Network Defense Essentials: Controls, Segmentation, and Monitoring
Network Defense Essentials (NDE) tests whether you can select and place controls that preserve confidentiality, integrity, and availability across a network. Questions tend to focus on hardening, segmentation, firewall and ACL logic, IDS/IPS placement, remote-access security, wireless controls, monitoring, and basic incident response.
Core rules and concepts
- Defense in depth: combine preventive, detective, and corrective controls at perimeter, network, endpoint, application, identity, and data layers. No single control is assumed sufficient.
- Least privilege and default deny: firewall rules, ACLs, role assignments, and service accounts should permit only required traffic or actions. Deny rules and logging matter as much as allow rules.
- Segmentation: VLANs, subnets, and security groups limit lateral movement. Put public-facing services in a DMZ; keep databases and management planes on internal segments.
- Stateful vs. stateless filtering: stateful firewalls track connections and allow return traffic automatically; stateless ACLs must explicitly permit both directions.
- IDS vs. IPS: IDS detects and alerts; IPS can block inline. Placement determines visibility: a span port sees traffic but cannot block; an inline sensor can block but becomes a failure point.
- Hardening and patching: remove unused services, change defaults, restrict management access, apply patches, and verify with configuration baselines.
- Monitoring: centralize logs in a SIEM, correlate events, tune alerts, and retain evidence. Egress filtering and DNS monitoring expose command-and-control traffic.
Worked example
A public web application must accept HTTPS from the internet, query a database, and be administered by staff. Place the web server in a DMZ. Permit inbound TCP 443 from any internet address to the web server; deny other inbound traffic by default. Permit the web server to reach the database only on the database port, and permit database access only from that web server's address. Permit SSH or RDP to the web server only from a management jump host on an internal management network. Log denied traffic and review it. The reasoning is least privilege plus segmentation: internet users need only HTTPS, the web tier needs only the database port, and administrators need only management access from a controlled path.
Traps that cost marks
Do not treat NAT as a security control; it hides addresses but does not authorize traffic. Do not place an IDS where it cannot see the traffic being discussed. Do not write "any-any" rules to make an application work. Do not forget egress rules, management-plane exposure, or the difference between a vulnerability scan finding and a confirmed incident. Patching is not the same as mitigation: a compensating control may reduce exposure while a patch is pending, but it does not remove the defect.