Network Security Architecture and Design
Learn about network security architecture principles including segmentation, firewalls, and DMZ design for CISA exam preparation.
Network Security Architecture Overview
Network security architecture defines how security controls are positioned within the network to protect organizational assets. A well-designed network security architecture provides multiple layers of defense, controls traffic flow, and limits the impact of security breaches. CISA candidates must understand these concepts for both the exam and professional practice.
Network Segmentation
Network segmentation divides a network into smaller, isolated zones to contain threats and control access between zones. Key segmentation strategies include:
- VLANs (Virtual LANs): Logically separate network traffic within the same physical infrastructure. VLANs reduce broadcast domains and can enforce basic access controls between segments.
- DMZ (Demilitarized Zone): A network segment that sits between the internal network and the internet. Public-facing services (web servers, email servers, DNS) are placed in the DMZ, where they can be accessed from the internet without exposing the internal network.
- Microsegmentation: A more granular approach that applies security policies at the workload or application level rather than the network level. Microsegmentation is particularly relevant in virtualized and cloud environments.
Security Devices and Controls
Several security devices form the building blocks of network security architecture:
- Firewalls: Control traffic flow between network segments based on defined rules. Types include packet-filtering firewalls, stateful inspection firewalls, application-layer firewalls, and next-generation firewalls that combine multiple security functions.
- Intrusion Detection Systems (IDS): Monitor network traffic for suspicious activity and generate alerts. IDS can be network-based (NIDS) or host-based (HIDS).
- Intrusion Prevention Systems (IPS): Similar to IDS but with the ability to automatically block detected threats. IPS sits inline in the traffic path.
- Web Application Firewalls (WAF): Protect web applications from common attacks such as SQL injection, cross-site scripting, and session hijacking.
- Network Access Control (NAC): Enforces security policies on devices attempting to connect to the network. NAC can verify device health, authentication status, and compliance before granting access.
Defense in Depth
Network security architecture should follow the defense-in-depth principle, layering multiple security controls so that if one fails, others continue to provide protection. This includes perimeter defenses, internal segmentation, host-based controls, and application-layer protections.
Audit Considerations
IS auditors should review network diagrams for accuracy, verify firewall rule sets for appropriate restrictiveness, assess whether segmentation adequately isolates sensitive systems, evaluate IDS/IPS effectiveness, and test whether security devices are configured according to documented standards.
CISA Exam Tips
For the CISA exam, understand the purpose and placement of each security device within the network architecture. Know that the DMZ protects the internal network by hosting public-facing services in an isolated zone. Remember that firewalls are preventive controls, IDS provides detective capability, and IPS combines both functions. Questions may ask you to identify the best placement for a security device in a given network scenario.