Network Security Foundations and Terminology

Introduction

Network security is the discipline of protecting networked systems, communications, services, and information from unauthorized access, misuse, disruption, alteration, and destruction. It combines technical controls—such as firewalls, authentication systems, encryption, and monitoring—with administrative processes, user education, governance, and incident response.

For a computer architecture and networking student, security is not an optional layer added after a network is built. It is a design property of the entire environment. A network may be fast, reliable, and inexpensive, yet still be unsafe if an attacker can impersonate a user, intercept sensitive traffic, alter configuration, or disable a critical service.

This chapter establishes the vocabulary and conceptual models used throughout network security. It explains what must be protected, how harm can occur, why weaknesses exist, and how security controls reduce exposure. The chapter also introduces the CIA triad, AAA, least privilege, defense in depth, trust boundaries, attack surfaces, and zero-trust security.

Learning Objectives

By the end of this chapter, you should be able to:

• identify assets, threats, vulnerabilities, exploits, risks, and attack surfaces;
• distinguish vulnerabilities from exploits and threats from risks;
• explain confidentiality, integrity, and availability;
• describe authentication, authorization, and accounting or auditing;
• apply least privilege and defense-in-depth principles;
• identify trust boundaries in a network architecture;
• explain the main ideas of zero-trust security;
• select appropriate security controls for a practical scenario; and
• discuss ethical, governance, and operational responsibilities in network security.

Security as a System Property

Security is concerned with reducing the likelihood and impact of undesirable events. It is not equivalent to secrecy alone. A public web service, for example, may not require confidential content, but it must still resist unauthorized modification and remain available to legitimate users.

Security objectives must be balanced with usability, performance, cost, maintainability, and legal obligations. A control that is theoretically strong but impossible for staff to use may encourage workarounds and therefore reduce real security. Similarly, excessive restrictions can interrupt essential business operations. Professional security design therefore considers the whole system, its users, its data, and its operating environment.

Assets, Threats, Vulnerabilities, and Exploits

Assets

An asset is anything of value that requires protection. Assets include more than files and databases. Examples are:

• hardware such as routers, switches, servers, laptops, and industrial controllers;
• software, operating systems, applications, and configuration files;
• information such as credentials, customer records, intellectual property, and logs;
• services such as DNS, email, web applications, and payment processing;
• identities, accounts, cryptographic keys, and certificates;
• network capacity, availability, and organizational reputation; and
• safety, privacy, and trust relationships.

An asset’s value depends on its owner, use, sensitivity, legal status, and required availability. A backup server may contain the same data as a production server, but its security requirements may differ because its operational role is different.

Threats

A threat is a potential cause of an unwanted security event. Threats may be intentional or accidental, internal or external, human or environmental. Examples include:

• a criminal attempting to steal credentials;
• a disgruntled employee deleting records;
• malware spreading through an unpatched server;
• an administrator making an incorrect firewall change;
• a power failure disabling network equipment; and
• a flood or fire damaging a data centre.

A threat actor is the person, group, process, or natural event that can produce the threat. Threat actors vary in capability, motivation, resources, and access.

Vulnerabilities

A vulnerability is a weakness that could be used to compromise an asset. Vulnerabilities may exist in software, hardware, configurations, processes, or human practice. Examples include an unpatched operating system, a default password, excessive permissions, poor physical access control, or an undocumented network connection.

A vulnerability does not automatically mean that compromise has occurred. It indicates an opportunity or condition that could contribute to harm. Vulnerability management involves discovering, assessing, prioritizing, remediating, and verifying weaknesses.

Exploits

An exploit is a method, technique, or piece of code that takes advantage of a vulnerability. The term may refer to a proof-of-concept demonstration or to a weaponized technique used in an attack. For example, a buffer-handling flaw is a vulnerability; a crafted input that triggers unauthorized code execution is an exploit.

This distinction is important in practice. Security teams may know that a vulnerability exists before a usable exploit is publicly available. Once exploitation becomes practical, urgency and risk may increase substantially.

Risk

Risk describes the possibility that a threat will exploit a vulnerability and cause harm. In introductory risk analysis, risk is often represented conceptually as:

Likelihood expresses how probable or plausible the event is over a defined period, while impact expresses the severity of its consequences. The expression is a decision-making model, not a universal physical law. Organizations must define their scales, time period, assumptions, and sources of evidence. A numerical risk score is meaningful only when its method is consistently applied.

For example, a public-facing server with a known critical vulnerability may have high likelihood and high impact. A rarely used internal workstation with a minor configuration weakness may have lower priority. Risk assessment should also consider existing controls, exposure, exploit availability, asset criticality, regulatory duties, and uncertainty.

Attack Surface

The attack surface is the collection of points through which an attacker might enter, interact with, or affect a system. It includes:

• internet-facing IP addresses and ports;
• web applications, APIs, email gateways, and remote-access services;
• wireless networks and removable media;
• user accounts, privileged interfaces, and exposed credentials;
• third-party connections and cloud services;
• software supply chains and update mechanisms; and
• physical ports, consoles, and data-centre access.

Attack-surface reduction is usually more effective than attempting to protect every unnecessary service. It includes removing unused software, closing unused ports, limiting administrative interfaces, segmenting networks, disabling inactive accounts, and restricting management access.

A Conceptual Security Model

A useful chain for analyzing security incidents is:

Asset → Threat → Vulnerability → Exploit → Security event → Impact

The chain is not inevitable. Controls can interrupt it at several points. A patch can remove a vulnerability; authentication can restrict access; network segmentation can limit movement; monitoring can detect an event; and backups can reduce impact.

Figure: A conceptual risk chain and examples of points at which controls can intervene.

The CIA Triad

The CIA triad is a foundational model for information and network security.

Confidentiality

Confidentiality means preventing unauthorized disclosure of information. Controls include encryption, access permissions, secure disposal, network segmentation, and privacy-aware handling of logs. Confidentiality is not the same as encryption: encryption is one technique that can help achieve it.

Integrity

Integrity means protecting information and systems from unauthorized or improper alteration. Integrity controls include file hashes, digital signatures, access control, change management, write protection, database constraints, and monitoring. Integrity also includes authenticity: users need confidence that data came from the claimed source and was not changed in transit.

Availability

Availability means that authorized users can access systems and information when required. Relevant controls include redundancy, backups, capacity planning, patch management, denial-of-service protection, fault tolerance, and disaster recovery. Availability involves more than keeping a device powered on; a service may be technically running but unavailable because it is too slow or unreachable.

Security objectives can conflict. Strong encryption may increase processing overhead, extensive inspection may reduce performance, and maintenance windows may temporarily reduce availability. Security professionals must identify which objectives are most important for each asset.

AAA: Authentication, Authorization, and Accounting

AAA provides a practical framework for controlling and reviewing access.

Authentication

Authentication is the process of verifying an identity claim. Common factors are:

• something the user knows, such as a password or PIN;
• something the user has, such as a hardware token or authenticator app; and
• something the user is, such as a biometric characteristic.

Multi-factor authentication uses two or more different factor types. Using two passwords is not normally multi-factor authentication because both are knowledge factors. Authentication should be supported by secure credential storage, account lockout or rate limiting, phishing-resistant methods where appropriate, and lifecycle processes for joiners, movers, and leavers.

Authorization

Authorization determines what an authenticated identity is permitted to do. Access-control models include role-based access control, in which permissions are assigned to job roles, and attribute-based access control, in which decisions consider attributes such as department, device state, location, resource sensitivity, and time.

Authentication answers “Who are you?” Authorization answers “What may you do?” Confusing these functions can lead to serious design errors.

Accounting and Auditing

Accounting records relevant activity so that actions can be traced, reviewed, and investigated. In modern security practice, this is often called auditing or accountability. Logs may record successful and failed logins, privilege changes, configuration changes, network connections, and access to sensitive information.

Logs must be protected against unauthorized alteration, synchronized sufficiently for correlation, retained according to policy and law, and reviewed or analyzed. Logging everything without a plan can create excessive cost and obscure important events.

Trust Boundaries and Network Segmentation

A trust boundary is a point where the level of trust, security policy, administrative control, or data sensitivity changes. Examples include:

• the boundary between the public internet and an organization;
• the boundary between a user network and a server network;
• the boundary between a corporate network and a guest wireless network;
• the boundary between an application and a database; and
• the boundary between an organization and a cloud or supplier.

A trust boundary is not necessarily a physical firewall. It may be logical, such as a role boundary within an application or an identity boundary between tenants in a cloud platform.

Network segmentation places systems into zones and controls traffic between them. A demilitarized zone may contain public-facing services, while internal databases remain in a more restricted segment. Microsegmentation applies similar ideas at a finer granularity, sometimes to individual workloads.

Segmentation limits lateral movement, but it is not automatically secure. Poorly configured rules, shared administrative credentials, unrestricted management protocols, and compromised routing devices can undermine it. Every boundary should have an explicit policy describing permitted communication, monitoring, and administrative responsibility.

Least Privilege

Least privilege means giving each subject only the minimum access required to perform an authorized task, for the minimum necessary duration. Subjects may be users, processes, applications, devices, or services.

Least privilege has several practical forms:

• separate ordinary and administrative accounts;
• use just-in-time or time-limited elevation;
• grant read-only access where modification is unnecessary;
• restrict service accounts to required files, APIs, and network destinations;
• remove inherited and unused permissions; and
• review privileges when duties change.

Least privilege reduces the consequences of stolen credentials and limits the reach of malware. It can, however, increase administration and cause work interruptions if requirements are poorly understood. Good implementation combines clear role design, access reviews, automation, and an emergency process that is monitored and documented.

Defense in Depth

Defense in depth uses multiple, complementary safeguards so that failure of one control does not produce immediate compromise. A layered design may include:

1. policy, training, and secure procedures;
2. physical security for facilities and devices;
3. identity controls and multi-factor authentication;
4. secure configuration and patch management;
5. network segmentation and firewalls;
6. endpoint protection and application controls;
7. encryption and data-loss safeguards;
8. monitoring, detection, and alerting; and
9. backups, incident response, and recovery.

Layers should be independent enough to provide meaningful resilience. Deploying several controls that all fail because of the same administrator account or configuration error is not true defense in depth. Controls should also be tested; an unused backup or an unreviewed alert provides little practical protection.

Zero Trust

Zero trust is a security approach based on the principle that no user, device, network location, or application should receive implicit trust merely because it is inside a traditional perimeter. Access should be granted according to explicit policy and continuously evaluated against available evidence.

Important zero-trust ideas include:

• verify identity and device context before access;
• apply least privilege;
• make access specific to a resource and a session;
• assume that compromise is possible;
• segment systems and limit lateral movement;
• monitor activity and use telemetry to adjust decisions; and
• protect resources rather than relying solely on a network perimeter.

Zero trust does not mean denying all access, eliminating firewalls, or requiring a user to authenticate every second. It is an architectural and governance approach that replaces broad implicit trust with evaluated, policy-based access. Implementing it requires reliable identity management, asset inventories, device information, application ownership, logging, and mature operational processes.

Security Controls

A security control is a safeguard or countermeasure intended to prevent, detect, deter, correct, or reduce the impact of an unwanted event.

Controls can be classified by function:

Controls may also be administrative, technical, or physical. A written access policy is administrative; an access-control list is technical; a locked server room is physical. Effective programs use all three categories.

Control selection should be risk-based. A control should have a defined owner, purpose, scope, implementation method, monitoring process, and review date. Security controls must not create a false sense of safety: antivirus, for example, cannot compensate for unsupported systems, weak identity management, or absent backups.

Applied Case: A College Network Segmentation Project

Background

This illustrative case concerns a college with student laboratories, staff offices, a learning-management system, a finance application, public web services, and guest wireless access. Historically, these systems shared a largely flat internal network.

Problem

A student laptop infected with malware could communicate with staff workstations and attempt connections to internal servers. Administrative accounts were used for everyday work, guest devices received broad network access, and logs from different systems could not be correlated reliably.

Analysis

The college identified its primary assets: student records, finance data, teaching services, staff identities, network infrastructure, and internet availability. The threat sources included malware, credential theft, accidental misconfiguration, and unauthorized access by compromised devices. Key vulnerabilities were excessive network reachability, weak privilege separation, inconsistent patching, and inadequate monitoring.

The highest-priority risks involved exposure of regulated student and finance data and disruption of teaching services. The analysis did not assume that all threats were external; a compromised internal endpoint was treated as an untrusted starting point.

Approach and Solution

The college introduced separate zones for public services, student laboratories, staff systems, finance systems, management interfaces, and guests. Firewall policies allowed only documented business flows. Administrative access required MFA through a controlled management path. Staff received ordinary accounts for routine work and separate privileged accounts for administration.

The college also deployed centralized logging, endpoint detection, vulnerability scanning, tested backups, and an incident-response procedure. Guest wireless access was isolated from internal systems. The design applied defense in depth and zero-trust principles without assuming that segmentation alone would solve every problem.

Outcome

A later malware incident was contained within a laboratory segment. Monitoring identified unusual outbound connections, the affected device was isolated, and clean images restored operations. The college still had work to do: asset inventories required improvement, some legacy applications could not yet support modern authentication, and staff needed continuing training.

Learning Points

The case demonstrates that security is an architectural and operational problem. Asset classification guided priorities; trust boundaries shaped segmentation; least privilege reduced account misuse; and monitoring and recovery converted a potentially major incident into a manageable event. It also illustrates that controls must be maintained, tested, and adapted as technology and threats change.

Challenges, Ethics, and Governance

Security decisions affect privacy, access to education, employment, and organizational trust. Monitoring should be proportionate, transparent, authorized, and limited to legitimate purposes. Logs may contain personal data and therefore require appropriate retention, access controls, and disposal.

Security professionals must obtain authorization before scanning or testing systems. A vulnerability assessment performed without permission can disrupt services or violate law. Responsible practice includes defining scope, protecting discovered information, documenting evidence, reporting weaknesses through appropriate channels, and avoiding unnecessary access to personal content.

Organizations should align security with applicable laws, contracts, sector requirements, and recognized risk-management frameworks. Governance should define accountability: who owns an asset, who approves access, who accepts residual risk, and who declares an incident. Compliance is important, but compliance alone does not guarantee effective security.

Contemporary environments complicate traditional boundaries. Cloud services, remote work, mobile devices, software-as-a-service platforms, APIs, operational technology, and artificial intelligence systems create distributed dependencies. AI can assist with anomaly detection, malware analysis, and security operations, but it can also generate convincing phishing content, automate reconnaissance, and amplify attacks. AI outputs require human review, secure data handling, testing for error and bias, and clear accountability.

Best-Practice Checklist

A diploma-level practitioner should be able to apply the following baseline practices:

• maintain an accurate inventory of assets, owners, software, and data flows;
• classify information according to sensitivity and operational importance;
• remove unnecessary services, accounts, ports, and privileges;
• patch supported systems according to risk and verify the result;
• use MFA for administrative and sensitive access;
• separate administrative activity from ordinary user activity;
• define trust boundaries and document permitted traffic;
• protect data in transit and at rest when appropriate;
• centralize important logs and protect their integrity;
• test backups and recovery procedures;
• rehearse incident-response actions; and
• review controls after incidents, major changes, and periodic risk assessments.

Chapter Summary

Network security protects assets against threats by reducing vulnerabilities, limiting attack surfaces, controlling trust relationships, detecting harmful activity, and recovering from incidents. An asset is valuable; a threat is a potential cause of harm; a vulnerability is a weakness; an exploit uses that weakness; and risk expresses the possibility and consequence of an adverse event.

The CIA triad organizes security objectives into confidentiality, integrity, and availability. AAA explains how systems verify identity, control permissions, and maintain accountability. Least privilege limits access to what is necessary, while defense in depth provides multiple complementary layers of protection. Trust boundaries identify changes in policy or trust and should be enforced through appropriate segmentation and access controls. Zero trust rejects implicit trust based on network location and emphasizes explicit, contextual, least-privilege access.

Effective security is not achieved by one product. It requires sound architecture, governance, trained people, technical controls, monitoring, recovery, ethical practice, and continuous improvement.

Key Terms

Asset: Anything of value that requires protection.

Threat: A potential cause of an unwanted security event.

Threat actor: A person, group, process, or event capable of causing harm.

Vulnerability: A weakness that may be exploited.

Exploit: A method or code that takes advantage of a vulnerability.

Risk: The possibility and consequence of harm arising from a threat and vulnerability.

Attack surface: The set of points through which a system may be attacked or affected.

Confidentiality: Protection against unauthorized disclosure.

Integrity: Protection against unauthorized or improper alteration.

Availability: Accessibility of systems and information when needed.

Authentication: Verification of an identity claim.

Authorization: Determination of permitted actions.

Accounting: Recording activity for accountability and review.

Trust boundary: A point where trust, policy, administration, or sensitivity changes.

Least privilege: Granting only the access necessary for an authorized task.

Defense in depth: Use of multiple complementary security layers.

Zero trust: An approach that grants no implicit trust and evaluates access explicitly.

Security control: A safeguard that prevents, detects, reduces, or recovers from security harm.

Lateral movement: An attacker’s movement from one compromised system or account to another.

Residual risk: Risk remaining after controls have been applied.

Review Questions

Short Answer Questions

1. Distinguish a vulnerability from an exploit.
2. What are the three elements of the CIA triad?
3. Why is multi-factor authentication stronger than a password alone?
4. Define a trust boundary and give one example.
5. What does least privilege mean?

Long Answer Questions

1. Explain how assets, threats, vulnerabilities, exploits, and impacts are related in a security incident.
2. Compare preventive, detective, corrective, and recovery controls, giving examples of each.
3. Explain how network segmentation supports defense in depth and limits lateral movement.
4. Discuss the relationship between authentication, authorization, and accounting in AAA.
5. Explain the main principles of zero trust and identify the organizational capabilities required to implement it.

Analytical / Application Questions

1. A small company hosts a public web server, an internal payroll database, staff laptops, and guest wireless devices on one network. Identify at least four assets, three vulnerabilities, and two trust boundaries. Propose a prioritized improvement plan.
2. An employee needs to administer a router once per month but uses a permanent domain administrator account. Analyze the risks and design a least-privilege alternative.
3. A ransomware incident encrypts production files, but offline backups and centralized logs are available. Analyze which CIA objectives were affected and explain how defense in depth supports containment and recovery.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness; an exploit is a method that uses the weakness.

B. A vulnerability is an attacker; an exploit is the victim.

C. A vulnerability is a security policy; an exploit is a firewall.

D. A vulnerability is an impact; an exploit is an asset.

Correct Answer: A. A vulnerability is a weakness; an exploit is a method that uses the weakness.

Question 2

Which CIA objective concerns preventing unauthorized disclosure of information?

A. Availability

B. Integrity

C. Confidentiality

D. Accounting

Correct Answer: C. Confidentiality

Question 3

A system verifies a user with a password and a hardware token. This is an example of:

A. Single sign-on only

B. Multi-factor authentication

C. Network segmentation

D. Data classification

Correct Answer: B. Multi-factor authentication

Question 4

Which activity is an example of authorization?

A. Checking whether a password matches an account

B. Recording a login in a security log

C. Determining whether a user may read a payroll file

D. Encrypting a database backup

Correct Answer: C. Determining whether a user may read a payroll file

Question 5

What is the primary purpose of least privilege?

A. To give every user administrator rights

B. To provide only the access necessary for an authorized task

C. To eliminate the need for authentication

D. To make all network traffic public

Correct Answer: B. To provide only the access necessary for an authorized task

Question 6

Which practice most directly reduces an organization’s attack surface?

A. Opening unused management ports

B. Disabling unnecessary services and accounts

C. Sharing one administrator password

D. Connecting guest devices to finance systems

Correct Answer: B. Disabling unnecessary services and accounts

Question 7

What is a trust boundary?

A. A location where network speed is measured

B. A point where trust, policy, or administrative control changes

C. A backup stored on the same disk as production data

D. A password complexity rule

Correct Answer: B. A point where trust, policy, or administrative control changes

Question 8

Which statement best describes defense in depth?

A. Using one very strong control instead of several controls

B. Allowing unrestricted internal traffic

C. Using multiple complementary layers so one failure does not cause immediate compromise

D. Trusting all devices inside the perimeter

Correct Answer: C. Using multiple complementary layers so one failure does not cause immediate compromise

Question 9

Which principle is central to zero-trust security?

A. Internal network location automatically proves trust

B. All users should have permanent administrator access

C. Access should be explicitly evaluated rather than implicitly trusted

D. Firewalls are never required

Correct Answer: C. Access should be explicitly evaluated rather than implicitly trusted

Question 10

A firewall blocks an unauthorized connection, an intrusion detector raises an alert, and a backup restores data. These controls are respectively:

A. Detective, preventive, and deterrent

B. Preventive, detective, and recovery

C. Corrective, recovery, and preventive

D. Recovery, preventive, and detective

Correct Answer: B. Preventive, detective, and recovery