Correct Answer: B. The endpoint may carry malware into reachable internal systems