Fundamental concepts and principles of network security
The exam tests precise use of ISO/IEC 27033-1 vocabulary - security objectives, trust boundaries, security domains and security gateways - and the principles that justify every later design decision.
Security objectives and risk
27033-1 frames network security around confidentiality, integrity and availability, extended by accountability, authenticity and reliability. These are pursued through risk management, not product purchase. Risk combines asset, threat, vulnerability and impact; controls reduce likelihood, impact or both, leaving residual risk that must be treated, accepted, transferred or avoided.
Principles that recur
- Defence in depth: overlapping, independent controls so a single failure is not fatal.
- Least privilege and least functionality: deny by default; enable only what the business requires.
- Segregation and trust boundaries: assets of comparable trust share a security domain; traffic crossing a boundary traverses a security gateway enforcing that boundary's policy.
- Choke points: concentrate enforcement where traffic must pass so it can be inspected.
- Fail-safe decisions: state explicitly whether a failing control blocks or permits traffic.
- Weakest link: users and unmanaged endpoints usually break the chain first.
Worked example
A finance user needs remote access to an ERP system. Asset: ERP data. Threat: credential theft. Vulnerability: password-only internet access. Impact: financial and regulatory loss. The design adds a VPN, multi-factor authentication, a segregated finance segment and access logging. Reasoning: the VPN protects data in transit, MFA attacks the credential-theft threat, segmentation limits lateral movement, logging supports accountability. Residual risk - a malware-infected but MFA-verified endpoint - is reduced by endpoint controls, not by more network devices.
Traps
Confusing threat with vulnerability; treating a firewall as complete network security; assuming a hard perimeter survives cloud and mobile; quoting a cipher suite as if it answered the business risk question.