Network Security Principles and Risk

Introduction

Network security is the discipline of protecting networked systems, communications, services, and data from unauthorized access, misuse, disruption, alteration, and destruction. It includes technical controls such as firewalls and encryption, administrative controls such as policies and training, and physical controls such as secure facilities and device protection.

Modern organizations depend on networks for identity management, cloud services, payment processing, operational technology, remote work, and communication. Consequently, network security is not limited to protecting a perimeter. A laptop outside the office, a cloud application, a supplier connection, a wireless access point, and an application programming interface may all become paths into organizational information systems.

This chapter introduces the principles used to design and evaluate secure networks. It also explains how to identify risks, prioritize safeguards, and understand why no single security mechanism is sufficient.

Learning Objectives

By the end of this chapter, you should be able to:

• explain confidentiality, integrity, and availability;
• distinguish authentication, authorization, and accountability;
• apply least privilege and separation of duties;
• explain defense in depth and zero trust;
• identify assets, threats, vulnerabilities, attack surfaces, and controls;
• perform a basic qualitative and quantitative risk assessment;
• recommend proportionate security controls;
• discuss ethical, governance, and operational limitations of security decisions.

1. The Security Objectives: The CIA Triad

The CIA triad is a foundational model for information and network security.

Confidentiality

Confidentiality means that information is available only to authorized subjects. A subject may be a person, device, process, or service. Examples include restricting payroll records to authorized staff and preventing an eavesdropper from reading traffic on a public wireless network.

Controls supporting confidentiality include:

• encryption in transit and at rest;
• access control lists and identity-based permissions;
• data classification and handling rules;
• network segmentation;
• secure authentication;
• prevention of information leakage.

Confidentiality is not identical to secrecy. An organization may legitimately share information with approved partners while still maintaining confidentiality against unauthorized parties.

Integrity

Integrity is the accuracy, completeness, and trustworthiness of information and systems. Integrity protection helps ensure that a transaction, configuration, software package, or log has not been altered improperly.

Controls include cryptographic hashes, digital signatures, file integrity monitoring, change control, version management, input validation, and write restrictions. A hash can help detect change, but it does not by itself prove who made the change or whether the original content was trustworthy.

Availability

Availability means that authorized users can access systems and information when required. Availability includes more than uptime. It also involves adequate capacity, maintainability, resilience, recoverability, and timely support.

Controls include redundancy, backups, failover, capacity planning, patching, denial-of-service protection, disaster recovery, and incident response. Availability decisions require balancing cost and operational need. A system requiring continuous operation will usually need stronger resilience than a low-impact internal application.

The three objectives can conflict. Strong confidentiality controls may make access slower; extensive integrity checks may consume processing resources; and a highly available service may expose more interfaces. Security design therefore requires risk-based trade-offs rather than maximizing one objective in isolation.

2. Identity and Access Control

Access control answers three related questions: Who or what is requesting access? What is it allowed to do? Can the action be traced afterward?

Authentication

Authentication is the process of verifying an identity claim. Common authentication factors are:

1. Something the user knows, such as a password or personal identification number.
2. Something the user has, such as a hardware token or registered phone.
3. Something the user is, such as a fingerprint or facial characteristic.
4. Somewhere the user is, such as a trusted location.
5. Something the user does, such as a behavioral pattern.

Multi-factor authentication uses two or more independent factor categories. Entering a password and approving a request on the same compromised device may provide less protection than a password combined with a hardware security key.

Authentication is weakened by password reuse, phishing, credential stuffing, insecure recovery procedures, shared accounts, and poorly protected session tokens. Effective practice includes phishing-resistant methods where feasible, secure password storage, rate limiting, session expiration, and prompt removal of accounts that are no longer needed.

Authorization

Authorization determines which actions an authenticated subject may perform on particular resources. A user may be authenticated successfully but still lack authorization to read a database or modify a firewall rule.

Common authorization models include:

• Discretionary access control (DAC): resource owners may grant permissions.
• Mandatory access control (MAC): a central policy uses classifications and clearances.
• Role-based access control (RBAC): permissions are assigned to job roles.
• Attribute-based access control (ABAC): decisions use attributes such as user role, device state, resource sensitivity, and location.

Authorization should be explicit, reviewable, and deny access by default where appropriate. Permissions should be checked on every sensitive operation, not only when a user initially signs in.

Accountability and Non-repudiation

Accountability links actions to responsible identities through logs, audit trails, monitoring, and review. Logs should record relevant events such as successful and failed authentication, privilege changes, administrative actions, and security alerts. They should be protected against unauthorized alteration and retained according to legal, operational, and privacy requirements.

Non-repudiation is stronger than ordinary logging. It seeks evidence that makes it difficult for a party to deny a recorded action, often through digital signatures, trusted timestamps, and controlled key management. No technical mechanism eliminates all disputes; organizational procedures and reliable evidence remain important.

3. Least Privilege and Separation of Duties

The principle of least privilege states that a subject should receive only the permissions necessary to perform an authorized task, for only as long as those permissions are needed.

Least privilege reduces the consequences of stolen credentials, malware, insider misuse, and programming errors. Practical applications include separate standard and administrative accounts, just-in-time elevation, restricted service accounts, network segmentation, and removal of unused permissions.

Least privilege is not the same as giving everyone minimal access regardless of work requirements. Excessive restriction can cause unsafe workarounds, shared accounts, and productivity failures. Permissions must therefore be designed around legitimate tasks and reviewed regularly.

Separation of duties divides a sensitive process among multiple people or systems. For example, one employee may prepare a payment while another approves it. In network operations, a person who requests a firewall change may be different from the person who reviews and implements it. This reduces the likelihood that one compromised or dishonest actor can complete an entire harmful process.

4. Defense in Depth

Defense in depth uses multiple independent or partially independent safeguards so that failure of one control does not expose the entire environment. A layered design may include:

1. physical security for facilities and devices;
2. secure configuration of endpoints and network equipment;
3. identity and access controls;
4. firewalls and network segmentation;
5. endpoint detection and response;
6. encryption and application security;
7. logging, monitoring, and alerting;
8. backups, recovery, and incident response.

The value of layers is not simply the number of controls. Layers should address different failure modes. Two tools that rely on the same identity provider or the same unpatched appliance may fail together. Defense in depth is strongest when controls are diverse, independently monitored, and tested.

A firewall, for example, may block an unwanted inbound connection but will not necessarily stop a valid user from downloading malware, prevent an insider from misusing an authorized account, or correct a vulnerable application. Layered protection addresses these different pathways.

5. Zero Trust

Zero trust is a security approach based on the principle that access should not be trusted merely because a request originates inside a traditional network perimeter. Each request should be evaluated using relevant evidence and policy.

Important zero-trust ideas include:

• verify explicitly using identity, device, application, and contextual information;
• apply least-privilege access;
• assume that compromise is possible;
• continuously monitor and adapt access decisions;
• segment resources and limit lateral movement;
• protect data and workloads regardless of location.

Zero trust does not mean that every request must be manually approved, nor does it require eliminating all internal networks. It means that network location alone is insufficient evidence of trust. Automated policy engines, strong identity, device security, application gateways, micro-segmentation, and effective telemetry can support the approach.

Implementation challenges include legacy systems, incomplete asset inventories, unreliable identity data, excessive complexity, privacy concerns, and insufficient monitoring. Zero trust is therefore a program of architectural and operational improvement rather than a single product.

6. Attack-Surface Analysis

An attack surface is the collection of points through which an unauthorized party might attempt to enter, influence, observe, or disrupt an organization’s systems. It includes technical, human, physical, and supply-chain elements.

Categories of Attack Surface

• External digital surface: public IP addresses, domains, web applications, remote access services, cloud storage, and exposed APIs.
• Internal digital surface: endpoints, servers, databases, internal applications, wireless networks, and administrative interfaces.
• Human surface: phishing targets, privileged administrators, contractors, and help-desk processes.
• Physical surface: offices, network cabinets, removable media, and unattended devices.
• Supply-chain surface: software dependencies, managed service providers, hardware suppliers, and partner connections.

Attack-surface analysis begins with an accurate inventory. An organization cannot protect assets it does not know exist. A basic process is:

1. identify business services and information assets;
2. discover systems, interfaces, identities, data flows, and dependencies;
3. determine which elements are exposed and why;
4. identify weaknesses and possible attack paths;
5. prioritize remediation by business impact and likelihood;
6. validate that exposure has been reduced.

Useful evidence includes vulnerability scans, configuration reviews, cloud inventories, DNS records, firewall rules, application inventories, identity directories, and interviews with system owners. Scanning must be authorized and carefully controlled because it can disrupt fragile systems or violate legal boundaries.

7. Threats, Vulnerabilities, and Risk

A threat is a potential cause of harm, such as a criminal group, malicious insider, natural hazard, software failure, or accidental human action. A vulnerability is a weakness that could be exploited or triggered. An asset is something valuable that requires protection. A control is a safeguard that reduces likelihood, impact, or both.

Risk expresses the possibility that a threat will exploit a vulnerability and cause harm. Risk is not identical to danger, vulnerability, or incident. A vulnerability may exist without being exploited, and an incident may occur even when the precise risk was not previously recognized.

Qualitative Risk Assessment

A practical certificate-level assessment can rate likelihood and impact as Low, Medium, or High. For example:

A risk matrix combines the two ratings to support prioritization. The matrix is a decision aid, not a scientific law. Organizations should define ratings consistently and document assumptions.

Basic Quantitative Assessment

A commonly used screening estimate is:

Here, SLE is the single-loss expectancy, AV is the asset value in monetary units, and EF is the exposure factor, expressed as a proportion from 0 to 1. The calculation assumes that the selected asset value and percentage loss are meaningful for the event being analyzed.

If an application and its associated response costs are valued at $100,000 and a particular incident is expected to destroy or make unavailable 40% of that value, then:

If the event is expected to occur 0.25 times per year, the annualized loss expectancy is:

ALE is annualized loss expectancy, and ARO is the annual rate of occurrence. Therefore:

These estimates are uncertain. They should not be treated as precise predictions, and they should not be compared with control costs without considering implementation cost, residual risk, legal duties, safety, dependencies, and non-financial consequences.

Risk Treatment

Organizations commonly choose one or more of four treatments:

• Avoid: discontinue the risky activity.
• Mitigate: reduce likelihood or impact using controls.
• Transfer: share financial or contractual consequences, for example through insurance or a service agreement.
• Accept: knowingly retain the risk within approved tolerance.

Risk acceptance should be explicit and assigned to an accountable decision-maker. It should not occur merely because remediation is inconvenient.

8. Controls and Their Selection

Controls may be classified by function:

• Preventive controls attempt to stop an unwanted event, such as access restrictions.
• Detective controls identify events, such as intrusion alerts and log analysis.
• Corrective controls restore or repair, such as malware removal.
• Deterrent controls discourage harmful action, such as visible monitoring notices.
• Compensating controls provide alternative protection when the preferred control is unavailable.

Controls may also be administrative, technical, or physical. Effective programs combine all three. A written password policy without technical enforcement may have limited value; a technical control without training or ownership may be misconfigured; and a locked server room does not protect a public web application from code-level attacks.

Control selection should consider risk reduction, cost, usability, maintainability, interoperability, legal obligations, and possible unintended effects. Security controls themselves can introduce risks, including privacy intrusion, service outages, false alarms, and concentration of power in administrators.

9. Applied Case: A Small Online Retailer

The following is an illustrative case.

Background

Northstar Books is a small online retailer with a public web store, a cloud-based payment service, an internal inventory system, ten employees, and a remote-access service for administrators. The company has grown rapidly and has no complete asset inventory.

Problem

A review finds that the administrative interface is reachable from the internet, several employees share an account, former contractors still have active accounts, and security logs are retained for only two days. The business assumes that its web host’s firewall provides complete protection.

Analysis

The retailer’s assets include customer contact information, order records, administrator credentials, inventory data, and service availability. Threats include credential theft, web exploitation, ransomware, payment fraud, and accidental deletion. Vulnerabilities include excessive exposure, weak identity lifecycle management, shared accountability, and inadequate recovery evidence.

The public administrative interface creates unnecessary attack surface. Shared accounts prevent reliable attribution and make least privilege difficult. Short log retention reduces the ability to investigate. The assumption that one firewall is sufficient violates defense-in-depth principles.

Approach and Solution

Northstar should first document systems, data flows, owners, and dependencies. It should then:

1. place administration behind a controlled access gateway or VPN with multi-factor authentication;
2. remove inactive accounts and establish joiner, mover, and leaver procedures;
3. replace shared accounts with named identities and role-based permissions;
4. separate administrative and ordinary user accounts;
5. restrict access to inventory data according to job duties;
6. enable centralized, protected logging with an appropriate retention period;
7. implement tested backups and recovery procedures;
8. patch and scan the web application under authorized procedures;
9. review supplier security responsibilities and incident notification terms;
10. test the controls and reassess residual risk.

Outcome

The approach reduces externally exposed services, improves accountability, limits the damage from compromised credentials, and strengthens recovery. It does not eliminate risk. A compromised authorized user, vulnerable supplier, or software defect may still create exposure, so monitoring and periodic reassessment remain necessary.

Learning Points

The case demonstrates that network security is a system of mutually reinforcing principles. Authentication without authorization is insufficient; authorization without least privilege is dangerous; preventive controls without detection delay response; and technology without ownership and process produces unreliable protection.

10. Governance, Ethics, and Contemporary Practice

Security professionals have authority that can affect privacy, employment, access to services, and organizational continuity. Monitoring should be necessary, proportionate, transparent where appropriate, and governed by policy and applicable law. Security testing must be authorized, scoped, documented, and conducted with care for availability and personal data.

Organizations should define responsibilities for asset owners, system administrators, users, security teams, suppliers, and senior decision-makers. Policies should address acceptable use, access reviews, incident reporting, retention, vulnerability disclosure, and exceptions.

Contemporary environments increasingly combine cloud services, mobile devices, software-defined networks, application programming interfaces, and artificial intelligence systems. These technologies can improve detection and automate response, but they also create new dependencies and attack paths. AI-assisted security tools may generate false positives, expose sensitive telemetry, or make opaque decisions. Human oversight, testing, data governance, and controlled permissions remain necessary.

Best practices include maintaining an accurate inventory, using secure configuration baselines, applying timely patches, enforcing strong identity controls, segmenting sensitive systems, protecting backups, centralizing logs, testing incident response, reviewing suppliers, and measuring whether controls actually reduce risk.

Challenges and Limitations

No security model provides absolute protection. Common limitations include:

• incomplete inventories and inaccurate asset ownership;
• uncertain threat intelligence and changing attacker behavior;
• legacy systems that cannot support modern controls;
• user friction that encourages unsafe workarounds;
• alert overload and limited security staffing;
• dependence on suppliers and shared cloud infrastructure;
• difficulty estimating probability and impact;
• trade-offs between privacy, availability, cost, and security.

Risk assessments are especially sensitive to assumptions. A numerical result can appear objective even when asset value, exposure, or occurrence rate is speculative. Quantitative estimates should therefore be revisited when systems, threats, business processes, or controls change.

Chapter Summary

Network security protects information, systems, and services through coordinated technical, administrative, and physical measures. Confidentiality limits disclosure, integrity protects accuracy and trustworthiness, and availability supports authorized access when needed. Authentication verifies identity; authorization determines permitted actions; and accountability supports traceability.

Least privilege limits permissions to necessary tasks, while separation of duties prevents one actor from completing sensitive processes alone. Defense in depth uses varied layers so that one failed control does not expose the environment. Zero trust rejects implicit trust based solely on network location and emphasizes explicit verification, least privilege, segmentation, and continuous monitoring.

Attack-surface analysis identifies exposed technical, human, physical, and supply-chain pathways. Basic risk assessment connects assets, threats, vulnerabilities, impacts, likelihood, and controls. Risk may be treated through avoidance, mitigation, transfer, or acceptance. Effective security is continuous: assets and threats change, controls fail, and residual risk must be reassessed.

Key Terms

Accountability: The ability to associate actions with responsible identities or processes.

Authentication: Verification of an identity claim.

Authorization: Determination of which actions an authenticated subject may perform.

Availability: Accessibility and usability of systems and information for authorized users.

Attack surface: The set of points through which systems or information may be attacked or influenced.

Confidentiality: Protection against unauthorized disclosure.

Control: A safeguard that reduces security risk.

Defense in depth: Use of multiple complementary security layers.

Exposure factor: Estimated proportion of asset value lost in a particular event.

Integrity: Accuracy, completeness, and trustworthiness of information and systems.

Least privilege: Granting only the permissions necessary for an authorized task.

Multi-factor authentication: Authentication using two or more independent factor categories.

Residual risk: Risk remaining after controls are applied.

Risk: The possibility of harm arising from threats, vulnerabilities, and consequences.

Role-based access control: Authorization based on assigned organizational roles.

Separation of duties: Dividing sensitive responsibilities among multiple subjects.

Single-loss expectancy: Estimated loss from one occurrence of a defined event.

Threat: A potential cause of harm.

Vulnerability: A weakness that may be exploited or triggered.

Zero trust: An approach that requires explicit, context-aware authorization rather than implicit trust based on location.

Review Questions

Short Answer Questions

1. What are the three objectives of the CIA triad?
2. How does authentication differ from authorization?
3. State the principle of least privilege.
4. What is an attack surface?
5. Name four common risk-treatment options.

Long Answer Questions

1. Explain how defense in depth can reduce the consequences of a failed firewall.
2. Compare role-based access control with attribute-based access control.
3. Explain why zero trust is not simply the removal of the network perimeter.
4. Describe a complete process for performing attack-surface analysis.
5. Discuss ethical and operational concerns associated with security monitoring.

Analytical / Application Questions

1. A college network has a public remote-access service, shared administrator credentials, and no tested backups. Identify at least four assets, three threats, and four vulnerabilities, then recommend controls using least privilege and defense in depth.
2. An asset is valued at $80,000. A defined incident is estimated to cause a 25% loss, and its annual rate of occurrence is 0.2. Calculate the single-loss expectancy and annualized loss expectancy, stating your assumptions.
3. A manager proposes accepting a high-impact risk because the proposed control is expensive. What evidence and governance steps should be required before accepting the risk?

Multiple Choice Questions with Answers

Question 1

Which security objective focuses primarily on preventing unauthorized disclosure of information?

A. Availability

B. Confidentiality

C. Integrity

D. Accountability

Correct Answer: B. Confidentiality

Question 2

What is the main purpose of authorization?

A. To verify an identity claim

B. To encrypt network traffic

C. To determine permitted actions

D. To restore unavailable services

Correct Answer: C. To determine permitted actions

Question 3

Which example best demonstrates least privilege?

A. Giving every employee administrator access

B. Using one shared account for a whole team

C. Granting a service account only the permissions required for its task

D. Allowing access based solely on office location

Correct Answer: C. Granting a service account only the permissions required for its task

Question 4

Which statement best describes defense in depth?

A. Using one highly capable security product

B. Using multiple complementary safeguards so one failure is less damaging

C. Trusting all internal traffic

D. Removing monitoring to reduce complexity

Correct Answer: B. Using multiple complementary safeguards so one failure is less damaging

Question 5

Which principle is central to zero trust?

A. Internal network traffic is automatically trusted

B. Physical location is sufficient for authorization

C. Every request should be evaluated using relevant evidence and policy

D. Authentication is unnecessary after the first login

Correct Answer: C. Every request should be evaluated using relevant evidence and policy

Question 6

Which item is part of an organization’s attack surface?

A. Only systems located in the server room

B. Only known malware samples

C. Public APIs, remote access services, users, and supplier connections

D. Only encrypted data

Correct Answer: C. Public APIs, remote access services, users, and supplier connections

Question 7

An asset is valued at $50,000 and an incident is expected to cause a 20% loss. What is the single-loss expectancy?

A. $1,000

B. $10,000

C. $25,000

D. $250,000

Correct Answer: B. $10,000

Question 8

Which control function is primarily concerned with identifying unwanted events?

A. Detective

B. Corrective

C. Preventive

D. Compensating

Correct Answer: A. Detective

Question 9

Which practice most directly improves accountability?

A. Using shared administrator accounts

B. Disabling security logs

C. Using named accounts and protected audit trails

D. Allowing indefinite access for former contractors

Correct Answer: C. Using named accounts and protected audit trails

Question 10

Which is a valid risk-treatment option?

A. Ignore

B. Avoid

C. Guarantee

D. Eliminate all uncertainty

Correct Answer: B. Avoid