Network Defense
Network Defense tests how well you can design, harden, monitor, and validate a defensible network rather than merely name attacks. C|CT-style items probe whether you can choose controls that match a threat, explain their placement, and recognize when a control creates false confidence.
Core rules
- Apply defense in depth: preventive, detective, and corrective controls at distinct layers.
- Default deny at trust boundaries; allow only required services, ports, and directions. Egress filtering matters as much as inbound filtering.
- Segment by function and sensitivity: user VLANs, management networks, DMZs, and data stores. A DMZ is a buffer zone, not a trusted zone.
- Harden hosts: remove unused services, restrict administrative access, patch, enforce MFA, and centralize logs.
- Use IDS for detection and IPS for inline prevention; neither replaces correctly configured firewalls, authentication, or logging.
- Monitor with baselining and alert tuning; retain logs long enough for investigation and legal needs. Map controls to the threat and test them; a firewall rule that is never reviewed may be stale.
Worked example
A public web server in a DMZ is suspected of compromise. Inbound HTTPS is allowed; the server can reach an internal database on TCP 3306. Which change best limits damage without breaking service? The strongest answer is not 'install antivirus.' It is to remove direct database access, place a controlled application tier between the web server and database, and allow only the specific application flow. Add egress deny rules, IDS alerts for abnormal outbound traffic, and host logging. Reasoning: the web server is internet-facing and therefore lower trust; the database holds high-value data. Segmentation and least-privilege flows reduce lateral movement even if the web server falls.
Traps
Do not call an IDS an IPS, or assume encryption replaces inspection. Encryption terminates inspection unless a deliberate break-and-inspect design exists. Do not treat a DMZ as fully trusted. 'Block all inbound traffic' is incomplete because outbound command-and-control and data exfiltration remain. Stateful firewalls track sessions but do not validate application content. A control that is not logged or tested is hard to defend.