An ninh mạngNetwork Security

Part of the Network Engineer Roadmap knowledge base.

Overview

Network security is the collection of policies, controls, architectures, and technologies that protect the confidentiality, integrity, and availability of data as it moves across and rests on a network. For a network engineer, security is not a bolt-on feature that a separate team adds later — it is a design property that you bake into addressing plans, routing, switching, segmentation, and every device configuration.

This note is written from a defensive point of view. The goal is to understand attacks well enough to detect and prevent them and to design networks that fail safely — not to perform them. Everywhere an attack is described, the emphasis is on detection and mitigation.

This note covers:

• Security fundamentals: the CIA triad, defense-in-depth, least privilege, segmentation, and the DMZ.
• Firewalls: packet-filtering (stateless), stateful inspection, circuit-level gateways, application-layer/proxy firewalls, and the Next-Generation Firewall (NGFW) — with a comparison table.
• ACLs: standard vs extended, direction, rule ordering, implicit deny — with Cisco configuration examples.
• IDS vs IPS: signature vs anomaly detection, inline vs passive, NIDS vs HIDS.
• Cloud security groups & NACLs (briefly — deep dive in ./16-cloud-networking.md).
• Zero-Trust Architecture (ZTA): “never trust, always verify”, microsegmentation, identity-based access, BeyondCorp/ZTNA.
• Encryption basics for the network engineer: symmetric vs asymmetric, TLS/IPsec at a glance (deep dive in ./12-vpn-and-tunneling.md), MACsec.
• Common network attacks and how to defend against them: DoS/DDoS, spoofing, MITM, ARP poisoning, VLAN hopping.

Security depends heavily on a correct addressing and subnetting plan (./05-ip-addressing-and-subnetting.md), because segmentation, ACLs, and firewall rules are all expressed in terms of subnets. If you want to formalize this knowledge, CompTIA Security+ is the natural entry-level certification — see ./18-certifications-and-learning-path.md.

Fundamentals

The CIA triad

Every security control ultimately serves one or more of three goals:

A common extension adds Authentication, Authorization, and Accounting (AAA), and non-repudiation. Every design decision can be traced back to one of these properties — if a control does not serve one, question why it exists.

Defense-in-depth

Defense-in-depth means layering independent controls so that the failure or bypass of any one layer does not compromise the whole system. An attacker who gets past the perimeter firewall still faces segmentation, host firewalls, IDS/IPS, authentication, and encryption.

No single layer is trusted to be perfect. This is the opposite of the old “hard shell, soft center” model where a strong perimeter protected a flat, fully trusted internal network.

Least privilege

Least privilege grants every user, device, and service only the access it needs to do its job — nothing more. On the network this translates to:

• ACLs and firewall rules that permit only required protocols/ports between only the subnets that need them, then deny everything else (default-deny).
• Management planes (SSH, SNMP, device GUIs) restricted to a dedicated management VLAN and jump hosts.
• Service accounts scoped to specific hosts and ports.

Network segmentation

Segmentation divides a network into isolated zones so that a compromise in one zone cannot freely spread (“lateral movement”) to others. Techniques:

• VLANs — Layer-2 segmentation within a switch fabric.
• Subnets + ACLs/firewalls — Layer-3 segmentation with inter-zone policy enforcement.
• Microsegmentation — very fine-grained, often per-workload segmentation enforced by host firewalls or SDN policy (a core Zero-Trust technique).

Typical zones: user VLANs, server VLANs, voice VLAN, guest/BYOD, IoT/OT, management, and the DMZ. Traffic between zones must pass through a policy enforcement point (firewall or L3 device with ACLs).

The DMZ (Demilitarized Zone)

A DMZ is a semi-trusted network segment that sits between the untrusted Internet and the trusted internal network. It hosts services that must be reachable from the outside — web servers, reverse proxies, mail gateways, DNS. If a DMZ host is compromised, the attacker is still separated from the internal network by a second firewall layer.

Internet ── Firewall A ── DMZ (web, mail, DNS) ── Firewall B ── Internal LAN

Rules of thumb:

• Internet → DMZ: allow only the specific published services (e.g., 443).
• DMZ → Internal: deny by default; allow only tightly scoped flows (e.g., web server → specific DB port).
• Internal → DMZ / Internet: controlled by policy, often via a proxy.

Key Concepts

Firewalls

A firewall enforces a security policy on traffic crossing a boundary, allowing or denying flows based on rules. Firewalls have evolved through several generations, from simple packet filters to context-aware NGFWs.

Packet-filtering (stateless) firewall

Operates at Layer 3/4. It examines each packet in isolation against static rules (source/destination IP, protocol, port, flags). It keeps no state, so it cannot tell whether a packet belongs to an established connection — you must write explicit rules for both directions. Fast and cheap, but coarse.

Stateful inspection firewall

Maintains a state table of active connections. When an internal host initiates a connection, the firewall records it and automatically permits the corresponding return traffic, dropping unsolicited inbound packets that do not match an existing session. This is the baseline for virtually all modern firewalls.

Circuit-level gateway

Operates at the session layer (L5). It validates the TCP handshake and monitors that sessions are legitimate, then relays traffic without inspecting payloads. SOCKS proxies are a classic example. Lightweight but no application-content visibility.

Application-layer / proxy firewall

Operates at Layer 7 and terminates connections on behalf of clients, acting as an intermediary. It understands specific protocols (HTTP, FTP, DNS, SMTP) and can inspect and filter content, hide internal structure, and enforce protocol correctness. Higher latency and more resource-intensive.

Next-Generation Firewall (NGFW)

Combines stateful inspection with:

• Deep Packet Inspection (DPI) — inspects packet payloads, not just headers.
• Application awareness — identifies applications regardless of port (e.g., recognizes that traffic on 443 is really a file-sharing app).
• Integrated IPS — signature-based intrusion prevention inline.
• Threat intelligence & reputation feeds — blocks known-bad IPs/domains/URLs.
• User-identity integration (via directory services) and TLS/SSL inspection.

Firewall types comparison

Access Control Lists (ACLs)

An ACL is an ordered list of permit/deny rules applied to router/switch interfaces or firewall zones. On Cisco IOS there are two main types:

• Standard ACL (numbered 1–99, 1300–1999): filters on source IP only. Place it close to the destination (because it cannot distinguish traffic types, placing it near the source would over-block).
• Extended ACL (numbered 100–199, 2000–2699, or named): filters on source and destination IP, protocol, and ports. Place it close to the source to drop unwanted traffic early.

Key rules of ACL behavior:

1. Direction matters — an ACL is applied in or out on an interface, relative to the router. Always reason from the router’s perspective.
2. Order matters — rules are evaluated top-down; the first match wins and processing stops. Put specific rules before general ones.
3. Implicit deny — every ACL ends with an invisible deny any. If nothing matches, the packet is dropped. Always include an explicit permit for the traffic you want.

Cisco ACL examples

Standard named ACL — allow only the management subnet to reach the router VTY (SSH) lines:

ip access-list standard MGMT-ONLY
 permit 10.10.99.0 0.0.0.255
 deny   any log
!
line vty 0 4
 access-class MGMT-ONLY in
 transport input ssh

Extended named ACL — an inbound Internet edge policy on the outside interface:

ip access-list extended INTERNET-IN
 ! Allow established return traffic
 permit tcp any any established
 ! Publish the DMZ web server on 443 only
 permit tcp any host 203.0.113.10 eq 443
 ! Allow inbound DNS to the DMZ resolver
 permit udp any host 203.0.113.11 eq 53
 ! Anti-spoofing: drop packets claiming to be from our internal ranges (BCP38)
 deny   ip 10.0.0.0 0.255.255.255 any log
 deny   ip 172.16.0.0 0.15.255.255 any log
 deny   ip 192.168.0.0 0.0.255.255 any log
 ! Explicit deny with logging (documents the implicit deny)
 deny   ip any any log
!
interface GigabitEthernet0/0
 description ** Internet uplink **
 ip access-group INTERNET-IN in

Note the wildcard masks (inverse of subnet masks): 0.0.0.255 matches a /24. See ./05-ip-addressing-and-subnetting.md for the arithmetic.

The same default-deny discipline applies to Linux hosts. nftables (modern) inbound example:

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;   # default-deny
    ct state established,related accept                # stateful return traffic
    iif "lo" accept                                    # loopback
    tcp dport 22 ip saddr 10.10.99.0/24 accept         # SSH from mgmt subnet only
    tcp dport 443 accept                               # public HTTPS
    ct state invalid drop
    ip protocol icmp icmp type echo-request limit rate 5/second accept
  }
}

Equivalent iptables essentials:

iptables -P INPUT DROP                                          # default-deny
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.99.0/24 --dport 22 -j ACCEPT  # SSH from mgmt only
iptables -A INPUT -p tcp --dport 443 -j ACCEPT                  # HTTPS
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

IDS vs IPS

An Intrusion Detection System (IDS) monitors traffic and alerts on suspicious activity. An Intrusion Prevention System (IPS) sits inline and can block malicious traffic in real time.

Detection methods:

• Signature-based — matches traffic against a database of known attack patterns. Accurate for known threats, low false positives, but blind to novel (zero-day) attacks and needs constant signature updates.
• Anomaly-based (behavioral) — builds a baseline of “normal” and flags deviations. Can catch unknown attacks but is prone to false positives and requires tuning.

Deployment scope:

• NIDS/NIPS (network-based) — monitors a network segment, typically via a SPAN/mirror port (IDS) or inline (IPS).
• HIDS/HIPS (host-based) — runs on an endpoint, sees local files, processes, and system calls in addition to that host’s traffic.

Detection engines: signature vs anomaly (as above) — apply to both IDS and IPS. Popular open-source engines include Snort, Suricata (NIDS/NIPS), and Zeek (network security monitoring). Modern NGFWs embed IPS functionality directly.

Cloud security groups & NACLs

In cloud environments the firewall model is split into two layers (AWS terminology; other providers are analogous):

Because SGs are stateful, you only define the inbound (or outbound) rule and the response is permitted automatically. NACLs are stateless like classic packet filters, so you must open ephemeral return ports explicitly. This is only a summary — the full treatment (SGs, NACLs, VPC design, cloud NAT, private endpoints) is in ./16-cloud-networking.md.

Zero-Trust Architecture (ZTA)

Zero Trust replaces the perimeter-centric model with the principle “never trust, always verify.” No user, device, or network location is trusted implicitly — every access request is authenticated, authorized, and encrypted, regardless of whether it originates inside or outside the corporate network.

Core tenets (NIST SP 800-207):

• Verify explicitly — authenticate and authorize every request based on identity, device posture, location, and behavior.
• Least-privilege access — grant just-in-time, just-enough access per session.
• Assume breach — segment aggressively, encrypt everything, log and inspect continuously.

Key mechanisms:

• Microsegmentation — per-workload isolation so that lateral movement is blocked even inside a “trusted” subnet.
• Identity-based access — access is tied to strong identity (MFA, device certificates) rather than IP address or network location.
• Policy Enforcement Point (PEP) + Policy Decision Point (PDP) — a broker evaluates each request against policy before granting access to a resource.
• ZTNA (Zero-Trust Network Access) — replaces broad VPN access with per-application, identity-aware tunnels. Google’s BeyondCorp is the canonical implementation.

Contrast with the legacy model: a traditional VPN, once connected, often places the user on a flat trusted network. ZTNA instead brokers access to individual applications and never exposes the broader network. VPN mechanics are covered in ./12-vpn-and-tunneling.md.

Encryption basics for the network engineer

Encryption protects confidentiality (and, with authentication, integrity) of data in transit and at rest.

• Symmetric encryption — the same secret key encrypts and decrypts (AES, ChaCha20). Fast; used for bulk data. Challenge: securely distributing the shared key.
• Asymmetric encryption — a mathematically linked public/private key pair (RSA, ECDSA, ECDH). Anything encrypted with the public key can only be decrypted with the private key, and vice-versa for signatures. Slower; used to exchange symmetric keys and to authenticate.

Real protocols combine both: asymmetric crypto performs authentication and a key exchange, then a fast symmetric cipher protects the actual data.

• TLS encrypts application traffic and authenticates the server (and optionally the client) via certificates. It is the foundation of HTTPS.
• IPsec secures IP traffic with AH (integrity/authentication) and ESP (encryption + integrity), in transport or tunnel mode — the workhorse of VPNs.
• MACsec provides hop-by-hop encryption at Layer 2, protecting traffic between directly connected devices even before it reaches an IP-layer boundary.

TLS and IPsec are covered in depth in ./12-vpn-and-tunneling.md.

Common network attacks — and how to defend

The following is defensive: what each attack is and how to detect and mitigate it. It is deliberately not a how-to for performing attacks.

DoS / DDoS (Denial of Service / Distributed DoS)

What it is: attempts to exhaust a target’s resources so legitimate users cannot be served. A DDoS uses many distributed sources (often a botnet). Three broad categories:

• Volumetric — saturates bandwidth (e.g., reflection/amplification floods).
• Protocol / state-exhaustion — exhausts connection tables or device state (e.g., SYN floods).
• Application-layer (L7) — exhausts server resources with seemingly legitimate requests (e.g., HTTP floods).

Defense / mitigation:

• Rate limiting and connection limits at the edge; SYN cookies to survive SYN floods.
• Upstream scrubbing — route traffic through a DDoS-mitigation/scrubbing provider that filters attack traffic and forwards clean traffic.
• Anycast — announce the service from many locations so volumetric traffic is absorbed and dispersed across a large distributed network.
• CDN / WAF in front of web apps to absorb and filter L7 floods.
• Overprovisioning and autoscaling for headroom; BCP38 anti-spoofing at ingress to reduce reflection abuse.
• Blackhole / RTBH routing as a last-resort to drop traffic to a targeted IP.

Spoofing

What it is: forging a source identity — IP spoofing (fake source IP), MAC spoofing, DNS spoofing, or email spoofing — to impersonate a trusted entity or evade filters.

Defense:

• Ingress/egress filtering (BCP38/uRPF) — drop packets whose source address could not legitimately arrive on that interface.
• DHCP snooping + Dynamic ARP Inspection (DAI) + IP Source Guard on switches to bind IP/MAC/port.
• DNSSEC to authenticate DNS responses; SPF/DKIM/DMARC for email.
• Authenticate at the application layer — never trust an IP address as identity.

MITM (Man-in-the-Middle)

What it is: an attacker secretly relays/alters traffic between two parties who believe they communicate directly.

Defense:

• Strong encryption with certificate validation — TLS with proper cert checking, HSTS, and pinning where appropriate defeats passive interception and detects tampering.
• Mutual authentication (mTLS, IPsec with strong IKE).
• Switch protections (DAI, DHCP snooping) to prevent the L2 redirections MITM often relies on.
• Avoid untrusted networks or tunnel over a VPN (./12-vpn-and-tunneling.md).

ARP poisoning / ARP spoofing

What it is: because classic ARP has no authentication, an attacker on the same L2 segment can send forged ARP replies to associate their MAC with another host’s IP (often the gateway), enabling MITM or DoS.

Defense:

• Dynamic ARP Inspection (DAI) — validates ARP packets against the DHCP snooping binding table and drops forged ones.
• DHCP snooping as the trust source for DAI; IP Source Guard.
• Static ARP entries for critical hosts in small/sensitive environments.
• Port security to limit MACs per port; segment broadcast domains to shrink the blast radius.

VLAN hopping

What it is: getting frames onto a VLAN the attacker should not reach, via switch spoofing (negotiating a trunk) or double-tagging (nesting two 802.1Q tags).

Defense:

• Disable DTP / auto-trunking — set access ports to switchport mode access and switchport nonegotiate.
• Change the native VLAN on trunks to an unused, dedicated VLAN and never carry user traffic on it — this defeats double-tagging.
• Explicitly allow only required VLANs on trunks (switchport trunk allowed vlan).
• Put unused ports in a shutdown/parking VLAN and administratively disable them.

Cisco access-port hardening example:

interface range GigabitEthernet0/1 - 24
 switchport mode access
 switchport access vlan 20
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict

Best Practices

• Default-deny everywhere. ACLs, firewall rules, security groups, and NACLs should permit only what is explicitly required and drop the rest. Rely on the implicit deny, but log it.
• Segment aggressively. Separate users, servers, management, guest, IoT/OT, and DMZ. Enforce inter-zone policy at a firewall or L3 ACL. Move toward microsegmentation.
• Protect the management plane. SSH only (never Telnet), on a dedicated management VLAN, restricted by ACL to jump hosts, with MFA and strong AAA (TACACS+/RADIUS). Disable unused services.
• Apply least privilege to every user, device, and service account.
• Harden Layer 2. Enable DHCP snooping, Dynamic ARP Inspection, IP Source Guard, port security, BPDU guard; disable auto-trunking; set a dedicated native VLAN.
• Anti-spoofing at the edge. Deploy BCP38 ingress/egress filtering and uRPF.
• Layer detection with prevention. Combine an inline IPS/NGFW with out-of-band IDS/monitoring (Suricata/Zeek) and centralized logging (SIEM).
• Encrypt in transit. TLS for applications, IPsec for VPNs, MACsec for sensitive links. Validate certificates; disable weak ciphers and old protocol versions.
• Plan for DDoS before you need to: upstream scrubbing, CDN/WAF, anycast, rate limiting, and a runbook.
• Log, monitor, and alert. You cannot defend what you cannot see. Centralize logs, baseline normal, and alert on anomalies.
• Patch and update firewall/IPS signatures, device firmware, and threat-intel feeds regularly.
• Adopt Zero-Trust principles incrementally: strong identity + MFA, device posture, per-application access (ZTNA), assume-breach segmentation.
• Test and audit. Regular configuration reviews, rule cleanup (remove stale ACL/firewall entries), and authorized penetration tests.
• Document. Every ACL and firewall rule should have a comment/remark explaining its purpose and owner.

References

• NIST SP 800-207 — Zero Trust Architecture
• NIST SP 800-41 Rev.1 — Guidelines on Firewalls and Firewall Policy
• OWASP — Network Segmentation Cheat Sheet
• Cloudflare Learning — What is network security?
• Cloudflare Learning — DDoS attacks and mitigation
• Cisco — Configuring IP Access Lists
• Google BeyondCorp — A New Approach to Enterprise Security
• BCP38 / RFC 2827 — Network Ingress Filtering