01What network security is
Network security is the combination of controls that keep networked systems and the data moving through them trustworthy. It is not a product or a perimeter; it is a continuous loop. Some controls stop bad things from happening, others notice when they happen anyway, and still others limit the damage and restore service.
Every control lives in one of three domains, and attackers probe all three. A flawless firewall is irrelevant if an employee reads a password over the phone to a stranger.
People
Awareness, incentives, habits, social engineering resistance.
Process
Change control, access reviews, patch cadence, incident playbooks.
Technology
Encryption, filtering, monitoring, identity systems, hardened configs.
02The CIA triad
Three properties define what "secure" means for data and services. Almost every attack can be described as a violation of one or more of them, and almost every control exists to protect one or more of them.
The properties compete. Encrypting and locking everything down strengthens confidentiality but adds failure points that hurt availability. The right balance depends on what the asset is for.
| Asset | Dominant property | Why |
|---|---|---|
| Password vault | C | Disclosure is catastrophic and irreversible. |
| Software update server | I | A tampered update is trusted and installed everywhere. |
| Grid control network | A | Downtime has physical, real-time consequences. |
| Public marketing site | A I | Content is public; defacement and outages are the harm. |
Two companion properties are often added: authenticity (the party or data is genuinely who or what it claims) and non-repudiation (an actor cannot credibly deny an action). Both matter heavily in network protocols.
- NIST CSRC glossary: CIA triad
- Saltzer, J. & Schroeder, M. (1975). The protection of information in computer systems. Proceedings of the IEEE, 63(9).
03Threat, vulnerability, risk
These words are used loosely in the press but mean different things, and mixing them up leads to spending on the wrong problems.
Threat
Something that could cause harm: an actor, an event, or a technique. Exists whether or not you are weak.
Vulnerability
A weakness a threat could use: a bug, a misconfiguration, a missing process, a gullible habit.
Asset
What you stand to lose: data, uptime, reputation, safety, money.
Risk
The expected harm when a threat meets a vulnerability on an asset you care about.
Once risk is estimated, there are only four responses: mitigate it with controls, transfer it (insurance, contracts), avoid it by not doing the risky thing, or accept it knowingly.
04The threat landscape
The threat landscape is the current set of adversaries, techniques, and exposures facing a system. It shifts constantly as technology changes (cloud, remote work, IoT), as criminal business models mature (ransomware-as-a-service), and as geopolitics changes who is targeted.
Major categories
Malware
Worms, trojans, ransomware, info-stealers. Self-spreading variants turn one host into many.
Social engineering
Phishing, pretexting, MFA fatigue. Attacks the person, not the protocol.
Network attacks
Scanning, spoofing, interception, denial of service against exposed services.
Supply chain
Compromise a trusted vendor or update channel and inherit its access.
Two illustrative incidents
Supply chain: in 2020, attackers inserted a backdoor into signed updates of a widely used IT monitoring product, reaching thousands of organizations through a channel they had every reason to trust. The core failure was integrity of the build pipeline.
Credential abuse: in 2021, a single reused password on a legacy remote-access account without MFA opened the door to ransomware that halted a major US fuel pipeline. A simple lapse produced an availability crisis with national effects.
05Attack surface
The attack surface is every point where an attacker can send input to, or pull data from, a system. Each open port, running service, API endpoint, login form, admin account, and reachable person is a door. More doors means more to defend and more chances one is left unlocked.
A useful exercise is enumerating your own surface the way an attacker would, with a port scanner against a lab host you own.
- Nmap reference guide · port scanning tutorial
- Shodan — search internet-exposed devices
- Manadhata, P. & Wing, J. (2011). An attack surface metric. IEEE Transactions on Software Engineering, 37(3).
06Defense in depth
Every control fails sometimes: signatures miss new malware, users click, patches lag. Defense in depth assumes this and stacks independent layers so that an attacker has to beat all of them in sequence, while defenders get multiple chances to notice.
The layers should be diverse, not duplicates. Two firewalls from the same vendor with the same rule set are closer to one layer than two.
Modern networks push this further with zero trust: no request is trusted because of where it comes from on the network; every access is authenticated, authorized, and evaluated in context.
- CIS Critical Security Controls
- NIST SP 800-207 — Zero Trust Architecture
- Reason, J. (2000). Human error: models and management. BMJ, 320 — origin of the Swiss cheese model.
07Least privilege
Every user, service, and process should hold exactly the permissions its job needs, for only as long as it needs them. When something is compromised or makes a mistake, the damage is capped by what it was allowed to do.
In practice this means role-based access, separate admin accounts, services running as unprivileged users, scoped API tokens, just-in-time elevation, and regular reviews that remove permissions nobody uses. It pairs with separation of duties: no single identity can both request and approve a sensitive action.
- NIST glossary: least privilege
- OWASP Authorization Cheat Sheet
- Saltzer & Schroeder (1975), op. cit. — the original statement of the principle, alongside fail-safe defaults and economy of mechanism.
08Threat modeling
Threat modeling is structured imagination: before building or defending a system, ask what it does, what could go wrong, what you will do about it, and whether you did a good job. Two tools make that repeatable.
STRIDE
A checklist of six threat types, each the inverse of a security property. Walk each component and data flow in a diagram and ask which of the six apply.
| Threat | Violates | Network example |
|---|---|---|
| Spoofing | authenticity | Forged source IP or ARP reply |
| Tampering | integrity | Altering packets in transit |
| Repudiation | non-repudiation | Admin action with no audit log |
| Information disclosure | confidentiality | Sniffing cleartext credentials |
| Denial of service | availability | SYN flood exhausting a server |
| Elevation of privilege | authorization | Exploiting a service running as root |
Attack trees
The attacker's goal is the root; children are ways to achieve it. OR nodes need any one child, AND nodes need all. Annotating leaves with cost or difficulty reveals the cheapest path, which is where defense should go first.
- OWASP Threat Modeling overview · Threat Modeling Manifesto
- Tools: OWASP Threat Dragon, Microsoft Threat Modeling Tool
- Mauw, S. & Oostdijk, M. (2006). Foundations of attack trees. ICISC 2005, LNCS 3935.
- Kordy, B., Piètre-Cambacédès, L. & Schweitzer, P. (2014). DAG-based attack and defense modeling. Computer Science Review, 13–14.
09Naming and scoring vulnerabilities
Thousands of vulnerabilities are disclosed every year. A shared vocabulary lets scanners, vendors, and defenders talk about the same flaw and decide what to fix first.
Vulnerability scanners automate the first pass: they fingerprint services and match versions against these databases. Their output is a starting point for analysis, not a verdict; false positives and context-blind scores are common.
- CVE Program · CWE · NIST National Vulnerability Database
- CVSS v4.0 specification · EPSS · CISA Known Exploited Vulnerabilities
- Scanner: Greenbone / OpenVAS documentation
- Bilge, L. & Dumitraş, T. (2012). Before we knew it: an empirical study of zero-day attacks in the real world. ACM CCS.
- Jacobs, J. et al. (2021). Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, 2(3).
10No perfect security
Security is risk management under constraints, not a finished state. Every control costs money, time, and convenience, and controls people find unbearable get bypassed.
Common misconceptions
- Adams, A. & Sasse, M. A. (1999). Users are not the enemy. Communications of the ACM, 42(12).
- Herley, C. (2009). So long, and no thanks for the externalities: the rational rejection of security advice by users. NSPW.
- Hands-on practice: TryHackMe · Hack The Box · OverTheWire
—References
Peer-reviewed
- Adams, A. & Sasse, M. A. (1999). Users are not the enemy. CACM, 42(12), 40–46. doi:10.1145/322796.322806
- Anderson, R. (2001). Why information security is hard — an economic perspective. ACSAC. doi:10.1109/ACSAC.2001.991552
- Bilge, L. & Dumitraş, T. (2012). Before we knew it. ACM CCS. doi:10.1145/2382196.2382284
- Herley, C. (2009). So long, and no thanks for the externalities. NSPW. doi:10.1145/1719030.1719050
- Jacobs, J. et al. (2021). Exploit Prediction Scoring System (EPSS). DTRAP, 2(3). doi:10.1145/3436242
- Kordy, B., Piètre-Cambacédès, L. & Schweitzer, P. (2014). DAG-based attack and defense modeling. Computer Science Review, 13–14. doi:10.1016/j.cosrev.2014.07.001
- Manadhata, P. & Wing, J. (2011). An attack surface metric. IEEE TSE, 37(3). doi:10.1109/TSE.2010.60
- Mauw, S. & Oostdijk, M. (2006). Foundations of attack trees. ICISC 2005. doi:10.1007/11734727_17
- Ohm, M., Plate, H., Sykosch, A. & Meier, M. (2020). Backstabber's knife collection. DIMVA. doi:10.1007/978-3-030-52683-2_2
- Reason, J. (2000). Human error: models and management. BMJ, 320, 768–770. doi:10.1136/bmj.320.7237.768
- Saltzer, J. & Schroeder, M. (1975). The protection of information in computer systems. Proc. IEEE, 63(9). doi:10.1109/PROC.1975.9939