Network Security, Ethics and Governance

Introduction

Computer networks support banking, education, healthcare, manufacturing, government and social communication. Their value depends not only on availability and performance but also on trust. A network that exposes confidential records, permits unauthorised access or cannot recover from an attack is technically connected but operationally unsafe.

Network security is the protection of networked systems, data and services against unauthorised access, misuse, modification, disruption and destruction. Security is not a single device or software package. It is a layered process involving technology, people, procedures, management and law. Ethics and governance extend this process by defining what administrators should do, what users may do, who is accountable and how risks are controlled.

This chapter presents practical foundations for applying security principles, access control, firewalls, encryption, public-key infrastructure, secure protocols, segmentation and incident response. It also examines privacy, acceptable use, legal compliance and responsible administration.

Learning Objectives

After studying this chapter, you should be able to:

• explain the confidentiality, integrity and availability model;
• identify common threats, vulnerabilities and risks;
• apply authentication, authorisation and accounting controls;
• describe firewall operation, network segmentation and zero-trust principles;
• distinguish symmetric encryption, asymmetric encryption, hashing and digital signatures;
• explain the purpose of certificates and public-key infrastructure;
• select secure protocols for common network services;
• outline a practical incident-response process;
• discuss privacy, acceptable use, professional ethics and governance;
• recommend security improvements for a small organisational network.

1. The Security Problem

A threat is a potential cause of harm, such as malware, an attacker, equipment failure or an irresponsible insider. A vulnerability is a weakness that a threat may exploit, such as an unpatched server, weak password or excessive permission. An exploit is a method or code used to take advantage of a vulnerability. Risk is the possibility that a threat will exploit a vulnerability and produce an adverse impact.

A useful qualitative risk relationship is:

Likelihood expresses how probable an event is, while impact expresses its consequence. This is a risk-estimation model rather than an exact physical law. Organisations may use numerical scales, such as 1–5, but the scales must be defined consistently. Risk treatment may include avoiding, reducing, transferring or accepting the risk.

Security controls are commonly classified as:

The CIA Triad

The central security model consists of three properties:

• Confidentiality: information is available only to authorised subjects.
• Integrity: information remains accurate, complete and protected from unauthorised alteration.
• Availability: authorised users can access systems and information when required.

Other important properties include authenticity, accountability, non-repudiation and privacy. For example, a digitally signed transaction can help establish authenticity and integrity, while audit logs support accountability.

Security objectives may conflict. Strong authentication can reduce convenience; extensive logging can create privacy concerns; aggressive filtering can reduce availability for legitimate users. Professional security design therefore balances risk, cost, usability and legal obligations.

2. Security Architecture and Defence in Depth

Defence in depth uses multiple independent or partially independent controls. A typical organisation may protect a service through physical access control, secure configuration, network segmentation, firewall rules, encrypted communication, endpoint protection, backups and monitoring. If one control fails, another may limit the damage.

A layered architecture should consider:

1. Physical layer: secure server rooms, power protection and controlled cabling.
2. Data-link and network layers: switch security, VLANs, routing controls and anti-spoofing filters.
3. Transport and application layers: TLS, secure authentication and input validation.
4. Endpoint layer: operating-system hardening, patch management and malware protection.
5. Identity layer: account lifecycle management, multifactor authentication and least privilege.
6. Operational layer: policies, training, logging, backups and incident response.

Security should be secure by design rather than added only after deployment. Administrators should identify assets, classify data, model threats, select controls, test them and review them continuously.

3. Identity and Access Control

Access control determines who or what may perform an action on which resource under specified conditions. The basic sequence is:

• Identification: a subject claims an identity, such as a username.
• Authentication: the system verifies the claim.
• Authorisation: the system determines permitted actions.
• Accounting or auditing: activities are recorded and reviewed.

Authentication Factors

Authentication factors include:

• something the user knows, such as a password or PIN;
• something the user has, such as a hardware token or registered phone;
• something the user is, such as a fingerprint;
• somewhere the user is, such as an approved network location; and
• something the user does, such as a behavioural pattern.

Multifactor authentication uses two or more different factor categories. Two passwords are not genuine multifactor authentication because both belong to the knowledge category. Hardware security keys and authenticator applications generally provide stronger protection against phishing than SMS codes, although no method is perfect.

Passwords should be long, unique and stored by services using a suitable one-way password-hashing scheme with a unique salt. Passwords must not be stored in plaintext. Account lockout should be designed carefully because unlimited lockout can enable denial-of-service attacks.

Authorisation Models

• Discretionary access control (DAC): resource owners grant permissions. It is flexible but can lead to uncontrolled sharing.
• Mandatory access control (MAC): a central policy assigns classifications and clearances. It is suitable for highly controlled environments.
• Role-based access control (RBAC): permissions are assigned to job roles, and users receive roles. It simplifies administration.
• Attribute-based access control (ABAC): decisions use attributes such as user department, device health, resource sensitivity and time.

The principle of least privilege gives a subject only the permissions necessary for its legitimate task. Separation of duties divides sensitive activities between people or roles so that one person cannot complete an abusive transaction alone. Privileges should be reviewed periodically, especially after job changes.

4. Firewalls and Network Segmentation

A firewall controls traffic between networks or security zones according to a policy. It may filter by source and destination address, protocol, port, connection state, application identity or user identity.

Common firewall types include:

• Packet-filtering firewalls: inspect header fields and apply rules.
• Stateful firewalls: track connection state and distinguish expected response traffic from unsolicited traffic.
• Proxy or application firewalls: relay traffic and inspect application content.
• Next-generation firewalls: combine stateful filtering with application awareness, identity integration and threat inspection.
• Web application firewalls: protect web applications against selected application-layer attacks.

A well-designed rule base follows least privilege. Rules should identify the source, destination, service, action and business justification. A default-deny approach blocks traffic unless a specific rule permits it. Rules should be ordered carefully, documented, tested and reviewed. Logging denied traffic can support investigation, but excessive logging can overwhelm storage and monitoring systems.

Segmentation divides a network into zones with controlled communication. Examples include user networks, server networks, guest wireless networks, management networks and a demilitarised zone (DMZ) for public-facing services. VLANs provide logical separation, but VLANs alone are not a complete security boundary; routing and filtering controls are also required.

Microsegmentation applies controls at a finer level, sometimes between individual workloads. It can limit lateral movement after an endpoint is compromised. Segmentation should reflect business flows rather than merely imitate organisational charts.

Zero Trust

Zero trust is a security approach based on the principle “never trust, always verify.” It does not mean that trust is impossible; it means that trust is not granted permanently merely because a user or device is inside a traditional perimeter. Access decisions should consider identity, device condition, resource sensitivity, context and policy. Continuous verification, least privilege and strong monitoring are central ideas.

5. Cryptography and Secure Communication

Cryptography protects information using mathematical algorithms and keys. It does not eliminate all risk: poor key management, compromised endpoints and social engineering can defeat strong algorithms.

Symmetric Encryption

Symmetric encryption uses the same secret key for encryption and decryption. It is efficient for large quantities of data and is used in disk encryption and secure sessions. The principal challenge is distributing the secret key securely.

Authenticated encryption modes, such as AES-GCM or ChaCha20-Poly1305, provide confidentiality and integrity together. A nonce or initialization value must be used according to the algorithm specification and must not be reused improperly with the same key.

Asymmetric Cryptography

Asymmetric cryptography uses a public key and a private key. The public key may be distributed widely, while the private key must remain protected. It supports key exchange, digital signatures and identity binding, but is generally more computationally expensive than symmetric encryption. Modern protocols commonly use asymmetric methods to establish or authenticate a session key, then use symmetric encryption for bulk data.

Hashing and Digital Signatures

A cryptographic hash maps input data to a fixed-length digest. A secure hash is designed so that it is computationally difficult to find an input producing a chosen digest or to find two different inputs with the same digest. Hashes are useful for integrity checking and password storage schemes, but a hash alone does not prove who created the data.

A digital signature is generated with a private signing key and verified with the corresponding public key. It provides evidence of integrity and origin under the assumptions that the private key is controlled by its owner and the verification key is trusted. Digital signatures do not automatically provide confidentiality.

Public-Key Infrastructure

A public-key infrastructure (PKI) manages public keys, private keys, certificates, identities and trust relationships. A digital certificate binds an identity to a public key and is signed by a certificate authority (CA). A browser or operating system trusts selected root CAs and can validate a chain from a server certificate to a trusted root.

Certificate validation includes checking the signature chain, validity period, subject name, key usage and revocation status where applicable. Private keys must be protected, certificates must be renewed, and compromised certificates must be revoked or otherwise distrusted. PKI is only as trustworthy as its identity-validation and key-management processes.

6. Secure Network Protocols

Protocols should be selected according to confidentiality, integrity, authentication, compatibility and operational requirements.

TLS protects a connection when correctly configured and when certificate validation is performed. It does not protect data after it reaches a compromised endpoint. Secure DNS technologies can improve authenticity or confidentiality of DNS queries, but they do not replace endpoint and application security.

Administrators should disable obsolete protocols, use supported cryptographic configurations, protect management interfaces, restrict administrative access and monitor authentication events.

7. Monitoring, Backup and Incident Response

Prevention cannot guarantee that incidents will not occur. Effective organisations prepare to detect, contain and recover from them.

A practical incident-response lifecycle is:

1. Preparation: establish policy, contacts, tools, backups, training and playbooks.
2. Detection and analysis: validate alerts, determine scope, preserve evidence and classify severity.
3. Containment: limit spread, isolate affected systems and protect critical services.
4. Eradication: remove malicious access, correct vulnerabilities and reset compromised credentials.
5. Recovery: restore trusted services, monitor closely and confirm normal operation.
6. Lessons learned: document causes, decisions, impacts and improvements.

Containment decisions require judgement. Disconnecting a machine may stop spread but can destroy volatile evidence or interrupt a critical service. Administrators should coordinate with management, legal advisers and, where necessary, law enforcement.

Logs should record relevant authentication, configuration, network and application events. Time synchronisation is important for reconstructing sequences. Logs should be protected against unauthorised alteration and retained according to policy and law.

Backups should be tested, protected from ransomware and separated from ordinary administrative credentials. A backup that has never been restored is an assumption, not a verified recovery capability.

8. Privacy, Ethics and Responsible Administration

Privacy concerns the appropriate collection, use, storage, sharing and deletion of information about identifiable people. Security and privacy overlap but are not identical. A system can be secure against outsiders while still collecting excessive data or using it for an unfair purpose.

Privacy-aware administration follows principles such as purpose limitation, data minimisation, accuracy, retention limitation, transparency and appropriate protection. Sensitive information should be encrypted where appropriate, access should be logged, and unnecessary copies should be removed securely.

Professional ethics require administrators to use authority responsibly. Administrators often possess powerful access that users cannot inspect. Ethical conduct includes:

• accessing information only for an authorised work purpose;
• avoiding curiosity-based browsing;
• maintaining confidentiality;
• reporting vulnerabilities responsibly;
• preserving evidence rather than altering it unnecessarily;
• documenting exceptional access;
• refusing unsafe or unlawful instructions; and
• informing affected parties through approved channels when incidents occur.

Monitoring should be proportionate, transparent where legally and operationally possible, and limited to a legitimate purpose. A technical ability to read a file does not create an ethical entitlement to read it.

Acceptable-Use Policies

An acceptable-use policy defines permitted and prohibited use of organisational systems. It should address account sharing, password handling, personal use, prohibited content, software installation, remote access, monitoring, reporting obligations and disciplinary consequences. Policies must be communicated, understandable and consistently enforced. A policy that users never see or cannot reasonably follow is ineffective governance.

Legal and Regulatory Compliance

Legal duties vary by jurisdiction and sector. They may involve data protection, breach notification, electronic communications, intellectual property, records retention, cybercrime and industry-specific requirements. Compliance is not identical to security: compliance establishes minimum obligations, while responsible security also addresses unrecognised and emerging risks.

Organisations should maintain an asset inventory, data classification scheme, risk register, policies, control ownership, audit evidence and an incident-notification process. They should obtain legal advice for jurisdiction-specific requirements rather than assuming that one country’s rules apply everywhere.

9. Governance and Security Management

Governance establishes direction, accountability and oversight. Management should define risk appetite, approve policies, allocate resources and review performance. Technical teams implement controls, but business owners remain responsible for deciding how important systems and data are.

A governance framework commonly includes:

• asset and data ownership;
• policy approval and review;
• risk assessment and treatment;
• change and configuration management;
• supplier and cloud-service assurance;
• training and awareness;
• audit and metrics; and
• continual improvement.

Useful metrics should support decisions rather than reward superficial activity. Examples include patch-age distribution, percentage of privileged accounts using multifactor authentication, backup restoration success, time to contain incidents and the number of high-risk findings overdue for treatment. Metrics require definitions and context; a high number of detected incidents may reflect improved visibility rather than deteriorating security.

10. Illustrative Case: Regional College Network

Background

A regional college operates student services, finance, teaching laboratories, staff offices and guest wireless access. Several servers are reachable from the student network, administrators share a remote-access password, and backups are connected continuously to the production domain.

Problem

A student installs malware on a laboratory computer. The malware obtains a stored administrator credential, reaches a file server and encrypts shared documents. The college has antivirus software but no network segmentation, no multifactor authentication and no tested offline backup.

Analysis

The incident combines excessive privilege, weak credential management, inadequate segmentation and insufficient recovery preparation. Antivirus detection was a useful preventive and detective control, but it could not compensate for architectural weaknesses.

Approach and Solution

The college first isolates affected laboratory machines, preserves relevant logs and resets privileged credentials. It then creates separate zones for laboratories, staff, servers, management and guests. Firewall rules permit only required flows. Administrative access uses a dedicated management network, SSH or HTTPS with strong authentication, and multifactor authentication. Shared administrator accounts are replaced with named accounts and role-based permissions.

Backups are redesigned using offline or immutable copies, access separation and scheduled restoration tests. The acceptable-use policy is updated, staff and students receive awareness training, and an incident playbook identifies technical, management, legal and communications contacts.

Outcome

The immediate incident is contained and services are restored from a verified backup. Later testing shows that a compromised laboratory account can no longer directly reach finance servers. Governance reviews are scheduled each term, and the college measures privileged-account coverage, patch status and recovery-test results.

Learning Points

The case demonstrates that security is a system of mutually supporting controls. A firewall alone would not solve shared credentials; encryption alone would not prevent excessive permissions; and a policy alone would not restore encrypted files. Effective protection combines architecture, identity, technology, people and governance.

11. Challenges and Contemporary Developments

Cloud computing distributes responsibility between the provider and customer. Customers must understand which party manages identity, network controls, operating systems, applications, encryption keys and backups. Misconfigured storage and excessive cloud permissions remain common practical risks.

Remote and hybrid work expand the trusted environment. Secure access should use managed devices, strong identity controls, endpoint monitoring and conditional access rather than relying only on a virtual private network.

Artificial intelligence can assist with log analysis, anomaly detection, malware classification and security-operations triage. However, AI systems can produce false positives, expose sensitive data, inherit biased training patterns or be manipulated by adversarial inputs. Human review, data governance and clear accountability remain necessary. Attackers also use automation and generative tools for phishing, reconnaissance and code production, increasing the importance of verification and layered controls.

No control is permanent. Software changes, new vulnerabilities, staff turnover, supplier dependencies and changing laws require periodic reassessment. Security is therefore a continuous management activity rather than a one-time installation.

Best-Practice Checklist

• Maintain an accurate inventory of systems, data and owners.
• Classify information according to sensitivity and business impact.
• Apply least privilege, separation of duties and regular access reviews.
• Use multifactor authentication for privileged and remote access.
• Segment users, servers, guests and management systems.
• Apply default-deny firewall policies where operationally appropriate.
• Use supported secure protocols and disable obsolete services.
• Protect, rotate and recover cryptographic keys appropriately.
• Centralise and protect logs; synchronise system time.
• Maintain tested, isolated and recoverable backups.
• Prepare and exercise an incident-response plan.
• Make privacy, acceptable use and legal duties part of operational practice.
• Review controls, suppliers, policies and risks continuously.

Chapter Summary

Network security protects confidentiality, integrity and availability while also supporting authenticity, accountability and privacy. Effective security begins with identifying assets, threats, vulnerabilities and impacts, then selecting layered controls. Identity management requires reliable authentication, least privilege, appropriate authorisation and auditing. Firewalls and segmentation restrict communication and reduce lateral movement, while zero-trust designs verify access continuously.

Symmetric encryption efficiently protects data, asymmetric cryptography supports key exchange and signatures, hashes support integrity and password protection, and PKI binds public keys to identities through certificates. Secure protocols such as SSH, HTTPS, SFTP and SNMPv3 should replace insecure alternatives. Monitoring, backups and incident response provide resilience when prevention fails.

Ethical administration requires confidentiality, proportional monitoring, responsible vulnerability handling and respect for authorised purpose. Governance assigns accountability through policies, risk management, audits, metrics and continual improvement. Legal compliance, privacy and acceptable-use requirements must be integrated into technical operations rather than treated as separate paperwork.

Key Terms

Confidentiality: Protection against unauthorised disclosure of information.

Integrity: Assurance that information is accurate and not improperly altered.

Availability: Accessibility of systems and data to authorised users when needed.

Threat: A potential cause of harm to an asset.

Vulnerability: A weakness that can be exploited.

Risk: The possibility and consequence of an adverse event.

Least privilege: Granting only the permissions necessary for a task.

Authentication: Verification of an identity claim.

Authorisation: Determination of permitted actions.

Multifactor authentication: Authentication using factors from at least two categories.

Firewall: A control that filters network traffic according to policy.

Segmentation: Division of a network into controlled security zones.

Zero trust: An approach that verifies access rather than assuming trust based on location.

Encryption: Transformation of readable data into protected ciphertext using a key.

Hash: A fixed-length digest produced from data by a cryptographic function.

Digital signature: A private-key-generated value used to verify origin and integrity.

PKI: The systems and processes used to manage keys, certificates and trust.

Incident response: Organised activities for detecting, containing, eradicating and recovering from incidents.

Governance: Direction, accountability and oversight of organisational security.

Privacy: Appropriate control over information relating to identifiable people.

Review Questions

5 Short Answer Questions

1. Define confidentiality, integrity and availability.
2. What is the difference between authentication and authorisation?
3. Why is least privilege important?
4. State two advantages of network segmentation.
5. What is the purpose of a digital certificate?

5 Long Answer Questions

1. Explain defence in depth and illustrate it with controls for a small organisation.
2. Compare DAC, MAC, RBAC and ABAC access-control models.
3. Describe the differences between symmetric encryption, asymmetric cryptography, hashing and digital signatures.
4. Explain the stages of the incident-response lifecycle.
5. Discuss how privacy, acceptable-use policies and governance influence technical administration.

3 Analytical / Application Questions

1. A company allows all internal computers to access its database server, uses shared administrator passwords and stores backups online. Identify the major risks and propose a prioritised improvement plan.
2. Design firewall zones and access rules for an organisation with public web servers, staff computers, a guest wireless network and a management network. Justify your design.
3. During an investigation, an administrator discovers that a colleague has accessed confidential student records without a work reason. Explain the ethical, technical and governance actions that should follow.

Multiple Choice Questions with Answers

Question 1

Which security property ensures that authorised users can access a service when required?

A. Confidentiality

B. Integrity

C. Availability

D. Non-repudiation

Correct Answer: C. Availability

Question 2

Which control gives users only the permissions necessary for their duties?

A. Least privilege

B. Data replication

C. Open authentication

D. Traffic flooding

Correct Answer: A. Least privilege

Question 3

Which authentication arrangement is genuine multifactor authentication?

A. Two different passwords

B. A password and a hardware security key

C. A username and an email address

D. Two security questions

Correct Answer: B. A password and a hardware security key

Question 4

What is the principal purpose of a default-deny firewall policy?

A. To permit all traffic unless malware is detected

B. To block traffic unless it is specifically authorised

C. To encrypt every file on a network

D. To replace the need for authentication

Correct Answer: B. To block traffic unless it is specifically authorised

Question 5

Which technique primarily divides a network into controlled security zones?

A. Segmentation

B. Hashing

C. Compression

D. Data deduplication

Correct Answer: A. Segmentation

Question 6

Which statement about hashing is correct?

A. It is normally reversible with a public key

B. It produces a fixed-length digest used to support integrity checking

C. It always provides confidentiality for network traffic

D. It distributes encryption keys between users

Correct Answer: B. It produces a fixed-length digest used to support integrity checking

Question 7

What does a digital certificate primarily bind together?

A. A password and a username

B. An identity and a public key

C. A firewall and a VLAN

D. A backup and a storage device

Correct Answer: B. An identity and a public key

Question 8

Which protocol is the preferred replacement for Telnet for secure remote administration?

A. FTP

B. HTTP

C. SSH

D. SNMPv1

Correct Answer: C. SSH

Question 9

What is the first stage in the incident-response lifecycle described in this chapter?

A. Eradication

B. Preparation

C. Recovery

D. Lessons learned

Correct Answer: B. Preparation

Question 10

Which action best reflects responsible privacy-aware administration?

A. Reading any file technically accessible to the administrator

B. Collecting all possible user data indefinitely

C. Accessing personal information only for an authorised work purpose

D. Sharing logs publicly to demonstrate transparency

Correct Answer: C. Accessing personal information only for an authorised work purpose