Network, Endpoint and Infrastructure Security

Introduction and Context

Modern organisations depend on interconnected networks, servers, cloud services, workstations, mobile devices, wireless access points and operational technology. This interdependence improves efficiency but also creates pathways through which attackers can compromise confidentiality, integrity and availability. Network, endpoint and infrastructure security therefore concerns more than installing a firewall. It is the coordinated protection of communication paths, computing devices, identity systems, configurations, software, data and recovery capabilities.

A useful security design assumes that no single control is sufficient. Firewalls can be bypassed, endpoint software can be disabled, vulnerabilities can remain unknown, and legitimate accounts can be misused. Effective protection combines preventive, detective, corrective and compensating controls. It also applies the principles of least privilege, defence in depth, secure-by-default configuration, network segmentation and continuous monitoring.

Learning Objectives

By the end of this chapter, a learner should be able to:

• explain the security characteristics and common weaknesses of important network protocols;
• distinguish packet-filtering, stateful, proxy and next-generation firewalls;
• describe VPNs, intrusion detection and prevention systems, endpoint protection and network segmentation;
• apply system-hardening, patch-management, backup and baseline-control practices;
• propose a secure architecture for servers, workstations and wireless networks;
• evaluate operational, ethical and governance issues in infrastructure security.

1. Network Protocols and Their Weaknesses

A protocol is a defined set of rules that enables systems to communicate. Protocols may specify addressing, routing, connection establishment, error handling, encryption and authentication. Security weaknesses commonly arise when a protocol transmits information in plaintext, trusts unauthenticated participants, accepts poorly validated input, or was designed before modern threat models existed.

1.1 The layered model

The OSI model divides communication into seven conceptual layers: physical, data link, network, transport, session, presentation and application. The TCP/IP model commonly groups these into link, internet, transport and application layers. Layering improves interoperability, but it also means that an attack at one layer may affect services at another. For example, an attacker may exploit a vulnerable application through a permitted TCP connection, while a denial-of-service attack may target routing or transport behaviour.

Important protocols include:

A secure protocol does not automatically create a secure system. HTTPS, for example, protects data in transit when certificates are correctly validated, but it does not prevent a vulnerable web application from accepting malicious input. Security must therefore be considered end to end.

1.2 Common network attacks

Reconnaissance identifies hosts, ports, technologies and organisational information. Port scanning is not necessarily an intrusion, but it may precede exploitation. Eavesdropping captures traffic on an unprotected medium. Man-in-the-middle attacks alter or relay communication between parties. Spoofing falsifies an address, identity or sender. Replay attacks reuse captured valid messages. Denial-of-service attacks exhaust bandwidth, connection tables, processing capacity or application resources. Tunnelling hides unauthorised data inside an allowed protocol, such as DNS or HTTPS.

Controls include encryption, strong authentication, certificate validation, ingress and egress filtering, rate limiting, network monitoring, secure DNS, segmentation and secure management channels.

2. Firewalls and Traffic Control

A firewall mediates traffic between security zones according to a policy. Its basic decision is whether a connection or packet should be permitted, denied, rejected or logged. A firewall may be a dedicated appliance, a host-based service, a cloud control or a virtual network function.

2.1 Firewall types

• Packet-filtering firewalls examine fields such as source address, destination address, protocol and port. They are efficient but have limited awareness of connection state and application meaning.
• Stateful firewalls maintain a state table and distinguish packets belonging to established connections from unsolicited traffic. They provide stronger control than simple stateless filtering.
• Proxy or application firewalls terminate a connection and create a separate connection to the destination. They can inspect application content but may introduce latency and require protocol-specific support.
• Next-generation firewalls commonly combine stateful inspection with application identification, user awareness, intrusion-prevention functions and content controls. Their effectiveness depends on accurate signatures, updates, configuration and visibility.
• Web application firewalls focus on HTTP and HTTPS traffic, helping address attacks such as injection and malicious request manipulation. They do not replace secure application development.
• Host-based firewalls protect individual servers and workstations, including traffic that never crosses a perimeter firewall.

2.2 Firewall policy design

A professional policy should follow least privilege: allow only traffic required for a defined business purpose. Rules should identify source, destination, service, direction, user or application where possible, time restrictions and logging requirements. A default-deny posture is preferable, provided that required services are explicitly allowed and operational teams can manage exceptions safely.

Rules should be ordered carefully because many devices process the first matching rule. Broad rules placed above specific rules can unintentionally allow dangerous traffic. Unused rules, temporary exceptions and obsolete objects should be removed. Administrative access should be restricted, strongly authenticated and logged. Firewall logs should be sent to a protected central system and reviewed for meaningful events rather than merely collected.

A firewall cannot solve attacks that use permitted traffic, compromised credentials or vulnerable internal systems. It must therefore operate with endpoint controls, identity controls, secure configurations and monitoring.

3. VPNs and Secure Remote Access

A virtual private network creates a protected logical connection across an untrusted or shared network. A VPN may provide confidentiality, integrity and authentication, depending on its protocol and configuration. Common forms include site-to-site VPNs connecting networks and remote-access VPNs connecting individual users or devices.

VPN security depends on more than encryption. The organisation must authenticate users and devices, limit reachable resources, manage cryptographic keys, apply patches, log connections and revoke access promptly. Multifactor authentication reduces the impact of stolen passwords. Full network access for every remote user is risky; application-specific or zero-trust access may provide narrower exposure.

VPNs also create concentration points. A compromised VPN account may provide a pathway into sensitive networks, and a vulnerable VPN appliance may be directly exposed to the internet. Therefore, VPN gateways require rapid patching, secure administration, strong logging, configuration backups and continuous review of accounts and routes.

4. Intrusion Detection and Prevention

An intrusion detection system (IDS) identifies suspicious activity and generates an alert. An intrusion prevention system (IPS) is placed inline or otherwise integrated so that it can block or modify traffic. Both may be network-based or host-based.

Detection approaches include:

• Signature detection, which matches known patterns. It is effective for known threats but weak against novel or substantially modified attacks.
• Anomaly detection, which compares activity with an established baseline. It can identify unusual behaviour but may generate false positives when legitimate behaviour changes.
• Behavioural or heuristic analysis, which evaluates sequences and characteristics rather than one exact pattern.
• Threat-intelligence correlation, which combines local observations with information about malicious infrastructure, techniques and campaigns.

Detection quality depends on sensor placement. Sensors may monitor internet boundaries, data-centre segments, wireless networks, cloud environments or hosts. Alerts need triage: an alert is not automatically evidence of compromise. Analysts should validate context, affected assets, account activity, time, related events and business impact.

IPS blocking can cause disruption if detection is inaccurate. A balanced deployment often uses carefully tested prevention for high-confidence events while initially monitoring lower-confidence detections. Logs should support incident response and comply with retention, privacy and access requirements.

5. Endpoint Protection

An endpoint is a device that connects to a network, including a workstation, laptop, server, mobile device, virtual machine or specialised appliance. Endpoint security aims to prevent compromise, detect malicious activity, limit attacker movement and support recovery.

Core controls include:

• supported operating systems and applications;
• automatic or centrally managed security updates;
• endpoint detection and response (EDR);
• anti-malware and exploit protection;
• host-based firewalls;
• disk encryption and secure boot where supported;
• application allowlisting for high-value systems;
• removal of unnecessary services and local administrator rights;
• device control for removable media;
• secure configuration management;
• central logging and time synchronisation.

Traditional anti-malware commonly uses signatures and reputation data. EDR adds telemetry about processes, files, users, persistence mechanisms and network connections. It can support investigation and containment, but it requires skilled monitoring, adequate storage and carefully defined response authority. Security tools themselves must be protected from unauthorised disabling.

Servers require role-specific hardening. A database server should not run unrelated file-sharing or desktop services. Management interfaces should be reachable only from administration networks. Workstations need browser, email, identity and privilege controls because they are frequent entry points for phishing and malicious documents.

6. Segmentation and Secure Architecture

Segmentation divides a network into zones with controlled communication between them. It reduces attack surface and limits lateral movement. Typical zones include internet-facing services, user workstations, server networks, management networks, backup systems, guest wireless, development environments and operational technology.

Segmentation can be physical, virtual, logical or identity-based. VLANs separate broadcast domains, but a VLAN alone is not a complete security boundary; routing and access-control enforcement are also required. Microsegmentation applies more granular policy around workloads or applications.

A practical design begins with asset and data-flow mapping. For each communication path, ask: who initiates it, what service is needed, what data crosses the boundary, how is the identity verified, and what happens if the connection is compromised? Policies should deny unnecessary east-west traffic, not merely protect the external perimeter.

The zero-trust model reinforces this approach. It does not mean that trust is impossible; it means that access decisions should be based on verified identity, device condition, resource, context and policy rather than network location alone. Access should be least-privileged, continuously evaluated where feasible and recorded for accountability.

7. System Hardening and Baseline Controls

Hardening is the deliberate reduction of unnecessary functionality and exposure. A baseline is an approved minimum configuration against which systems can be measured. Baselines should be tailored to system role and risk rather than copied blindly.

A hardening process commonly includes:

1. inventory the asset, owner, purpose, dependencies and data classification;
2. install a supported operating system from a trusted source;
3. remove unnecessary packages, accounts, services, ports and software;
4. apply secure authentication, privilege and lockout settings;
5. configure host firewalls, logging, time synchronisation and encryption;
6. apply tested security updates;
7. restrict administrative interfaces to trusted networks;
8. scan and manually review the configuration;
9. document exceptions, obtain approval and monitor drift.

Configuration benchmarks can provide technical guidance, but they require interpretation. Excessive restrictions may break business processes and encourage informal workarounds. Every exception should have an owner, justification, compensating control and review date.

Patch and vulnerability management

Patching is a risk-management process, not merely a technical installation task. Organisations should discover assets, identify vulnerabilities, assess exploitability and business impact, prioritise remediation, test updates, deploy in stages and verify results. Internet-facing and actively exploited vulnerabilities generally receive urgent treatment. Unsupported software requires replacement, isolation or a formally approved exception.

Vulnerability scanners identify likely weaknesses, but results may include false positives and do not prove that a system is secure. Authenticated scans, configuration assessment, penetration testing and operational validation provide complementary evidence.

Backups and recovery

Backups protect availability and support recovery from ransomware, accidental deletion, hardware failure and operational mistakes. A sound strategy defines recovery point objectives (RPOs), the maximum tolerable data-loss interval, and recovery time objectives (RTOs), the target time to restore a service.

Backups should be protected from alteration, encrypted when appropriate, access-controlled, monitored and tested through restoration exercises. A common resilience principle is to retain multiple copies, use different media or environments, and maintain at least one copy isolated from ordinary administrative credentials. A backup that has never been restored in a test is an assumption, not demonstrated resilience.

8. Wireless Network Security

Wireless networks extend the attack surface beyond physically controlled cabling. Risks include rogue access points, weak authentication, evil-twin networks, radio interception, misconfigured guest access and denial of service.

Enterprise wireless should use modern protected authentication, preferably individual identity-based access rather than a shared password. Management frames and encryption should be configured according to supported standards. Guest networks should be isolated from internal systems and should receive only the services required. Default administrator credentials must be changed, firmware maintained and management access restricted.

Wireless security also requires physical and radio-frequency awareness. Signal leakage beyond the intended area, unauthorised devices and poorly placed access points can undermine logical controls. Monitoring should identify rogue devices and unusual associations without collecting unnecessary personal information.

9. Governance, Ethics and Professional Practice

Infrastructure security involves surveillance, access to personal data and decisions that can affect employees and customers. Monitoring should have a legitimate purpose, proportional scope, defined retention period and controlled access. Organisations should inform users through appropriate policies and comply with applicable privacy, employment, records-management and breach-notification requirements.

Security professionals must avoid scanning or testing systems without permission. Vulnerability research, penetration testing and incident response require documented scope, rules of engagement and protection of discovered information. Controls should not discriminate unfairly through poorly designed automated decisions. AI-based detection may help prioritise events, but its outputs can be biased, opaque or wrong; human validation and auditability remain important.

Applied Case: Illustrative Regional Health Network

Background

A fictional regional health network operates clinics, a central hospital, electronic health-record servers, medical devices, staff workstations and public guest Wi-Fi. It previously used a flat internal network and allowed remote access through a shared VPN account.

Problem

A phishing email led to the compromise of a receptionist’s credentials. The attacker accessed the VPN, moved from a workstation to a file server and encrypted shared documents. Backups were connected with ordinary administrator credentials and were also affected. Clinical operations were disrupted.

Analysis

The incident was enabled by several weaknesses rather than one failure: shared remote authentication, insufficient multifactor authentication, flat segmentation, excessive workstation privileges, inadequate monitoring of east-west traffic, and poorly isolated backups. The perimeter firewall had allowed the VPN service, but that permitted service became an entry point.

Approach and solution

The organisation first isolated affected systems and preserved evidence. It reset credentials, revoked sessions, checked persistence and restored critical services from protected recovery copies. It then implemented individual VPN identities with multifactor authentication and restricted remote users to required applications. Clinical devices, user workstations, servers, management systems and guest wireless were placed in separate zones. Inter-zone rules were documented and default-deny where practical.

Endpoints received centrally managed EDR, host firewalls, removal of local administrator rights and application updates. Backups were redesigned with protected copies, separate credentials and scheduled restoration tests. Critical logs were forwarded to a monitored platform, and incident exercises were conducted with clinical and technical staff.

Outcome

The network became more resistant to credential theft and lateral movement. Recovery time improved because backup restoration was tested and responsibilities were defined. Some legacy medical devices could not support modern agents, so they were isolated, monitored and placed under compensating controls pending replacement.

Learning points

Security architecture must account for legacy systems and operational constraints. Strong perimeter controls cannot compensate for weak identity, segmentation and recovery practices. The most valuable improvements often combine technical controls with governance, training, asset ownership and tested procedures.

Challenges and Limitations

No control eliminates risk. Encryption can be misconfigured; segmentation can be bypassed by trusted administration; IDS systems can miss novel attacks; EDR can generate excessive alerts; patching can conflict with availability; and backups can contain corrupted or malicious data. Cloud and hybrid environments also complicate ownership because responsibility is divided between provider and customer.

Organisations should measure more than the number of tools installed. Useful indicators include the percentage of assets with known owners, patch compliance by risk category, time to remediate critical vulnerabilities, percentage of privileged accounts protected by multifactor authentication, alert investigation time, backup restoration success and the age of approved exceptions. Metrics should guide improvement rather than reward superficial compliance.

Best-Practice Checklist

• Maintain an accurate asset and data-flow inventory.
• Use least privilege and default-deny policies where operationally suitable.
• Separate user, server, management, backup, guest and high-risk environments.
• Protect remote access with individual identities and multifactor authentication.
• Harden systems using approved, role-specific baselines.
• Patch supported systems according to risk and verify deployment.
• Centralise important logs and monitor for meaningful behaviour.
• Protect, isolate and regularly restore-test backups.
• Review firewall, VPN, wireless and privileged-access rules regularly.
• Document exceptions, compensating controls and review dates.
• Test incident response and recovery with technical and business participants.

Chapter Summary

Network, endpoint and infrastructure security is a coordinated discipline based on layered controls. Protocols may expose weaknesses through plaintext communication, weak authentication, spoofing or excessive trust. Firewalls enforce traffic policy, while VPNs protect remote connections when combined with strong identity and access restrictions. IDS and IPS technologies detect or block suspicious activity, but require suitable placement, tuning and skilled response.

Endpoint protection combines hardening, patching, host firewalls, encryption, EDR, privilege control and central monitoring. Segmentation limits attack paths and supports zero-trust access decisions. Secure infrastructure also depends on role-specific baselines, tested backups, recovery objectives and secure wireless design. Governance, privacy, authorised testing and human oversight are essential because technical controls affect people and organisational operations. Effective security is therefore a continuous process of prevention, detection, response, recovery and improvement.

Key Terms

Protocol: Agreed rules that govern communication between systems.

Firewall: A control that permits, denies or inspects network traffic according to policy.

Stateful inspection: Firewall processing that tracks the state of network connections.

VPN: A protected logical connection across an untrusted or shared network.

IDS: A system that detects and reports suspected malicious activity.

IPS: A system that can actively block or alter suspected malicious traffic.

Endpoint: A network-connected device such as a workstation, server or mobile device.

EDR: Endpoint detection and response technology that collects telemetry and supports investigation and containment.

Hardening: Reducing unnecessary functionality, privilege and exposure.

Baseline: An approved minimum configuration for a defined system role.

Segmentation: Dividing a network into zones with controlled communication.

Microsegmentation: Fine-grained control of communication between workloads or services.

Least privilege: Giving users and processes only the access required for their duties.

Zero trust: An access approach that verifies identity, device and context rather than trusting network location.

RPO: The maximum acceptable period of data loss measured in time.

RTO: The target time for restoring a service after disruption.

Spoofing: Falsifying an identity, address or source characteristic.

Lateral movement: An attacker’s progression between systems after initial access.

Compensating control: An alternative safeguard used when a preferred control is not feasible.

Configuration drift: Unintended change from an approved secure baseline.

Review Questions

Short Answer Questions

1. What is the main security difference between HTTP and HTTPS?
2. Why is a default-deny firewall policy generally preferred?
3. Distinguish an IDS from an IPS.
4. What is the purpose of network segmentation?
5. Define RPO and RTO.

Long Answer Questions

1. Explain how protocol weaknesses can enable eavesdropping, spoofing and man-in-the-middle attacks, and describe suitable controls.
2. Compare packet-filtering, stateful, proxy and next-generation firewalls.
3. Describe a complete system-hardening and patch-management process for a server.
4. Explain how endpoint protection, segmentation and identity controls work together to limit lateral movement.
5. Discuss the technical and governance requirements for a resilient backup and recovery programme.

Analytical / Application Questions

1. A company permits all internal users to reach every server after authenticating through a VPN. Analyse the risks and propose a redesigned remote-access and segmentation model.
2. A hospital cannot immediately replace legacy medical devices that do not support modern endpoint agents. Recommend compensating controls and explain their limitations.
3. A ransomware incident encrypts production data, online backups and several workstations. Evaluate which preventive and recovery controls failed, and design a prioritised improvement plan.

Multiple Choice Questions with Answers

Question 1

Which firewall capability tracks whether packets belong to an established connection?

A. Stateful inspection

B. Cable shielding

C. Data deduplication

D. Disk encryption

Correct Answer: A. Stateful inspection

Question 2

What is the primary purpose of network segmentation?

A. To eliminate the need for authentication

B. To limit communication paths and lateral movement

C. To make all services publicly accessible

D. To replace backups

Correct Answer: B. To limit communication paths and lateral movement

Question 3

Which technology is most directly associated with collecting endpoint process and connection telemetry?

A. DHCP

B. EDR

C. NAT

D. SMTP

Correct Answer: B. EDR

Question 4

Which practice best protects a remote-access VPN from stolen passwords?

A. Using a shared account

B. Disabling logging

C. Requiring multifactor authentication

D. Allowing unrestricted network access

Correct Answer: C. Requiring multifactor authentication

Question 5

What does a default-deny firewall policy do?

A. Allows all traffic unless a signature detects malware

B. Blocks traffic unless an explicit rule permits it

C. Encrypts every packet automatically

D. Permits only wireless traffic

Correct Answer: B. Blocks traffic unless an explicit rule permits it

Question 6

Which statement correctly distinguishes RPO from RTO?

A. RPO concerns acceptable data loss; RTO concerns restoration time

B. RPO concerns firewall rules; RTO concerns encryption keys

C. RPO is a password policy; RTO is a scanning method

D. RPO and RTO are identical terms

Correct Answer: A. RPO concerns acceptable data loss; RTO concerns restoration time

Question 7

Why is a VLAN alone not necessarily a complete security boundary?

A. VLANs cannot separate broadcast domains

B. Routing and access controls may still permit unwanted communication

C. VLANs automatically disable encryption

D. VLANs only operate on endpoint devices

Correct Answer: B. Routing and access controls may still permit unwanted communication

Question 8

Which is an example of a compensating control?

A. Isolating an unpatchable legacy device and monitoring it closely

B. Removing all logs from the device

C. Publishing its management interface to the internet

D. Sharing its administrator password

Correct Answer: A. Isolating an unpatchable legacy device and monitoring it closely

Question 9

What is a major limitation of signature-based intrusion detection?

A. It cannot identify any known threat

B. It is generally weak against novel or substantially modified attacks

C. It prevents all false positives

D. It replaces incident response

Correct Answer: B. It is generally weak against novel or substantially modified attacks

Question 10

Which wireless practice provides the strongest enterprise approach among these options?

A. Using one shared password for all staff indefinitely

B. Leaving the manufacturer administrator password unchanged

C. Using individual identity-based authentication and isolating guest access

D. Allowing guest devices onto the server network

Correct Answer: C. Using individual identity-based authentication and isolating guest access