Network Security: Threats, Controls, and Secure Access
Frameworks and threats
Anchor decisions in confidentiality, integrity, and availability. Threat actors range from insiders to organized crime, and social engineering remains effective: phishing by email, vishing by phone, smishing by text, plus tailgating and shoulder surfing. Technical attacks include DoS/DDoS, on-path interception, spoofing, ARP and DNS poisoning, VLAN hopping, evil twin access points, deauthentication floods, and credential stuffing.
Controls and hardening
Apply least privilege and role-based access, require multifactor authentication, and segment networks so a compromise stays contained. Disable unused ports and services, change defaults, and patch. Port security, DHCP snooping, and dynamic ARP inspection defend Layer 2. 802.1X provides port-based access control with a supplicant, authenticator, and authentication server. NAC checks device posture before admission.
Defensive devices
A stateful firewall tracks connections; an IDS detects and alerts; an IPS can block inline. A WAF protects web applications specifically. Zero trust removes implicit trust based on network location, and SASE combines cloud-delivered security with wide-area connectivity.
Encryption and wireless
Symmetric encryption is fast and used for bulk data; asymmetric keys solve key exchange and signatures. IPsec uses AH for integrity and ESP for confidentiality. WPA3 adds SAE and protected management frames, which mitigate deauthentication attacks.
Traps
Encryption alone does not authenticate a peer. Deauthentication frames are management frames, so protected management frames matter. An evil twin is a rogue AP using a legitimate SSID, not merely an unsecured network. An IDS does not stop traffic by default.
Rule of thumb
When credentials are suspected compromised, the first response is to revoke sessions and enforce MFA, then reset the password - not simply to change the password and hope the session dies.