Network Security

What It Is and Why It Matters

Network security encompasses the technologies, policies, and practices designed to protect the integrity, confidentiality, and availability of computer networks and the data transmitted across them. For the CISA exam, network security is a core topic because networks are the backbone of modern IT infrastructure, and their compromise can have cascading effects on every system and service an organization relies upon.

Auditors must understand network security controls to evaluate whether an organization has implemented appropriate defenses against unauthorized access, data interception, denial of service, and other network-based threats. This includes understanding the purpose and limitations of various security devices, network architecture principles, and monitoring capabilities.

Network security is not about deploying individual tools in isolation but about implementing a defense-in-depth strategy where multiple layers of controls work together to protect against diverse threats. No single control is sufficient on its own; the strength of network security lies in the combination and coordination of multiple defensive measures.

Key Concepts and Terminology

Firewalls

• Packet Filtering Firewalls: Examine individual packets and allow or deny them based on source and destination IP addresses, ports, and protocols. They are fast but do not inspect packet contents.
• Stateful Inspection Firewalls: Track the state of active connections and make decisions based on the context of traffic, not just individual packets. They provide better security than simple packet filters.
• Application-Layer (Proxy) Firewalls: Operate at the application layer and can inspect, filter, and modify traffic based on application-specific protocols (HTTP, FTP, DNS). They provide the deepest inspection but may introduce performance overhead.
• Next-Generation Firewalls (NGFW): Combine traditional firewall capabilities with additional features such as intrusion prevention, application awareness, deep packet inspection, and threat intelligence integration.

Intrusion Detection and Prevention Systems

• Intrusion Detection System (IDS): Monitors network traffic or system activity for suspicious patterns and generates alerts. An IDS is passive; it detects but does not block threats.
• Intrusion Prevention System (IPS): Similar to an IDS but actively blocks or prevents detected threats in real time. An IPS is inline with network traffic and can drop malicious packets.
• Signature-Based Detection: Identifies threats by matching traffic patterns against a database of known attack signatures. Effective against known threats but cannot detect novel attacks.
• Anomaly-Based (Behavioral) Detection: Establishes a baseline of normal activity and alerts on deviations. Can detect unknown threats but may generate more false positives.

Network Segmentation

Network segmentation divides a network into smaller, isolated segments to limit the spread of attacks and control traffic flow between zones. VLANs (Virtual Local Area Networks) are commonly used for logical segmentation. A DMZ (Demilitarized Zone) is a network segment that hosts public-facing services (such as web servers) while isolating them from the internal network. Microsegmentation extends this concept by creating fine-grained security zones around individual workloads or applications.

Virtual Private Networks (VPNs)

VPNs create encrypted tunnels over public networks, enabling secure remote access and site-to-site connectivity. Common VPN protocols include IPsec (operating at the network layer) and SSL/TLS VPNs (operating at the transport layer). Auditors should verify that VPN configurations use strong encryption, enforce multi-factor authentication, and restrict access to authorized users and resources.

Common Network Attacks

• Denial of Service (DoS) and Distributed DoS (DDoS): Overwhelming a system or network with traffic to make it unavailable.
• Man-in-the-Middle (MITM): Intercepting and potentially altering communications between two parties without their knowledge.
• ARP Spoofing: Sending falsified ARP messages to link the attacker's MAC address with the IP address of a legitimate host.
• DNS Poisoning: Corrupting DNS cache entries to redirect users to malicious sites.
• Phishing: Social engineering attacks that use deceptive communications to trick users into revealing credentials or installing malware.

How This Appears on the CISA Exam

Network security questions on the CISA exam typically ask you to:

• Identify the appropriate network security control for a given threat scenario.
• Distinguish between IDS and IPS, and understand their placement in network architecture.
• Evaluate the adequacy of network segmentation and DMZ configurations.
• Recognize the purpose and limitations of different firewall types.
• Understand VPN technologies and their role in securing remote access.

Study Tips

• Know the differences between firewall types and when each is most appropriate.
• Remember that an IDS detects and alerts, while an IPS detects and blocks.
• Understand the defense-in-depth concept: multiple layers of security controls working together.
• Review common network attack types and the controls that mitigate each.
• Be familiar with the purpose of a DMZ and where it fits in network architecture.

Related Subtopics

• Network architecture and topology design
• Wireless network security (WPA3, 802.1X)
• Network access control (NAC)
• Security information and event management (SIEM)
• Network monitoring and traffic analysis
• Zero trust networking