Network Security

Network security protects data in transit and the network infrastructure itself, using cryptographic protocols, perimeter controls, and monitoring to defend against eavesdropping, spoofing, denial of service, and intrusion.

Definition

Network security is the practice of protecting the confidentiality, integrity, and availability of data as it travels across networks, and of the network devices and services themselves, against malicious activity.

Scope

This topic, viewed from the cryptography and security side, covers the threats specific to networked communication and the defenses against them: network-layer encryption (IPsec, VPNs), firewalls and network segmentation, intrusion detection and prevention, denial-of-service mitigation, and DNS and routing security. It addresses how cryptography secures traffic against on-path attackers. It excludes the secure-channel protocol details of TLS and the network-architecture topics covered under computer networks.

Core questions

• What attacks threaten data and services as they cross untrusted networks?
• How does network-layer cryptography (IPsec, VPNs) protect traffic transparently to applications?
• How do firewalls and segmentation limit an attacker's reach within a network?
• How are intrusions and anomalous traffic detected and contained?
• How are foundational services like DNS and routing protected from spoofing and hijacking?

Key concepts

• on-path (man-in-the-middle) attacker
• IPsec and VPNs
• firewalls
• network segmentation
• intrusion detection and prevention
• denial-of-service mitigation
• DNS security (DNSSEC)
• ARP and route spoofing
• packet filtering

Key theories

Defense in depth and segmentation

Networks are defended with layered, independent controls — perimeter firewalls, internal segmentation, host defenses, and monitoring — so that breaching one layer does not grant free movement across the whole network.

Cryptographic protection of traffic in transit

Confidentiality and integrity of network traffic are achieved by encrypting and authenticating packets (IPsec) or sessions, defeating eavesdropping and tampering by an attacker positioned on the path.

Mechanisms

Network-layer security encrypts and authenticates IP packets (IPsec's ESP and AH), establishing tunnels between gateways or hosts so that applications need not change. Firewalls enforce policy by filtering packets on addresses, ports, and connection state, while segmentation isolates network zones. Intrusion-detection systems inspect traffic for signatures or anomalies, and DNSSEC signs DNS records to prevent forged responses. These controls assume an adversary may observe or inject traffic on the path.

Clinical relevance

Network security underlies remote work and enterprise operations: VPNs and IPsec connect branch offices and remote employees securely, firewalls and segmentation contain breaches, and DDoS mitigation keeps online services available. High-profile incidents — BGP route hijacks, DNS cache poisoning, and large botnet-driven DDoS attacks — show what happens when these protections fail.

Evidence & guidelines

IPsec is standardized across RFCs (4301 and related), DNSSEC in RFC 4033-4035, and guidance is given in NIST SP 800-41 (firewalls) and SP 800-77 (IPsec VPNs). Modern guidance favors zero-trust segmentation (NIST SP 800-207) over flat perimeter-only networks, and the MITRE ATT&CK framework catalogs network-borne attack techniques.

History

Network security became urgent as TCP/IP networks grew: the 1988 Morris worm spread across the early internet, the 1990s brought firewalls and the first VPNs, and IPsec was standardized to secure the network layer. Repeated incidents in DNS (Kaminsky's 2008 cache-poisoning attack) and routing (BGP hijacks) drove the deployment of DNSSEC and routing-security measures, while DDoS attacks grew into a persistent threat.

Key figures

• William Stallings
• Ross Anderson
• Steven Bellovin
• Radia Perlman

Seminal works

• stallings2017
• anderson2020
• kurose2021

Frequently asked questions

Does a VPN make me anonymous online?

A VPN encrypts traffic between you and the VPN server, hiding it from your local network and your ISP and masking your IP from destination servers. It does not provide full anonymity: the VPN provider can see your traffic, and other tracking (cookies, accounts, fingerprinting) still identifies you.

If traffic is encrypted with TLS, why is network security still needed?

TLS protects individual application sessions, but networks also face denial-of-service, intrusion, lateral movement after a breach, DNS and routing attacks, and unencrypted or misconfigured services. Network-level defenses address threats that per-session encryption alone cannot.