Network Security Architecture and Design
Core ideas
Network security design segments trust zones and controls traffic between them. Understand the OSI/TCP-IP layers and where controls live: firewalls at L3/L4, proxies and WAFs at L7. Know stateful vs. stateless filtering, NGFW, IDS vs. IPS, and DMZ design. Segmentation (VLANs, subnets, microsegmentation) limits lateral movement.
Concepts to master
Perimeter vs. zero-trust models; VPNs (IPsec, TLS); NAC; secure protocols (HTTPS, SSH, SFTP) vs. insecure (Telnet, FTP, HTTP). Wireless security (WPA2/WPA3, 802.1X). Network address translation, routing hygiene, and DNS security. Cloud shared-responsibility and virtual network controls. Redundancy and high availability for availability.
Traps
IDS detects; IPS blocks inline. A DMZ hosts externally reachable services but must not expose internal databases. Stateful firewalls track connections; stateless ACLs evaluate each packet independently. Zero trust does not mean "no perimeter"-it means verify continuously and assume breach.
Worked example
A web server must be reachable from the internet but must query an internal database. Place the web server in the DMZ; allow inbound 443 from internet to DMZ, and a narrowly scoped outbound rule from DMZ to the database subnet only. Deny all else by default.
Rule of thumb: design default-deny with explicit allow rules, and put internet-facing services in a segmented zone.