Network Security — From Firewalls to Zero Trust

OSI Layers and Security

Layer	Name	Security issue	Control
7	Application	XSS, SQL injection, phishing	WAF
6	Presentation	Weak cryptography	TLS/SSL
5	Session	Session hijacking	Session-token management
4	Transport	SYN flood, port scans	Firewall, IPS
3	Network	IP spoofing, routing attacks	Firewall, ACL
2	Data link	ARP spoofing, MAC flooding	Dynamic ARP inspection
1	Physical	Wiretap, physical access	Physical security

Firewall Types

Packet filter: IP and port. Fast. No connection state.

Stateful: Tracks TCP connection state. The current baseline.

Next-generation (NGFW): Application awareness, DPI, IPS in one box.

WAF: Inspects HTTP. Used against OWASP Top 10 classes of bugs.

IDS vs IPS

IDS: Detects. Does not block.

IPS: Detects and blocks.

Detection methods:

Signature: Matches known attack patterns. Fast. Misses zero-days.
Anomaly: Flags deviation from a baseline. More false positives.

VPN

A private tunnel over a public network.

IPsec VPN: Network layer. Fits site-to-site.

SSL/TLS VPN: Application layer. Fits remote users, including browser access.

Types:

Site-to-site: Two office networks
Remote access: A worker reaching the internal network

Zero Trust

Never trust, always verify.

Legacy model: inside the network = trusted. Outside = untrusted.
Zero Trust: every request is verified, inside or out.

Core ideas:

Do not trust users, devices, or networks by default
Least privilege
Explicit verification (MFA, device posture)
Assume breach

Common Network Attacks

DoS/DDoS: Availability. SYN flood, volumetric floods.

MITM: Intercept and alter a session.

ARP spoofing: Fake ARP replies to steal traffic.

DNS hijacking: Answer a DNS query with a fake IP.

Key Concept Cards

Stateful firewall ★★★★★
: Tracks TCP state. Smarter than a packet filter. Today’s default firewall.

IDS vs IPS ★★★★★
: IDS = detect (not inline). IPS = detect and block (inline). IPS false positives can halt service.

Zero Trust ★★★★★
: No default trust. Internal users and networks are not trusted either.

Practice Quiz

Q1. A remote worker needs a safe path to an internal file server. What do you use?

A remote-access SSL/TLS VPN. The worker authenticates (client or browser) and gets an encrypted tunnel. Pair it with MFA and device checks and you are also applying Zero Trust.

Q2. Why does Zero Trust fit cloud better than a VPN-only model?

VPN assumes a trusted interior once you are on the network. Cloud has no clean interior. Zero Trust evaluates user, device, and request every time — which matches cloud, remote work, and SaaS.