Network and Communications Security

Introduction and Context

Modern organizations depend on networks to connect users, applications, cloud services, suppliers, branch offices, industrial systems, and customers. These connections create efficiency, but they also create pathways for unauthorized access, interception, malware propagation, data loss, and service disruption. Network and communications security is the discipline of protecting information while it is transmitted, controlling which systems may communicate, detecting malicious activity, and maintaining the availability and integrity of network services.

Network security is not achieved by installing one product. It is a layered practice involving architecture, protocols, access control, cryptography, monitoring, secure configuration, incident response, and user behavior. A firewall may block an unauthorized connection, but it cannot correct a stolen password. Encryption may protect data in transit, but it does not prevent a compromised endpoint from sending legitimate credentials to an attacker. Effective security therefore combines preventive, detective, and corrective controls.

Learning Objectives

By the end of this chapter, you should be able to:

• Explain the security roles of common network protocols.
• Distinguish major network attacks and their likely effects.
• Apply network segmentation and firewall principles.
• Configure wireless networks using secure authentication and encryption.
• Explain the purpose and limitations of VPNs.
• Describe DNS and email security controls.
• Distinguish intrusion detection from intrusion prevention.
• Recommend secure practices for remote access.
• Evaluate network-security designs using risk, usability, availability, and governance considerations.

1. Network Communication as a Security Problem

A network enables endpoints to exchange data through agreed protocols. The commonly taught TCP/IP model includes application, transport, internet, and link layers. Each layer provides useful functions but also presents different security concerns.

At the application layer, protocols such as HTTP, DNS, SMTP, and SSH define how services communicate. At the transport layer, TCP and UDP provide different delivery behaviors. TCP establishes a connection and provides ordered, reliable delivery; UDP has lower overhead but does not itself provide reliability or confidentiality. At the internet layer, IP provides addressing and routing. At the link layer, Ethernet and Wi-Fi provide local network delivery.

Security objectives can be expressed through the confidentiality, integrity, and availability (CIA) triad:

• Confidentiality prevents unauthorized disclosure.
• Integrity prevents unauthorized alteration and supports trustworthy data.
• Availability ensures that authorized users can access systems when needed.

Authentication establishes who or what is communicating. Authorization determines what that identity may do. Accountability connects actions to identities through logging and monitoring. These properties are related but not interchangeable: encryption can support confidentiality, but it does not by itself prove the identity of the other party.

Important Protocol Security Characteristics

A protocol should be assessed in context. For example, HTTPS protects a connection between a client and server when certificate validation succeeds and the endpoint itself is trustworthy. It does not guarantee that the website is honest or that the client computer is free from malware.

2. Common Network Attacks

Eavesdropping and Traffic Interception

An attacker who can observe network traffic may collect credentials, personal information, session tokens, or business data. Unencrypted protocols are especially vulnerable. Even encrypted traffic can reveal metadata such as communicating addresses, timing, and volume.

A man-in-the-middle attack occurs when an attacker positions themselves between two communicating parties and relays or alters traffic. Defenses include certificate validation, mutual authentication where appropriate, secure wireless configuration, authenticated VPNs, and user education against certificate warnings.

Spoofing and Poisoning

Spoofing occurs when an attacker falsifies an identity or address. Examples include IP spoofing, address-resolution spoofing, email sender spoofing, and DNS spoofing. DNS cache poisoning inserts false name-to-address information into a resolver’s cache, redirecting users to an attacker-controlled destination.

Defenses include authenticated protocols, network-layer filtering, secure resolver configuration, DNSSEC validation, and monitoring for unexpected changes. DNSSEC provides origin authentication and integrity for DNS data; it does not encrypt ordinary DNS queries or hide the websites a user requests.

Denial of Service

Denial-of-service attacks consume bandwidth, processing capacity, connection tables, or application resources. A distributed denial-of-service attack uses many sources, often compromised devices. Controls include rate limiting, upstream filtering, redundant services, content-delivery networks, capacity planning, and incident-response agreements with providers.

Scanning and Enumeration

Attackers scan addresses and ports to identify live systems and services. Service-version detection and directory enumeration can reveal weaknesses. Scanning is not always malicious—administrators use it for inventory and testing—but unauthorized scanning may violate policy or law. Organizations should maintain an approved asset inventory, close unnecessary services, and monitor unusual reconnaissance patterns.

Credential and Session Attacks

Password spraying tries a small number of common passwords against many accounts, reducing the chance of immediate lockout. Brute force tries many passwords against one account or service. Credential stuffing uses passwords exposed in previous breaches. Session hijacking steals a valid session token.

Mitigations include multifactor authentication, password managers, rate limits, breached-password screening, secure cookies, short session lifetimes for sensitive actions, and reauthentication for high-risk transactions.

Malware Propagation and Lateral Movement

After compromising one endpoint, attackers may move through shared folders, administrative protocols, remote-management tools, or stolen credentials. Flat networks make this easier because many systems can communicate freely. Segmentation, least privilege, endpoint protection, patching, and monitoring of east-west traffic limit lateral movement.

Routing and Availability Attacks

Routing attacks may redirect traffic, create black holes, or overload routing systems. In enterprise environments, secure routing practices include authenticated routing protocols where supported, controlled route exchange, filtering, redundant links, and change management. Small organizations commonly rely on service providers for much of this protection but still need documented ownership and escalation procedures.

3. Defense in Depth and Network Architecture

Defense in depth uses multiple independent or partially independent controls. A practical architecture often separates users, servers, management systems, guest devices, voice systems, and high-value assets. Segmentation can be implemented through physical networks, VLANs, routing policies, firewalls, software-defined controls, or cloud security groups.

A VLAN separates broadcast domains at the switching layer, but a VLAN alone is not a complete security boundary. Communication between VLANs normally requires routing, and routing should pass through an access-control policy or firewall when the risk justifies it. Sensitive assets should not be protected merely by an informal VLAN label.

Segmentation Design Principles

1. Identify assets and data flows before creating zones.
2. Group systems with similar trust requirements and business functions.
3. Permit only required communication between zones.
4. Place administrative interfaces in a restricted management network.
5. Isolate guest and unmanaged devices from internal resources.
6. Monitor denied and unusual inter-zone traffic.
7. Review rules when applications, suppliers, or business processes change.

A useful design is a screened architecture with an internet edge, an external-facing demilitarized zone (DMZ), an internal user network, and protected server or management networks. Public web servers may reside in the DMZ, while databases remain in a more restricted zone. The DMZ is not automatically safe; it is a zone designed to limit the consequences of compromise.

Zero Trust Perspective

Zero trust is an architectural approach rather than a single product. It assumes that network location alone does not establish trust. Access decisions consider identity, device condition, resource sensitivity, policy, and context. This approach supports least privilege and continuous verification. It does not mean that every packet must be inspected identically or that traditional segmentation is obsolete; segmentation remains useful as one enforcement mechanism.

4. Firewalls and Access-Control Policy

A firewall controls traffic according to rules. Rules may consider source and destination addresses, ports, protocols, interfaces, identities, application characteristics, time, and connection state. A stateless packet filter evaluates packets independently. A stateful firewall tracks connection state, allowing return traffic for an approved connection. A next-generation firewall may add application identification, user identity, malware inspection, and intrusion-prevention functions.

A sound rule base follows these principles:

• Deny by default where operationally feasible.
• Permit only necessary source, destination, service, and direction.
• Place specific rules before broad rules when the platform uses first-match processing.
• Remove obsolete, duplicate, shadowed, and overly broad rules.
• Log important denies and high-risk permits without overwhelming monitoring systems.
• Separate temporary emergency rules from permanent policy.
• Review rules periodically and record business ownership.

Firewalling is not a substitute for secure systems. An allowed HTTPS connection can carry a web exploit, and a trusted internal host can be compromised. Host firewalls, application controls, identity-based access, and endpoint security complement network firewalls.

Worked Rule-Review Example

An organization has a web server at 10.20.10.15 and a database at 10.20.20.25. The web application requires database TCP port 5432, but no user workstation does. A restrictive policy permits traffic from 10.20.10.15 to 10.20.20.25 on TCP 5432 and denies other workstation-to-database traffic. This is safer than permitting the entire user subnet to access the database because it reduces the number of possible sources and limits lateral movement after a workstation compromise.

The rule should also be documented with its owner, purpose, review date, logging requirement, and expiry condition. Addresses and ports alone do not explain whether the rule remains justified.

5. Secure Wireless Networking

Wireless signals extend beyond building walls, so physical access control is insufficient. Security depends on authentication, encryption, configuration, and monitoring.

Recommended practices include:

• Use WPA3-Personal where supported, or WPA2-AES when WPA3 is unavailable.
• For organizations, prefer WPA2-Enterprise or WPA3-Enterprise with 802.1X and a properly managed authentication service.
• Use strong, unique passphrases for personal-mode networks.
• Disable obsolete protocols such as WEP and avoid WPA/TKIP.
• Change default administrator credentials and update firmware.
• Place guests on a separate network with internet-only access where appropriate.
• Restrict management interfaces to wired or dedicated administrative networks.
• Use certificate validation carefully in enterprise authentication to prevent rogue access points.
• Monitor for unauthorized access points and unusual association behavior.

Hiding a network name does not provide meaningful confidentiality, and MAC-address allowlists are not strong authentication because addresses can be observed and impersonated. Wireless security should be combined with segmentation, endpoint controls, and secure application protocols.

6. VPNs and Secure Tunneling

A virtual private network creates an authenticated and protected logical connection over an untrusted network. VPN technologies may operate at the network layer, such as IPsec, or at the transport/application layer, such as TLS-based remote-access systems. A site-to-site VPN connects networks; a remote-access VPN connects an individual device or user to organizational resources.

A VPN commonly provides:

• Confidentiality through encryption.
• Integrity through authenticated protection against modification.
• Peer authentication through certificates, keys, or credentials.
• Controlled routing between authorized networks or resources.

A VPN does not automatically make an endpoint secure. If a laptop is infected, the VPN may provide the attacker a trusted path into internal systems. Organizations should use multifactor authentication, device-health checks, least-privilege access, split-tunnel decisions based on risk, session logging, and prompt revocation.

Split tunneling sends some traffic directly to the internet while organizational traffic uses the VPN. It can improve performance and reduce gateway load, but it may reduce visibility and create a path between an untrusted network and a managed device. Full tunneling improves centralized inspection but may increase bandwidth and latency requirements. The choice should follow risk and operational analysis.

7. DNS Security

DNS translates names such as example.org into network addresses. Because users and applications rely on this translation, DNS is a high-value control point.

Important protections include:

• Use trusted recursive resolvers and restrict who may query them.
• Disable open recursion on resolvers not intended for public use.
• Apply timely patching and secure configuration.
• Use DNSSEC validation to detect forged or altered signed responses.
• Protect authoritative DNS administration with multifactor authentication and change control.
• Monitor for unusual query volume, newly registered look-alike domains, and suspicious newly observed destinations.
• Consider encrypted DNS transports such as DNS over TLS or DNS over HTTPS where they support privacy and policy requirements.

Encrypted DNS can reduce local observation of queries, but it may make organizational filtering and monitoring more difficult if unmanaged. Governance should specify approved resolvers and logging expectations. DNSSEC and encrypted DNS solve different problems: DNSSEC addresses authenticity and integrity of DNS data, whereas encrypted transports address confidentiality of the DNS query path.

8. Email Security

Email combines identity, content, attachments, links, and external communication, making it a frequent attack channel. Technical controls should be supported by user reporting, awareness, and incident response.

SPF allows a domain owner to publish authorized sending hosts. DKIM adds a cryptographic signature to messages so receiving systems can assess whether selected headers and content were signed by an authorized domain. DMARC allows a domain owner to specify how receivers should handle messages that fail alignment and provides reporting. These controls reduce domain spoofing but do not eliminate display-name deception, compromised legitimate accounts, malicious look-alike domains, or all phishing.

Organizations should also use:

• Attachment and URL analysis.
• Malware and spam filtering.
• External-sender indicators.
• Protection against dangerous file types and macro-enabled content.
• Strong authentication and multifactor protection for mail accounts.
• Secure transport using TLS where supported.
• Data-loss prevention for sensitive information.
• Clear reporting and rapid mailbox-remediation procedures.

Email encryption may be required for sensitive content. Transport encryption protects communication between mail systems, while end-to-end or message-level encryption can provide stronger protection against intermediary access. The organization must consider key management, recipient usability, retention, and legal discovery.

9. Intrusion Detection and Prevention

An intrusion detection system (IDS) identifies suspicious activity and generates alerts. An intrusion prevention system (IPS) can block or modify traffic automatically. Network IDS sensors may use signatures, protocol analysis, anomaly detection, or a combination.

Signature detection is effective for known patterns but may miss new variants. Anomaly detection can identify deviations from normal behavior but may produce false positives when legitimate activity changes. Effective monitoring requires asset context, time synchronization, tuned rules, adequate storage, alert prioritization, and trained analysts.

A practical monitoring process is:

1. Collect relevant network, firewall, DNS, authentication, endpoint, and cloud logs.
2. Normalize timestamps and fields.
3. Establish expected behavior for important systems.
4. Correlate events across sources.
5. Investigate alerts using asset and identity context.
6. Contain confirmed threats and preserve evidence.
7. Tune detections using lessons from investigations.

Automatic prevention should be introduced carefully. Blocking a malicious source may be useful, but an incorrect block can interrupt critical services. High-confidence signatures and carefully tested controls are preferable to unrestricted automatic action.

10. Secure Remote Access

Remote work expands the organization’s effective perimeter. Secure remote access begins with identity and device assurance, not merely a VPN address.

Minimum practices include:

• Require multifactor authentication, preferably phishing-resistant methods for high-risk access.
• Use managed devices with supported operating systems, encryption, endpoint protection, and automatic updates.
• Restrict administrative access through dedicated jump hosts or privileged-access systems.
• Apply least privilege and separate ordinary and administrative accounts.
• Enforce session timeout, reauthentication, and rapid account revocation.
• Record access events and investigate unusual location, time, device, or behavior.
• Prohibit direct exposure of management services to the public internet where possible.
• Provide secure procedures for lost devices, suspected compromise, and emergency access.

Remote desktop services are especially sensitive because exposed services are frequently scanned and attacked. If remote desktop is necessary, place it behind a VPN or zero-trust access gateway, require multifactor authentication, restrict source access, patch promptly, and monitor authentication failures and unusual sessions.

11. Illustrative Case: Northbridge College Network

Background

Northbridge College operates administrative systems, student laboratories, a learning platform, residence Wi-Fi, guest Wi-Fi, and a small data center. The original network was largely flat. Staff reported phishing incidents, and a compromised student laptop had recently scanned internal systems.

Problem

The college needed to protect student records and administrative applications without preventing teaching laboratories and research systems from communicating where required. It also needed secure remote access for staff and a manageable monitoring program.

Analysis

An asset and data-flow review identified four risk groups: public services, student and guest devices, staff systems, and high-value administrative servers. The review found unnecessary workstation access to database ports, shared administrator passwords on network devices, weak wireless settings in an older building, and limited centralized logging.

Approach and Solution

The college created separate zones for public-facing services, student devices, staff devices, administrative servers, management interfaces, and guests. Inter-zone firewall rules were written from documented application requirements. Database access was restricted to named application servers. WPA3-Enterprise was introduced for managed users, while guest access was isolated from internal networks. Network-device administration moved to a management network using individual accounts and multifactor authentication.

A remote-access gateway was deployed with multifactor authentication and device compliance checks. DNS resolvers were restricted to authorized clients, DNSSEC validation was enabled, and authoritative DNS changes required approval. Email protection was improved through SPF, DKIM, and a staged DMARC policy. Centralized logs from firewalls, DNS, authentication systems, and endpoints were sent to a monitoring platform.

Outcome

The college reduced unnecessary internal reachability, improved visibility into scanning and suspicious authentication, and gained a controlled method for remote administration. Some legacy laboratory systems could not support modern authentication, so they were placed in a restricted segment with compensating controls and an upgrade plan.

Learning Points

The case demonstrates that security architecture must follow business and data flows. Segmentation is more effective when accompanied by firewall policy, identity controls, monitoring, and lifecycle planning. Legacy systems require risk-based compensating controls rather than unrealistic assumptions that they can be modernized immediately.

12. Governance, Ethics, and Limitations

Network monitoring can protect people and systems, but it may also collect personal information. Organizations should define a legitimate purpose, collect proportionate data, restrict access, protect logs, establish retention periods, and communicate monitoring practices in accordance with applicable law and policy. Intercepting content without authorization may violate privacy or communications regulations.

Security testing must be authorized, scoped, and documented. Port scanning, wireless testing, traffic capture, and simulated phishing may affect availability or expose personal information. A written rules-of-engagement document should identify systems, dates, methods, contacts, prohibited actions, and emergency procedures.

Technical controls also have limitations. Encryption can complicate lawful inspection and troubleshooting. IDS tools generate false positives and may miss encrypted malicious traffic. Firewalls can become single points of failure if not designed redundantly. Cloud and software-defined networks change rapidly, making static rules and undocumented exceptions dangerous. Security is therefore a continuing governance process involving risk acceptance, review, training, and improvement.

13. Contemporary Developments and Best Practices

Current network security increasingly combines conventional controls with identity-centered and cloud-native methods. Secure access service edge (SASE) and security service edge (SSE) integrate networking and security functions closer to users and applications. Network detection and response uses telemetry and analytics to identify behavior across internal and cloud environments. Automation can improve rule review, asset discovery, and alert triage, but automated recommendations require human validation.

Artificial intelligence can assist with anomaly detection, phishing analysis, configuration review, and prioritization. It can also produce false positives, inherit biased training data, or be manipulated by adversarial inputs. Organizations should validate AI-assisted decisions, protect sensitive telemetry, retain human accountability, and avoid treating model output as proof of compromise.

A practical baseline is to maintain an accurate asset inventory, use secure protocols, segment by risk, enforce least privilege, patch and back up critical systems, authenticate administrators strongly, monitor important events, test recovery, and review controls after architectural or business changes. The objective is not merely to block attacks but to reduce attack paths, detect compromise quickly, limit impact, and restore trusted operations.

Chapter Summary

Network and communications security protects confidentiality, integrity, availability, authentication, authorization, and accountability across connected systems. Common attacks include interception, spoofing, DNS poisoning, denial of service, scanning, credential abuse, and lateral movement. Defense in depth combines secure protocols, segmentation, firewalls, endpoint controls, identity assurance, monitoring, and response.

Segmentation should reflect assets and data flows, while firewall rules should be specific, documented, logged, and regularly reviewed. Secure wireless networks require modern authentication and encryption, not hidden names or address allowlists. VPNs protect connections but do not make compromised endpoints trustworthy. DNSSEC supports DNS integrity, encrypted DNS protects query privacy, and SPF, DKIM, and DMARC reduce email-domain spoofing. IDS detects suspicious activity, whereas IPS can prevent it, though both require tuning and context. Secure remote access depends on multifactor authentication, managed devices, least privilege, monitoring, and controlled administrative pathways. Ethical and legal governance is essential whenever network activity or user communications are monitored.

Key Terms

Confidentiality: Protection against unauthorized disclosure of information.

Integrity: Assurance that information and systems have not been improperly altered.

Availability: The ability of authorized users to access systems and data when needed.

Authentication: Verification of an identity or system.

Authorization: Determination of permitted actions after authentication.

Segmentation: Dividing a network into zones with controlled communication between them.

VLAN: A logical local-area network implemented within switching infrastructure.

DMZ: A controlled network zone commonly used for services exposed to external networks.

Firewall: A control that permits or blocks traffic according to policy.

VPN: An authenticated, protected logical connection over an untrusted network.

Man-in-the-middle attack: An attack in which an adversary intercepts and may alter communication between parties.

DNSSEC: Extensions that provide authentication and integrity for signed DNS data.

SPF: A domain-publishing mechanism identifying authorized email-sending hosts.

DKIM: A cryptographic email-signing mechanism.

DMARC: A policy and reporting framework for email authentication alignment.

IDS: An intrusion detection system that identifies and reports suspicious activity.

IPS: An intrusion prevention system that can block suspicious activity.

Lateral movement: An attacker’s movement from one compromised system to other systems.

Zero trust: An approach that avoids granting trust solely because of network location.

Multifactor authentication: Authentication using two or more independent factor types.

Review Questions

Short Answer Questions

1. What are the three elements of the CIA triad?
2. Why is a VLAN alone not necessarily a complete security boundary?
3. What is the difference between an IDS and an IPS?
4. What security problem does DNSSEC address?
5. Why does a VPN not guarantee that a remote device is safe?

Long Answer Questions

1. Explain how defense in depth can reduce the impact of a compromised workstation.
2. Compare stateful firewalls, stateless packet filters, and next-generation firewalls.
3. Describe a secure wireless design for an organization with employees, guests, and unmanaged devices.
4. Explain how SPF, DKIM, and DMARC work together and identify threats they do not eliminate.
5. Discuss the governance and privacy issues involved in centralized network monitoring.

Analytical / Application Questions

1. A company’s staff subnet can directly access every server port, and a recent malware incident began on a staff laptop. Propose a segmentation and firewall strategy, including the evidence you would collect before implementing it.
2. An organization must choose between full-tunnel and split-tunnel remote VPN access for employees using managed laptops. Analyze the security, performance, monitoring, and operational trade-offs.
3. A college detects repeated failed logins, unusual DNS queries, and scanning from a student device. Design an investigation and containment sequence that preserves evidence while limiting disruption to legitimate users.

Multiple Choice Questions with Answers

Question 1

Which control primarily provides confidentiality and integrity for web traffic in transit?

A. HTTP

B. HTTPS using TLS

C. DNSSEC

D. SPF

Correct Answer: B. HTTPS using TLS

Question 2

Why is segmentation valuable after a workstation is compromised?

A. It guarantees that malware cannot execute

B. It prevents all internet access

C. It limits the systems and services the attacker can reach

D. It replaces the need for authentication

Correct Answer: C. It limits the systems and services the attacker can reach

Question 3

What is the main purpose of DNSSEC?

A. Encrypting all application traffic

B. Authenticating and protecting the integrity of signed DNS data

C. Blocking every malicious email attachment

D. Replacing firewall rules

Correct Answer: B. Authenticating and protecting the integrity of signed DNS data

Question 4

Which email control allows a domain owner to publish a policy for messages that fail authentication alignment?

A. DMARC

B. FTP

C. SNMPv3

D. 802.1X

Correct Answer: A. DMARC

Question 5

What is a characteristic of a stateful firewall?

A. It tracks connection state when evaluating traffic

B. It can inspect only wireless traffic

C. It provides email signatures automatically

D. It eliminates the need for endpoint security

Correct Answer: A. It tracks connection state when evaluating traffic

Question 6

Which wireless practice is most appropriate for an enterprise network?

A. Use WEP because it is widely supported

B. Hide the network name as the primary security control

C. Use WPA2-Enterprise or WPA3-Enterprise with 802.1X where appropriate

D. Allow shared administrator passwords on access points

Correct Answer: C. Use WPA2-Enterprise or WPA3-Enterprise with 802.1X where appropriate

Question 7

What is the principal difference between an IDS and an IPS?

A. An IDS detects and alerts, while an IPS can automatically block activity

B. An IDS encrypts traffic, while an IPS decrypts it

C. An IDS authenticates users, while an IPS assigns addresses

D. An IDS protects email, while an IPS protects DNS only

Correct Answer: A. An IDS detects and alerts, while an IPS can automatically block activity

Question 8

Which measure most directly reduces the risk of password spraying in remote access?

A. Disabling system logs

B. Using multifactor authentication and rate limiting

C. Hiding the wireless network name

D. Allowing unlimited login attempts

Correct Answer: B. Using multifactor authentication and rate limiting

Question 9

What is a major risk of split-tunnel VPN access?

A. It always prevents access to internal systems

B. It may reduce centralized visibility and inspection of some traffic

C. It disables encryption for organizational traffic

D. It makes multifactor authentication impossible

Correct Answer: B. It may reduce centralized visibility and inspection of some traffic

Question 10

Which statement about a VPN is correct?

A. A VPN guarantees that the endpoint contains no malware

B. A VPN provides a protected connection but still requires endpoint and access controls

C. A VPN replaces all firewall policies

D. A VPN prevents denial-of-service attacks in every circumstance

Correct Answer: B. A VPN provides a protected connection but still requires endpoint and access controls