Network Security — Firewalls, Encryption & Threat Defense

Network Security Fundamentals

Network security protects computer networks from unauthorized access, misuse, and attacks. The CIA triad defines core objectives: Confidentiality (data readable only by authorized parties), Integrity (data not altered in transit/storage), Availability (systems accessible when needed). The OSI model’s 7 layers each have specific security concerns: physical (access control), data link (MAC spoofing), network (IP spoofing, routing attacks), transport (TCP hijacking), session/presentation/application (XSS, SQL injection, session fixation). Defense in depth: multiple layers of security controls. The average cost of a data breach reached $4.88 million in 2024 (IBM).

Cryptography & Encryption

Symmetric encryption : same key for encrypt/decrypt. AES (128/192/256-bit keys, used worldwide) and ChaCha20 (mobile/streaming). Asymmetric encryption : public/private key pairs. RSA (factoring problem, 2048+ bits), Elliptic Curve Cryptography (ECDSA, Ed25519 — shorter keys, same security). Hashing : one-way functions (SHA-256, bcrypt for passwords, Argon2id). TLS 1.3 : secure communication protocol — handshake (ECDHE key exchange, certificate verification), then symmetric encryption (AES-256-GCM). IPsec : network-layer encryption for VPNs (tunnel mode: encrypt entire packets). Post-quantum cryptography : NIST standardized CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (signatures) in 2024.

Firewalls & IDS/IPS

Firewalls filter network traffic based on rules. Types: packet filtering (stateless, examines headers), stateful inspection (tracks connections), application-level gateways (proxy), next-generation firewalls (NGFW — deep packet inspection, application awareness, IPS, SSL decryption). IDS (Intrusion Detection Systems): signature-based (Snort, Suricata — match known attack patterns) or anomaly-based (ML models detect deviations from baseline). IPS : actively blocks detected threats. WAF (Web Application Firewall): protects against OWASP Top 10 (SQL injection, XSS, CSRF). SIEM (Security Information and Event Management): Splunk, Elastic SIEM — aggregate logs, correlate events, trigger alerts.

Common Attacks & Defense

DDoS : overwhelm servers with traffic (volumetric, protocol, application layer). Mitigation: CDN (Cloudflare), rate limiting, scrubbing centers. Man-in-the-Middle (MitM) : intercept communications. Defense: TLS, HSTS, certificate pinning. Phishing : social engineering to steal credentials. Defense: MFA, security awareness training, DMARC/DKIM/SPF for email. Ransomware : encrypts victim’s data, demands payment. Defense: offline backups (3-2-1 rule), endpoint detection and response (EDR), network segmentation. Supply chain attacks : compromise software update mechanisms (SolarWinds 2020). Defense: SBOM, code signing, dependency scanning.

Zero Trust Architecture

Zero Trust (NIST SP 800-207): "never trust, always verify." Principles: (1) Every access request is authenticated and authorized regardless of network location. (2) Least privilege access. (3) Micro-segmentation (isolate workloads). (4) Continuous monitoring and validation. Components: identity provider (Okta, Azure AD), MFA (TOTP, FIDO2/passkeys), device trust (MDM, endpoint health checks), policy engine, network micro-segmentation (Zscaler, Cloudflare Access). Google’s BeyondCorp (2014) pioneered the model. Zero Trust is now mandated for US federal agencies (Executive Order 14028). Implementation: start with identity, then data classification, then network controls.

📚 Cybersecurity

All Cybersecurity articles

Home

Physics

Chemistry

Biology

Mathematics

Computer Science

🌐 Languages

🇺🇦 Українська

🇬🇧 English (current)

❓ Frequently Asked Questions

What is encryption?

Encryption converts plaintext into ciphertext using a mathematical algorithm and a key, making it unreadable without the correct decryption key. Symmetric encryption (AES) uses one shared key. Asymmetric (RSA, ECC) uses a public key to encrypt and private key to decrypt. Modern encryption (AES-256) is computationally infeasible to break with current technology.

What is a VPN?

A Virtual Private Network creates an encrypted tunnel between your device and a VPN server. Traffic is encrypted (typically using IPsec or WireGuard), hiding your IP address and protecting data on untrusted networks. Corporate VPNs provide remote access to internal resources. Consumer VPNs add privacy but the provider can still see your traffic — choose trusted, audited providers.

What is zero trust security?

Zero Trust eliminates implicit trust based on network location. Instead of "inside the network = trusted," every request is verified: who is requesting (identity/MFA), from what device (health check), for what resource (least privilege), and the request context (risk score). This addresses the reality that perimeter security fails when attackers breach the network.

How does TLS protect web traffic?

TLS 1.3 protects HTTPS connections through: (1) handshake — client and server exchange keys using ECDHE (forward secrecy), server proves identity via X.509 certificate chain. (2) Record protocol — application data encrypted with AES-256-GCM or ChaCha20-Poly1305. TLS 1.3 reduced the handshake to 1 round trip (from 2 in TLS 1.2) and removed insecure algorithms.

What are the most common cyberattacks?

Top threats (2024): (1) Phishing/social engineering (79% of breaches involve human element), (2) Ransomware ($1.1B paid in 2023), (3) Business email compromise (BEC), (4) Supply chain attacks, (5) DDoS attacks, (6) Credential stuffing (using leaked password databases), (7) Zero-day exploits. Defense: MFA, patch management, security awareness, EDR, backup strategy, and incident response plans.

Try it live

Everything above runs in your browser — open Network Packet Routing and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.