Network Security: Principles and Practical Controls

The CIA triad

Every security decision protects one or more of three properties:

• Confidentiality: only authorised people and systems can read the data. Encryption such as TLS and access controls support it.
• Integrity: data is not altered without detection. Hashes, digital signatures and change control support it.
• Availability: systems and data are reachable when needed. Redundancy, backups and DDoS protection support it.

A ransomware incident threatens all three: it can expose data, alter it and make it unavailable. Thinking in CIA terms helps you explain risk to managers in plain language.

Defence in depth

No single product stops every threat. Defence in depth layers independent controls so that an attacker who gets past one still meets another, and defenders get more chances to detect and respond.

Firewalls and segmentation

A stateful firewall tracks connections and allows return traffic automatically. Good rule sets follow default deny: block everything, then allow only the specific traffic the business needs. Next-generation firewalls add application awareness, TLS inspection and intrusion prevention.

On a single Linux host, ufw expresses the same principle:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.10.0/26 to any port 22 proto tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

This allows HTTPS from anywhere but SSH only from the admin subnet. Segmentation applies the same idea across a network: put servers, staff, guests, CCTV and payment systems in separate VLANs and filter traffic between them, as explained in our routing and switching guide. Zero Trust architectures extend this by verifying every request based on identity and device health rather than network location.

Least privilege, MFA and patching

• Least privilege: give each user, service account and device only the access it needs, for only as long as it needs it. A helpdesk account should not be a domain administrator, and a web server should not be able to reach the HR database.
• Multi-factor authentication (MFA): require a second factor, such as an authenticator app or hardware security key, for VPN access, email, cloud consoles and all administrator accounts. Phishing-resistant methods such as FIDO2 keys and passkeys are stronger than SMS codes.
• Patching: keep an inventory of devices and software, apply security updates promptly, and prioritise internet-facing systems and vulnerabilities listed as actively exploited. Include firmware for routers, switches and firewalls, which are often forgotten.

Consider a common scenario: an employee's password is captured by a phishing page. With MFA, the stolen password alone does not open the account. With least privilege, even a compromised account can reach only a narrow set of systems. With prompt patching, the attacker finds fewer known weaknesses to use from that foothold. Each control is imperfect on its own, but together they turn a likely breach into a contained event.

These three controls are inexpensive compared with the incidents they prevent, which is why security frameworks list them among the first things to put in place.

VPNs, IDS and IPS, and monitoring

A VPN encrypts traffic between remote users or sites and the corporate network, commonly using IPsec or TLS-based protocols, and WireGuard is increasingly used. An IDS (intrusion detection system) watches traffic and raises alerts; an IPS (intrusion prevention system) sits inline and can block matching traffic. Open-source tools such as Suricata and Zeek are widely used to learn these concepts.

Logs only help if someone reads them. Send firewall, VPN, server and authentication logs to a central system or SIEM, define alerts for events such as repeated failed logins or new administrator accounts, and review them on a schedule.

Testing your own network responsibly

Defenders verify that controls work. Nmap can list open ports on hosts you own or have written authorisation to test, and Wireshark can confirm that sensitive traffic is encrypted. Always keep scans within an agreed scope, because scanning networks without permission can break the law and your employer's policies.

If you want to practise these controls step by step, SkillNewton's online network security course covers firewalls, segmentation and monitoring through project-based work. For the wider picture, read our introduction to cybersecurity.

Common mistakes

• Relying on a perimeter firewall alone and leaving the internal network flat.
• Writing allow-all firewall rules during testing and never removing them.
• Enabling MFA for regular users but exempting administrator and service accounts.
• Forgetting to patch network devices because they keep working without attention.
• Collecting logs without anyone reviewing them or acting on alerts.

Frequently asked questions