Layer by Layer
Confidence by Practice
Preparing your CISSP domains…
Read knowledge points freely. Practice, saved topics, progress and personal records require sign-in.
338 knowledge points
Network architecture should be built around segmentation, minimal implicit trust, explicit boundaries, controlled protocols, observability, redundancy, and a protected management plane so compromise of one component does not easily spread across the environment.
The seven-layer OSI model helps locate network functions and controls: Physical, Data Link, Network, Transport, Session, Presentation, and Application. CISSP emphasizes identifying functions and attack surfaces by layer.
OSI Layer 1 carries bits over physical media and includes cabling, radio, interfaces, and electrical or optical signaling, along with physical interception and interference risks.
OSI Layer 2 handles local-link frames, MAC addressing, and switching; common risks include MAC flooding, ARP-related attacks, VLAN misconfiguration, and Layer 2 loops.
OSI Layer 3 handles logical addressing and routing, primarily IP. Security concerns include routing, segmentation, ACLs, IP spoofing, and network-layer tunnels.
OSI Layer 4 protocols such as TCP and UDP provide end-to-end transport, ports, and reliability semantics. Firewalls, load balancers, and session controls often use Layer 4 information.
OSI Layer 5 describes logical session establishment, maintenance, and termination. Real-world stacks often merge these functions into transport or application protocols.
OSI Layer 6 covers data representation, encoding, compression, and some encryption functions. Real TCP/IP implementations rarely expose it as a separate layer.
OSI Layer 7 provides network services directly to applications, such as HTTP, DNS, and SMTP. Application proxies, WAFs, and content controls can perform richer semantic analysis here.
Encapsulation adds protocol headers or trailers as data moves down the stack. A security device must understand the relevant layers or it may miss content hidden by tunneling or encryption.
De-encapsulation removes protocol wrappers at the receiver and passes payloads upward. Abnormal nesting, tunneling, and parsing inconsistencies can create security problems.
Common PDU terminology includes a Layer 2 frame, Layer 3 packet, and Layer 4 segment or datagram. The terms help identify the network-processing layer.
The TCP/IP model is commonly represented as Link, Internet, Transport, and Application. It maps conceptually to OSI rather than matching it layer-for-layer.
OSI is useful for teaching and layered analysis; TCP/IP reflects the deployed Internet protocol suite. Their layer counts should not be mechanically mapped one-to-one.
TCP provides connection-oriented, reliable, ordered byte-stream delivery using handshakes, sequence numbers, acknowledgments, retransmission, and flow control.
The TCP three-way handshake uses SYN, SYN-ACK, and ACK to establish a connection and synchronize sequence numbers. Half-open state can be abused in SYN-flood attacks.
TCP sequence numbers support ordering and reliable delivery. Predictable numbers or hijacked sessions can let an attacker inject forged data.
UDP is connectionless, lightweight, and does not guarantee delivery or ordering. It suits DNS, streaming, and real-time traffic, with security provided by the application or higher-layer protocol.
TCP emphasizes reliable connections and flow control; UDP emphasizes low overhead and latency. The choice depends on application requirements, and UDP is not inherently an “unsafe protocol.”
A port identifies a logical service endpoint on a host; a socket commonly combines IP address, port, and protocol. Open ports increase exposure, but the port number itself is not evidence of trust.
Common services use conventional well-known ports, but applications can run on nonstandard ports. Security policy should not identify a real protocol solely by port number.
IPv4 uses 32-bit addresses and supports unicast, broadcast, and multicast. Address scarcity drove mechanisms such as NAT.
RFC 1918 private IPv4 space is commonly used internally and translated for external access. A private address does not make a host inherently trusted or secure.
IPv4 subnetting divides address space into logical networks using prefixes, supporting routing, isolation, and broadcast-domain control.
CIDR expresses networks with prefix lengths such as /24 and improves address allocation and route aggregation.
A subnet mask identifies the network and host portions of an IPv4 address. Poor subnet design can enlarge broadcast domains or undermine isolation.
Unicast sends traffic from one source to one destination and is the most common form of IP communication.
IPv4 broadcast sends to all hosts in a local broadcast domain. It expands the receiving population and can be abused for discovery or amplification.
Multicast sends one source's traffic to multiple receivers that join a group, efficiently supporting uses such as video distribution and routing updates; group membership and routing must be controlled.
Anycast lets multiple nodes advertise the same address so routing generally directs a client to a topologically nearby instance. It is common in DNS, CDNs, and highly available services.
IPv6 uses 128-bit addresses, reduces address scarcity, and changes neighbor discovery, autoconfiguration, and broadcast semantics. Security design cannot simply copy IPv4 assumptions.
Primary IPv6 address types include unicast, multicast, and anycast; IPv6 does not use IPv4-style broadcast.
IPv6 link-local addresses are used for same-link neighbor discovery and autoconfiguration and are not forwarded by normal routers.
IPv6 global-unicast addresses are globally routable and generally do not require NAT for address conservation.
IPv6 Unique Local Addresses provide local-scope internal addressing somewhat analogous to private IPv4 usage, although their design and routing behavior differ from RFC 1918.
IPv6 Neighbor Discovery uses ICMPv6 to discover neighbors, routers, and address information and replaces some IPv4 ARP functions. Forged NDP messages can affect the local network.
SLAAC lets an IPv6 host form an address and default route from router advertisements. Malicious RAs or configuration errors can create security risk.
DHCPv6 can provide IPv6 addresses or other configuration and can be used independently of or together with SLAAC.
IPv6 is not inherently more secure than IPv4. NDP, router advertisements, extension headers, dual stack, and tunnels create different attack surfaces, and security devices must actually support IPv6.
Dual stack creates separate IPv4 and IPv6 reachability and policy surfaces. An attacker may use an overlooked IPv6 path to bypass controls focused only on IPv4.
IPv6 can be tunneled through IPv4 or other protocols. Automatic tunneling can cross intended boundaries or bypass monitoring.
NAT translates addresses and or ports and is widely used for IPv4 address reuse and edge connectivity. It is not a complete firewall and should not be the primary security model.
Port Address Translation allows multiple internal addresses to share one public address by using different source ports and is a common form of NAT.
NAT can hide internal addresses and reduce some direct inbound paths, but it is not a firewall and does not provide complete content inspection, authentication, or outbound-security policy.
Common traps: Do not treat NAT as a complete firewall or a zero-trust boundary.
IP fragmentation splits large packets for later reassembly at the destination. Overlapping or abnormal fragments can be used to evade inspection or trigger implementation flaws.
Path MTU Discovery determines the largest end-to-end packet size and depends on ICMP or similar feedback. Incorrectly blocking required ICMP can create black-hole connectivity problems.
ICMP carries network error, diagnostic, and control messages. Blocking it completely can break path discovery and troubleshooting, so security policy should be selective rather than absolute.
ICMPv6 is essential to IPv6 functions such as neighbor and path discovery and therefore cannot safely be blocked indiscriminately.
Source-IP spoofing can hide origin or support reflection and trust abuse. Ingress and egress filtering, stateful controls, and authenticated protocols reduce risk.
Ingress filtering drops source addresses that are clearly spoofed or should not arrive from a given direction, helping reduce spoofing.
In the 4.1 architecture context, egress filtering blocks internal hosts from sending source addresses, protocols, or other obviously inappropriate traffic that should not leave the network, reducing source spoofing and limiting compromised systems from attacking others.
Common traps: Do not perform only ingress filtering while allowing internal hosts to emit spoofed source addresses.
Distinctions: 4.1 architectural/boundary hygiene vs 4.2 firewall policy enforcement egress source-address/protocol validity filtering vs destination/service allowlisting
IPSec provides authentication, integrity, and optional confidentiality at the IP layer and is suitable for site-to-site or host-to-host secure communication.
IPSec AH provides data integrity and source authentication but does not encrypt the payload. Because it protects some IP-header fields, it is less compatible with NAT.
IPSec ESP can provide confidentiality and commonly also integrity or authentication, making it the more frequently used IPSec protection mechanism.
IPSec transport mode mainly protects the original IP payload while preserving the original IP header and is common in host-to-host scenarios.
IPSec tunnel mode encapsulates the entire original IP packet inside a new outer IP packet and is common for site-to-site VPNs and security gateways.
An IPSec Security Association defines one-way security parameters, algorithms, keys, SPI, and related state. Bidirectional communication generally uses multiple SAs.
IKE negotiates IPSec security parameters, identities, and keys. Weak authentication or deprecated algorithms can undermine the entire VPN.
SSH provides encrypted remote command execution, administration, and tunneling with server authentication and password or public-key client authentication. Disable weak algorithms and shared administrator accounts.
With SSH public-key authentication, the client proves possession of a private key while the server stores the corresponding public key. Private-key protection, revocation, and authorized_keys management are central.
SSH supports local, remote, and dynamic port forwarding. It can securely forward traffic but can also be abused to bypass network policy.
SSL is the predecessor to TLS and obsolete SSL versions should not be used for modern security. The outline retains “SSL/TLS” terminology for historical and migration context.
TLS provides confidentiality, integrity, and server authentication for application communications and can optionally authenticate clients. Security depends on version, certificates, cipher suites, and implementation.
TLS 1.3 removes many legacy algorithms and handshake options and simplifies negotiation. Existing systems may still use TLS 1.2, but obsolete configurations should be disabled.
TLS clients must validate the trust chain, hostname, validity period, and revocation or status semantics. Merely enabling HTTPS does not guarantee correct certificate validation.
Mutual TLS authenticates both client and server with certificates and is useful for high-assurance service-to-service communications, but certificate lifecycle and identity mapping still require governance.
Enterprise TLS inspection can decrypt traffic at a controlled boundary to detect malicious content, but introduces privacy, certificate-trust, performance, and high-value plaintext-processing risks.
Prefer currently supported, standardized, correctly authenticated protocols and disable insecure legacy mechanisms such as Telnet, plaintext FTP authentication, and SSL.
Telnet commonly transmits authentication and session content in plaintext and should not be used for modern remote administration; SSH is the common replacement.
Traditional FTP lacks built-in encryption for authentication and data channels; use SFTP, FTPS, or another protected file-transfer mechanism.
SFTP is an SSH subsystem, while FTPS applies TLS to FTP. Their similar names do not imply the same protocol stack or port behavior.
HTTPS is HTTP over TLS and protects transport and server identity, but it does not automatically eliminate application vulnerabilities, authorization errors, or malicious content.
Tunnels, encapsulation, encryption, and overlays can keep one security layer from seeing the real traffic or identity at another layer, so design must consider the complete protocol stack.
Protocol tunneling encapsulates one protocol inside another to cross a network. It supports legitimate VPN and compatibility uses but can also hide traffic or bypass boundaries.
If a security device parses only an outer encapsulation layer, malicious inner traffic, addresses, or protocols may remain invisible; appropriate termination, decryption, or deeper parsing may be required.
Different devices can parse unusual encapsulation, fragmentation, or protocol boundaries differently, causing an IDS, firewall, and endpoint to see different content.
Overlay technologies such as VXLAN or SDN overlays create logical networks above the physical underlay. Security policy must address overlay identity, control planes, and underlay dependencies.
The underlay provides foundational IP reachability; the overlay creates logical virtual networks. Overlay isolation does not remove underlay management and routing risks.
Converging storage, voice, compute, or other traffic onto a general data network can reduce infrastructure cost but expands shared failure domains and security impact.
iSCSI carries SCSI storage commands over IP networks, bringing storage traffic into ordinary network security boundaries and requiring attention to isolation, authentication, availability, and sensitive data.
Protect iSCSI with dedicated VLANs or networks, authentication such as CHAP, access restrictions, and encryption or tunneling as appropriate; an “internal” storage network is not automatically trusted.
VoIP carries voice signaling and media over IP and introduces eavesdropping, call hijacking, fraud, SPIT, availability, and QoS risks.
SIP commonly establishes, modifies, and terminates voice or video sessions. Signaling can be spoofed, hijacked, or abused and should use TLS, authentication, and boundary controls where appropriate.
RTP carries real-time audio or video media and does not by itself provide strong confidentiality; SRTP adds media encryption and integrity.
SRTP protects RTP media streams with encryption, message authentication, and replay protection; key establishment still requires a secure mechanism.
Real-time voice is sensitive to latency, jitter, and packet loss, so security inspection and encryption must be designed alongside QoS requirements.
High-performance computing and data centers can converge low-latency, high-throughput interconnect capabilities with Ethernet infrastructure, creating shared-network, isolation, and control-plane concerns.
Compute Express Link provides high-speed connectivity and resource sharing among CPUs, memory, and accelerators; pooled resources expand hardware trust boundaries and isolation requirements.
Transport architecture includes topology, forwarding models, data, control, and management planes, and path redundancy, which determine failure domains, visibility, and control placement.
Physical and logical network topology determines traffic paths, single points of failure, broadcast domains, and recovery options; assess the topology, not only individual devices.
A bus topology has many nodes share one medium. It is simple but has broad shared-medium failure and interception impact and is uncommon in modern enterprise networks.
A star topology connects endpoints to a central device, simplifying management and isolation but making central switches or uplinks potential single points that may need redundancy.
A ring topology forms a logical or physical loop. Some implementations provide deterministic paths or redundancy, but loop behavior and recovery depend on the protocol design.
A mesh topology provides multiple paths among nodes and can improve resilience at the cost of routing and management complexity; full-mesh cost rises quickly with node count.
In a hub-and-spoke topology, branches communicate through a central hub, enabling centralized control while concentrating performance and failure risk at the hub.
The data plane forwards actual user and business traffic at high speed according to forwarding state learned or programmed by the control plane.
The control plane learns routing, topology, and policy and builds forwarding state. Compromise can alter traffic paths across large parts of the network.
The management plane configures, monitors, and maintains network devices and is highly privileged; isolate and protect it with strong authentication, encryption, and source restrictions.
Out-of-band management uses a separate management network or channel, preserving administrative access during production-network failures and reducing exposure; the separate network still requires security.
In-band management shares the production network with business traffic, simplifying deployment but increasing dependence on and exposure to production-network failures and attacks.
Cut-through switching begins forwarding after reading enough destination information, reducing latency but potentially forwarding a damaged frame before full-frame validation.
Store-and-forward switching receives the full frame and checks its FCS before forwarding, adding latency but allowing corrupted frames to be discarded.
Network segmentation divides networks by business function, trust, sensitivity, and threat and constrains lateral movement through routing, firewalls, or policy.
Microsegmentation applies fine-grained policy at workload or service level to reduce east-west lateral movement and depends on reliable identity, policy, and observability.
Security zones group assets with similar trust and control requirements and constrain communication across boundaries, such as user, server, DMZ, and management zones.
A DMZ hosts services that must be externally reachable but should not sit directly on the internal trusted network, with boundary controls limiting access between the Internet and internal systems.
East-west traffic is lateral communication among services inside a data center or cloud. Traditional perimeter firewalls may not see it, so internal identity, segmentation, and monitoring are needed.
North-south traffic flows between internal and external networks or between clients and data centers and often crosses Internet edges, proxies, and perimeter firewalls.
Zero Trust Network Architecture does not grant implicit trust based on network location; access decisions use identity, device, and contextual signals before resource access. Identity-governance details belong to Domain 5.
Network resilience uses redundant paths, devices, carriers, failure domains, and automatic convergence to preserve critical communication while verifying that redundant components do not share hidden single points.
Redundancy and rapid failover improve availability, but synchronized state, shared keys, and additional paths can increase attack surface and should be designed with security.
Segment AI training, inference, data-preparation, and privileged-tool networks by trust and sensitivity so compromise of an AI interface cannot easily move laterally into data warehouses or core enterprise systems.
Apply fine-grained east-west policy to model services, vector databases, training nodes, GPU clusters, and tool calls to limit the blast radius of one compromised workload.
AI nodes and services should not be trusted merely because they reside in an internal training cluster; continuously validate identity and policy for user, device, service, model, and tool access.
Switches, routers, firewalls, wireless systems, load balancers, DNS or DHCP, and other network infrastructure require secure configuration, patching, protected management planes, logging, and lifecycle support.
Network security depends not only on configuration but also on power, vendor support, spare parts, firmware, capacity, and maintainability. Unsupported core devices create systemic risk.
Core switches, routers, firewalls, and wireless controllers should use dual power supplies, UPS systems, or independent power paths according to business criticality to avoid single-power-path outages.
Warranty, vendor support, and spare-parts availability affect failure recovery and security-patch availability; critical equipment life should not be judged only by whether it still powers on.
End-of-support or end-of-life network devices may stop receiving firmware fixes and vendor support and should be replaced, isolated, or covered by formally approved compensating controls.
Obtain firmware from trusted sources, verify signatures, test compatibility, and update promptly. Downgrading to old firmware can reintroduce known vulnerabilities.
Before deployment, disable unnecessary services, weak protocols, and default accounts; configure strong management authentication, time synchronization, logging, ACLs, and secure SNMP.
Network configurations should be versioned, audited, and changed through controlled processes with mechanisms to detect unauthorized or accidental drift.
Back up router, firewall, and switch configurations regularly and protect embedded secrets to speed failure recovery and incident analysis.
Web, SSH, API, console, and SNMP management interfaces are highly privileged and should be limited to management networks, trusted sources, and strong identities rather than directly exposed to the Internet.
Physical console ports can bypass network-layer restrictions; control facility access and device authentication, and treat console cables and terminal servers as part of the management boundary.
SNMP manages and monitors network devices. SNMPv1 or v2c rely on community strings and lack strong protection, while SNMPv3 can provide authentication and privacy.
An SNMP community string acts like a shared secret; default or weak values can expose device information or even permit configuration changes.
SNMPv3 supports user-based authentication, integrity, and optional encryption and is generally preferable to v1 or v2c for modern management.
Network devices commonly send events and status to centralized logging through syslog. Traditional UDP syslog is neither reliable nor confidential, so protected transport may be needed.
Consistent time is essential for log correlation, certificates, and authentication. NTP sources should be trusted and designed for authentication, redundancy, and tamper resistance as appropriate.
NTP synchronizes network-device and server clocks. Uncontrolled NTP can also be abused for amplification or time manipulation.
Administrator access to network devices should use individual identities, MFA, or centralized AAA rather than shared enable or password accounts.
AAA centrally controls administrator authentication, authorization, and accounting and commonly integrates with RADIUS or TACACS+.
RADIUS is commonly used for network-access AAA such as 802.1X, VPN, and wireless. Classic RADIUS uses UDP; in basic RADIUS the User-Password attribute in Access-Request is protected or obscured, but the rest of the packet body is not encrypted as a whole.
Common traps: Do not memorize RADIUS as a TCP protocol. Classic RADIUS does not encrypt the entire packet body. Do not treat typical RADIUS and TACACS+ device-management use as identical.
Distinctions: RADIUS commonly uses UDP; TACACS+ uses TCP classic RADIUS protects the User-Password attribute rather than the entire packet body RADIUS commonly couples authentication and authorization in the access exchange; TACACS+ separates AAA functions
TACACS+ is commonly used for network-device administrator AAA, uses TCP port 49, and separates Authentication, Authorization, and Accounting functions. It protects the packet body, although RFC 8907 technically describes that protection as obfuscation rather than modern strong encryption.
Common traps: Do not memorize TACACS+ as a UDP protocol. TACACS+ does not bind Authentication, Authorization, and Accounting into one indivisible exchange. Do not interpret the traditional phrase “encrypts the entire body” as RFC 8907 endorsement of modern strong encryption.
Distinctions: TACACS+ uses TCP; RADIUS commonly uses UDP TACACS+ separates authentication, authorization, and accounting TACACS+ protects/obfuscates the packet body while the standard header remains visible
High-yield CISSP comparison: RADIUS commonly supports user or network access, classic implementations use UDP, and mainly protect the Access-Request User-Password; TACACS+ commonly supports device administration, uses TCP or 49, separates AAA, and protects the packet body—more precisely called obfuscation by RFC 8907.
Common traps: Do not swap RADIUS and TACACS+ UDP or TCP characteristics. RADIUS and TACACS+ do not both protect the entire packet body in the same way. Do not overlook TACACS+'s finer-grained authorization and accounting for device administration.
Distinctions: transport: RADIUS = UDP; TACACS+ = TCP/49 protection scope: classic RADIUS = User-Password protection, not whole-body encryption; TACACS+ = body obfuscation/protection, header visible AAA semantics: RADIUS commonly couples authentication + authorization; TACACS+ separates authentication, authorization, accounting typical use: RADIUS = network access; TACACS+ = network-device administration
Routers control paths between networks and require protection of routing protocols, management interfaces, ACLs, and control-plane resources against hijacking and DoS.
Switches control Layer 2 forwarding and VLAN boundaries and should resist MAC flooding, VLAN hopping, forged trunks, and unauthorized ports.
A firewall permits or denies traffic according to policy using addresses, ports, state, application, identity, or similar context. It is a boundary control, not a complete network-security solution.
A packet-filtering firewall makes mainly stateless decisions from Layer 3 or 4 header fields. It is fast but lacks session and application context.
A stateful firewall tracks connection state and uses session context to decide whether return traffic is legitimate, providing more communication context than simple packet filtering.
An application proxy terminates and re-establishes application connections between client and server, enabling deep protocol-semantic inspection at the cost of latency and compatibility complexity.
A next-generation firewall commonly combines stateful inspection with application identification, user context, IPS, and TLS inspection. The product-category name does not guarantee security.
A WAF primarily protects HTTP application requests and responses and has a different role from a general network firewall; remediation of application vulnerabilities remains a Domain 8 responsibility.
Design firewall rules using default deny, minimum source, destination, and port scope, and a clear business owner; avoid permanent any-any rules and include review and expiration.
An earlier broad firewall rule can shadow a later specific rule so the intended rule never matches, causing the expected control to fail.
In the 4.2 firewall-policy context, egress filtering restricts which external destinations, services, ports, or applications internal hosts may reach, reducing C2, malicious downloads, and exfiltration. It complements the 4.1 source-address or protocol-validity form of egress filtering.
Common traps: Do not assume a firewall only needs inbound controls. Do not reduce all egress filtering to checking only whether the source IP is spoofed.
Distinctions: 4.2 firewall rule-set enforcement vs 4.1 architectural/boundary hygiene destination/service/application control vs source-address/protocol validity filtering
An IDS monitors network or host activity and alerts on suspicious behavior but usually does not block directly; effectiveness depends on visibility, rules, and response processes.
An IPS typically operates inline and can block malicious traffic, providing active prevention while introducing availability risk from false positives.
An IDS primarily detects and alerts; an IPS is generally inline and can block. Deployment mode and business risk determine the appropriate use.
Signature-based detection matches known attack patterns and can be precise but has limited coverage of unknown variants and encrypted traffic.
Anomaly-based detection finds deviations from a normal baseline and can identify unknown attacks, but tends to produce more false positives and requires a stable baseline.
NDR combines network telemetry, behavioral analysis, and event correlation to find lateral movement, C2, and anomalous traffic and to support investigation and response.
A physical or virtual network TAP copies link traffic for monitoring and normally does not block traffic like an inline device.
A SPAN or mirror port copies selected switch traffic to a monitoring port. It is easy to deploy but may drop packets or reduce observation fidelity under high load.
A proxy establishes connections on behalf of clients or servers and can enforce content, identity, caching, and policy controls while hiding some network details.
A forward proxy represents internal clients when accessing external services and commonly supports web filtering, identity, logging, and DLP.
A reverse proxy accepts client connections on behalf of backend servers and can hide backends, terminate TLS, load balance, and enforce application policy.
A load balancer distributes connections across backends for performance and availability and may terminate TLS or perform health checks; it can itself become a high-value single point.
Layer 4 load balancing forwards based on IP, port, and connection information and is efficient but has limited application context.
Layer 7 load balancing understands application content such as HTTP and can route by URL, header, or cookie, but requires deeper parsing and adds complexity.
A CDN caches content at edge locations and can absorb some DDoS traffic, while adding third-party, certificate, cache, and origin-protection trust boundaries.
A DNS resolver recursively queries names for clients and caches results, making it a common infrastructure service and high-value attack surface.
Authoritative DNS stores the official records for a domain and answers queries; its availability and integrity affect web access, email, and certificate-related services.
DNS cache poisoning tricks a resolver into storing forged records and redirecting users to malicious addresses; randomization, DNSSEC, and secure resolver design reduce risk.
DNSSEC uses digital signatures to validate DNS data origin and integrity and resist forged records; it does not provide confidentiality for DNS queries.
DoH and DoT encrypt client-to-resolver DNS queries, improving privacy and resistance to local tampering while potentially bypassing enterprise DNS monitoring and filtering.
DHCP automatically supplies IP address, gateway, DNS, and other network settings. A rogue DHCP server can distribute malicious parameters.
Unauthorized DHCP can hijack default-gateway or DNS settings; DHCP snooping, port controls, and network monitoring reduce this risk.
ARP maps IPv4 addresses to MAC addresses on a local network and lacks strong authentication, making spoofing possible.
ARP spoofing or poisoning forges ARP mappings to intercept or disrupt local traffic; Dynamic ARP Inspection, static mappings for critical systems, and end-to-end encryption can mitigate it.
MAC flooding fills a switch CAM table with forged source MAC addresses and can cause abnormal flooding; port-security features can limit the attack.
Port security limits the number or identity of MAC addresses allowed on a physical switch port, reducing unauthorized-device and MAC-flooding risk.
A VLAN creates a logical Layer 2 broadcast domain on switching infrastructure for segmentation and management. It is not a high-assurance security boundary and usually requires Layer 3 or firewall policy as well.
802.1Q trunking uses VLAN tags to carry multiple VLANs over one link; trunk misconfiguration can unintentionally expand reachability.
VLAN hopping exploits trunk negotiation or tag-handling weaknesses to cross intended VLAN boundaries; fix port modes, disable unnecessary negotiation, and configure the native VLAN correctly.
Spanning Tree Protocol prevents Layer 2 loops and broadcast storms by selecting a loop-free logical topology and blocking redundant paths.
An attacker who advertises superior bridge parameters can manipulate STP topology or attract traffic; BPDU Guard, Root Guard, and similar protections reduce the risk.
Link aggregation combines physical links for bandwidth and redundancy, but common physical paths or devices can still create common-mode failure.
A router ACL restricts traffic using addresses, protocols, ports, and related fields and is useful for simple boundaries; complex policy usually requires stateful or application-aware controls.
Routing protocols should restrict peers, authenticate updates, filter prefixes, and protect control-plane resources against accidental or malicious route propagation.
OSPF is an internal link-state routing protocol; constrain adjacency scope and use suitable authentication or controls to reduce forged routes and topology manipulation.
BGP is a path-vector protocol used by the Internet and large networks. Incorrect or malicious prefix advertisements can cause route hijacks or leaks.
BGP route hijacking occurs when an attacker or misconfigured operator advertises a prefix it does not own, misdirecting traffic; prefix filtering and RPKI reduce risk.
RPKI helps validate whether an Autonomous System is authorized to originate a particular IP prefix, mainly reducing origin hijacking; it does not validate the complete AS path.
MPLS uses label switching for provider VPNs and traffic engineering. MPLS isolation depends on provider configuration and should not automatically be treated as end-to-end encryption.
Software-Defined Networking separates centralized network-control logic from the forwarding data plane, increasing programmability while making the controller a high-value asset.
An SDN controller can change network policy at broad scale and should use strong authentication, isolation, redundancy, auditing, and protected northbound and southbound interfaces.
Network Function Virtualization moves firewalls, routing, load balancing, and similar functions from dedicated hardware into virtualized software, adding flexibility along with hypervisor and orchestration dependencies.
Traffic between VMs on one host may never traverse physical devices, so isolation and visibility must be implemented in virtual switches, distributed firewalls, or host controls.
Transmission media require protection against physical access, signal leakage, interference, distance limitations, and quality degradation; copper, fiber, and wireless have different risk profiles.
Copper media such as twisted pair and coaxial cable carry electrical signals, are inexpensive and common, but are more susceptible to electromagnetic interference and physical tapping.
Twisted-pair cabling reduces crosstalk and electromagnetic interference through twisting and is common in Ethernet; UTP and STP differ in shielding.
STP cabling adds shielding to reduce EMI but requires proper grounding; UTP is cheaper and more commonly deployed.
Coaxial cable uses a center conductor with shielding and has good interference resistance; it is less common in modern enterprise LANs but remains in specialized communications.
Fiber uses light, provides high bandwidth and long distance, and is immune to ordinary EMI. It is harder to tap without detection than copper but can still be tapped through bending or optical coupling.
Single-mode fiber supports longer distances and high bandwidth; multimode is common over shorter distances. Choice depends on distance, transceivers, and cost.
Fiber is not impossible to tap. Bending, optical coupling, or access to equipment ports can expose signals, so physical and cryptographic protection still matter.
External electromagnetic sources can disrupt copper and wireless signal quality; shielding, separation, grounding, and proper cabling reduce EMI.
Radio-frequency sources and equipment can interfere with communications and affect availability or error rates.
Crosstalk is signal coupling between adjacent conductors; twisting, shielding, and proper cabling practices reduce it.
Attenuation is signal-strength loss over distance. Exceeding a medium's design distance increases errors and outages and may require repeaters or a different medium.
Transmission design should consider attenuation, noise, interference, reflections, distance, and environment to maintain reliable communication while avoiding signal leakage beyond intended boundaries.
Restrict physical access to cables, patch panels, cabinets, and conduits and monitor critical paths to prevent tapping, disconnection, and unauthorized connections.
Network Access Control decides whether to permit, isolate, or restrict a device based on identity, device posture, and policy before or during network access.
Pre-admission NAC verifies identity and device posture before normal network access and can reject noncompliant endpoints or place them in quarantine.
Post-admission NAC continues to observe device state or behavior after connection and can re-restrict or isolate a device when risk changes.
Agent-based NAC installs endpoint software to collect patch, antivirus, configuration, and other posture information, giving rich visibility at added deployment and trust cost.
Agentless NAC evaluates devices through network observation, remote checks, or existing protocols without installing an agent, but may have less detailed visibility.
802.1X is a port-based network-access-control framework commonly composed of a supplicant, authenticator, and authentication server and typically integrates EAP with RADIUS.
The 802.1X supplicant is the client component requesting network access.
The 802.1X authenticator is usually a switch or wireless AP that controls the port and relays EAP authentication to a backend server.
The 802.1X authentication server commonly uses RADIUS to validate client credentials and return authorization results.
EAP is a framework for multiple network-authentication methods, not one authentication algorithm; the selected EAP method determines certificates, passwords, and tunnel protection.
EAP-TLS uses client and server certificates for strong mutual authentication, at the cost of more certificate-lifecycle management.
Noncompliant devices can be placed in a restricted VLAN or network for remediation or update-only access rather than being admitted directly to production.
Device posture can include patching, encryption, EDR, firewall, and configuration state as access-decision inputs, but posture is only partial evidence and does not prove absolute trust.
Endpoint security combines least privilege, patching, host firewalls, anti-malware, EDR, encryption, and application control and is an important layer beyond network-edge defenses.
A host-based firewall restricts inbound and outbound connections locally on an endpoint or server, protecting mobile devices and lateral traffic within the same network.
Anti-malware combines signatures, behavior, and reputation to detect malicious files and processes but does not replace patching, least privilege, or application control.
EDR continuously records process, file, network, and behavioral telemetry to detect and investigate advanced endpoint attacks and support response.
Application allowlisting permits only approved executables, scripts, or components, significantly restricting malicious code but requiring mature change and signing management.
Endpoint patching remediates operating-system, browser, and application vulnerabilities and should be driven by asset inventory and risk priority.
Endpoint disk encryption reduces disclosure if a device is lost or its media removed, but does not fully protect an already-unlocked system from malicious processes.
Reduce local administrators and standing privilege; use JIT or controlled elevation where appropriate to limit the impact of endpoint compromise.
Browser isolation executes untrusted web content in a remote or sandboxed environment, reducing the direct impact of browser exploits on enterprise endpoints.
Routers, switches, APs, firewalls, optics, controllers, and virtual network functions should have documented owners, versions, locations, and support status.
AI or ML can help NDR identify anomalies in traffic and behavioral baselines that signatures may miss, but false positives, model drift, and data quality still require human and rule-based validation.
AI network detection depends on representative, complete, high-quality telemetry. Gaps or poisoned data can produce false negatives, false positives, and incorrect automated responses.
When AI recommends or automatically executes blocking, routing, or isolation, use policy constraints, approval or rollback, and independent monitoring to prevent model errors from causing widespread business outages.
Select encryption, authentication, integrity, segmentation, availability, and monitoring controls for a communication channel based on data classification, identities, endpoints, path, and business requirements, and verify that the deployed channel matches the design.
End-to-end protection provides confidentiality and integrity between the true communicating endpoints, reducing dependence on intermediate networks. A proxy that terminates encryption changes the end-to-end trust boundary.
Link encryption protects only the connection between adjacent network nodes, with intermediate nodes potentially decrypting and re-encrypting traffic. It protects a transmission segment but is not end-to-end encryption.
Link encryption protects each hop while intermediate devices can see plaintext; end-to-end encryption normally keeps payloads unreadable to intermediate networks. The two can be layered together.
Authenticate the peer before relying on encryption; otherwise an encrypted channel may be established to an attacker. Certificates, pre-shared keys, or other identity mechanisms must be correctly bound.
Voice communications require protection against eavesdropping, call hijacking, impersonation, fraud, and availability attacks; VoIP also depends on IP networks and components such as SIP and RTP.
Video conferencing combines audio or video, screen sharing, chat, files, and meeting-control data and should protect meeting access, transport, recordings, and shared content.
Collaboration platforms combine chat, files, meetings, calendars, and third-party integrations and require strong identity, least sharing, guest governance, data protection, and auditing.
For sensitive meetings, use authenticated access, waiting rooms, host controls, time-limited links, and participant permissions instead of relying on public links or meeting IDs.
Meeting passcodes reduce random joining but are not sufficient as the only identity control for highly sensitive meetings because any holder of a leaked shared code can use it.
Waiting rooms let hosts review and approve participants before entry and reduce unauthorized joins, but still depend on correct host judgment.
Restrict who can share screens, what windows may be shared, and whether remote control is allowed to reduce accidental data exposure and malicious-content presentation.
Recordings can be copied and retained far longer than a live meeting. Classify them, restrict access, define retention, and obtain appropriate authorization.
Shared, always-on conference-room devices have cameras and microphones and should be patched, have restricted management interfaces, use device identity, and avoid default accounts.
Conference and smart devices should clearly indicate microphone or camera collection state, restrict remote activation, and grant application access using least privilege.
Unencrypted SIP or RTP or compromised switching can expose calls and credentials; use TLS or SRTP, segmentation, and endpoint protection.
Attackers can exploit weak SIP authentication, session state, or network position to modify or seize calls; protect signaling identity and session integrity.
Toll fraud abuses PBXs, SIP accounts, or call forwarding to generate unauthorized charges; restrict dialing privileges, use strong authentication, and monitor abnormal call patterns.
SPIT is large-scale automated voice spam that can disrupt users and VoIP infrastructure.
A voice VLAN logically separates voice devices from ordinary data endpoints for QoS and policy management, but a VLAN is not a strong standalone security boundary.
External collaboration guests should have minimum scope, defined duration, an accountable owner, and recurring review so access does not persist after the collaboration ends.
Federated collaboration simplifies cross-organization identity and sharing, but the other tenant's identity governance, domain control, and account compromise can affect your data boundary.
Remote access from outside the organization should establish trusted identity, a protected channel, least authorization, endpoint posture, and monitoring rather than relying only on the user's VPN location.
Remote administration of routers, firewalls, servers, and cloud control planes is highly privileged and should use dedicated management channels, strong MFA, jump hosts, and session auditing.
A VPN creates a protected tunnel over an untrusted network for remote-access or site-to-site communication. It protects the tunnel but does not automatically make endpoints or users trusted.
A remote-access VPN connects an individual user or device to organizational resources and should combine MFA, NAC or posture checks, least routing, and session monitoring.
A site-to-site VPN creates a protected tunnel between network gateways for branches or partners; precisely define the trust and reachable networks on both sides.
A full-tunnel VPN sends all remote-client traffic through the organizational VPN, enabling centralized security inspection at the cost of bandwidth and latency.
Split tunneling sends only enterprise-destined traffic through the VPN while other traffic uses the local Internet path, improving performance but creating a potential bridge between trusted and untrusted networks.
A compromised remote host using split tunneling can communicate simultaneously with the local Internet and the enterprise VPN, increasing monitoring-bypass and lateral-entry risk.
Always-on VPN automatically establishes the organization tunnel when the device is online, improving remote-policy consistency while requiring designs for outages, pre-logon identity, and recovery.
A clientless VPN typically exposes selected applications through a browser or portal without a traditional VPN client, but supports fewer protocols and creates a proxy trust boundary.
SSL or TLS VPNs use TLS for remote-access channels and usually traverse NAT or firewalls easily; security depends on certificates, client integrity, and application authorization.
IPSec VPNs create authenticated encrypted tunnels at the IP layer and are common for site-to-site and some remote-access deployments.
A VPN concentrator terminates many VPN sessions and is a high-value entry point that requires redundancy, patching, strong authentication, and anomalous-connection monitoring.
Assess patching, EDR, encryption, and device identity before and or after VPN connection to reduce the chance that an infected endpoint receives broad internal reachability.
A VPN only shows that a connection entered through a protected tunnel; it does not prove the user, device, or application behavior is trusted. Access still requires least privilege, segmentation, and continued validation.
Common traps: A device connected through a VPN should not automatically be treated as an internally trusted device.
ZTNA grants fine-grained access to applications based on user, device, and context rather than attaching a remote user to the entire network, and can complement or replace some traditional VPN use.
VPNs often provide a network-layer tunnel and broader reachability; ZTNA tends to authorize identity and context-specific application access. Real products may combine both models.
A bastion host is a specially hardened system exposed to a higher-risk zone and used as a controlled entry point or proxy; minimize services, monitor heavily, and patch rapidly.
A jump server is a controlled intermediate host administrators connect to before sensitive systems, centralizing authentication, auditing, and network paths and reducing direct management-interface exposure.
A Privileged Access Workstation is a dedicated high-trust endpoint for administering critical systems and should restrict normal web, email, and nonadministrative traffic to reduce credential theft and channel mixing.
Internet-exposed RDP is a common password-attack and exploit entry point; place it behind VPN, ZTNA, or jump hosts and use MFA and network restrictions.
SSH administration should verify host keys, use individual public keys, apply least-privilege sudo rights, and restrict sources rather than sharing a root password.
Out-of-band controllers such as BMC, iLO, and iDRAC can control hardware even when the OS is down and are therefore highly privileged; use isolated management networks, MFA, and current firmware.
Unmanaged dial-up or cellular modems can bypass enterprise boundaries and create hidden backdoors; inventory, disable, or tightly control them.
Wireless signals cross physical boundaries, so WLAN security depends on strong encryption and authentication, AP management, RF monitoring, and network segmentation.
802.11 Wi-Fi uses clients, APs, and distribution systems over a shared radio medium, creating eavesdropping, interference, rogue-AP, and evil-twin risks.
An SSID is only a wireless-network name, not a security control; hiding the SSID does not provide real access control or confidentiality.
WPA2 is based on 802.11i and commonly uses AES-CCMP. Personal mode relies on a shared password, while Enterprise mode commonly uses 802.1X or EAP.
WPA3 improves password authentication in personal networks and strengthens portions of Wi-Fi protection; secure deployment still requires correct configuration, compatible devices, and strong enterprise identity where applicable.
WPA-Personal uses a shared wireless secret across devices. It is easy to manage but has greater risk from employee departures, password sharing, and offline guessing.
WPA-Enterprise combines 802.1X or EAP with backend AAA to provide individual user or device authentication and is generally more appropriate for enterprise environments.
SAE is the password-authentication mechanism used by WPA3-Personal and improves resistance to offline guessing compared with traditional PSK handshakes, although weak passwords remain undesirable.
EAP-TLS provides strong mutual certificate authentication for enterprise Wi-Fi and reduces phishing and shared-credential risks while depending on PKI and certificate lifecycle management.
A rogue AP is an unauthorized wireless access point connected to the enterprise wired network and can bypass intended boundaries and NAC; detect it through inventory, switch-port controls, and wireless monitoring.
An evil twin imitates a legitimate SSID to lure clients into connecting for credential theft or MITM attacks; clients should validate server certificates and network identity.
Forged wireless management frames can disconnect clients for DoS or to induce reconnection to an evil twin; Protected Management Frames reduce some deauthentication and disassociation attacks.
802.11 Protected Management Frames provide integrity and authentication for selected wireless management frames and reduce forged deauthentication and disassociation attacks.
Wireless jamming disrupts radio availability and cannot be solved by encryption; spectrum monitoring, alternate communications, and source or location analysis are resilience measures.
A wireless site survey measures coverage, signal leakage, interference, and AP placement to meet availability needs while minimizing signal propagation beyond physical boundaries.
AP placement and power can extend signals into parking lots or neighboring spaces; use location, power settings, directional antennas, and strong authentication to reduce exposure.
Wireless IDS or IPS monitors rogue APs, evil twins, abnormal clients, and RF attacks. Automated blocking must avoid disrupting legitimate neighboring networks.
Bluetooth is short range but still vulnerable to weak pairing, unauthorized connections, and tracking; disable unnecessary discoverable mode and keep firmware current.
NFC's short range reduces remote attack surface but does not eliminate relay, eavesdropping, or malicious-tag attacks; sensitive transactions need additional authentication and validated distance assumptions.
4G or 5G provides carrier identity and encryption mechanisms, but devices, roaming, base stations, SIMs, and carrier trust remain part of the communication boundary.
A rogue base station or IMSI catcher can lure devices or induce downgrade behavior to collect identifiers or influence communication. End-to-end TLS or VPN reduces plaintext visibility at the carrier-network layer.
Enterprise data may traverse Internet, leased line, MPLS, SD-WAN, cellular, microwave, satellite, and other backhaul. Channel security should match the medium and third-party trust model.
A backhaul network connects branches, wireless access, cellular sites, or edge facilities to the core and is often carrier-provided; consider redundancy, encryption, and SLA requirements.
A leased line is a carrier-provided point-to-point circuit that can offer predictable performance but does not automatically provide end-to-end encryption or eliminate carrier-internal risk.
MPLS WANs can provide logical VPNs and QoS but primarily rely on carrier isolation rather than cryptographic encryption; sensitive data often still uses IPSec or TLS.
SD-WAN dynamically chooses among MPLS, Internet, cellular, and other paths based on application and link state and often includes encryption and centralized policy, making controllers and orchestrators high-value assets.
Protect SD-WAN control planes, device identities, overlay tunnels, centralized policy, and branch edges so controller compromise cannot affect the entire WAN.
Metro Ethernet is carrier-provided metropolitan Ethernet connectivity; trust and encryption requirements still depend on the service boundary.
Point-to-point microwave backhaul requires line of sight and can be jammed, intercepted, or physically misaligned; encrypt traffic and protect antenna locations.
Satellite links provide broad coverage and reach remote areas but introduce unique availability and interception risks from latency, weather, ground stations, and wide-area RF propagation.
Round-trip latency is especially high for geostationary satellites and affects interactive protocols, VPNs, and TCP performance; low-earth-orbit systems reduce but do not eliminate latency.
Satellite signals can be received over a wide geographic area, so sensitive payloads should use end-to-end encryption rather than relying on physical inaccessibility.
Intentional RF interference can make satellite links unavailable; resilience measures include frequency or power management, directional techniques, alternate links, and carrier response.
A satellite ground station connects space and terrestrial networks and is a high-value physical and network control point requiring strong identity, segmentation, device security, and physical protection.
During major network failure or compromise, an independent out-of-band communication channel can coordinate recovery without relying on the affected primary network.
Supplier, carrier, customer, and maintenance connections extend the trust boundary and should use minimum access, isolated paths, explicit contractual responsibilities, and continuous monitoring.
When relying on ISPs, telecoms, and WAN providers, evaluate SLAs, routing, DDoS, failure domains, encryption, support, and notification responsibilities.
Remote hardware support can require highly privileged management access and should be enabled on demand with MFA, jump hosts, time limits, session recording, and owner approval.
Third-party remote-access accounts should be individually identified, least-privileged, time-limited, revocable, and distinguished from employee accounts rather than using permanent shared accounts.
Terminate third-party traffic in a dedicated zone or DMZ and permit only explicit destinations rather than giving a partner's VPN broad internal-network reachability.
Before establishing third-party connectivity, define the business owner, data scope, technical path, identity, SLA, security requirements, and termination conditions.
Monitor third-party sessions, data volume, destinations, and privileged operations and ensure abnormal activity can be rapidly disconnected and investigated.
When a contract or project ends or a supplier changes, close tunnels, revoke accounts and certificates, remove rules, and verify that no residual access remains.
Critical WANs can use multiple carriers to reduce single-supplier failure, but verify that last-mile paths, conduits, facilities, and upstream infrastructure are actually independent.
Two logical circuits can still fail together if they share the same physical conduit or central office; validate physical routing and failure domains.
Communication-service SLAs define measurable availability, latency, repair time, support, and notification responsibilities for provider connectivity.
A DDoS attack uses distributed traffic or requests to exhaust bandwidth, state, or application resources, primarily attacking availability.
Volumetric DDoS consumes Internet or link bandwidth and often requires upstream ISP, CDN, or scrubbing-center mitigation before traffic reaches the local network.
Protocol or state-exhaustion attacks consume TCP, TLS, firewall, or load-balancer state, such as SYN floods, and require combined mitigations such as SYN cookies, rate limiting, and capacity.
Application-layer DDoS sends apparently legitimate but expensive requests to exhaust application resources and requires application semantics, rate controls, caching, identity, and resilient architecture.
DDoS scrubbing redirects traffic to a high-capacity filtering service and returns legitimate traffic, commonly coordinated through BGP, DNS, or the carrier.
Rate limiting restricts connections, requests, or bandwidth per unit time and can reduce brute force and resource exhaustion, but overly low limits can disrupt legitimate peaks.
A network replay attack resends captured valid authentication or business messages; nonces, sequence numbers, time windows, and session state provide freshness.
Session hijacking occurs when an attacker obtains or predicts a session identifier and impersonates an authenticated subject; protect tokens, use TLS, and reauthenticate high-risk actions.
An on-path or MITM attacker inserts into the communication path to read or modify data. Endpoint authentication, certificate validation, encryption, and anti-spoofing controls are key mitigations.
Modern terminology often uses “on-path attack” instead of MITM to describe an attacker positioned to observe or modify traffic on the communication path.
DNS tunneling encodes commands or data in DNS queries or responses to bypass ordinary egress restrictions; monitor unusual domains, lengths, frequency, and resolver use.
ICMP tunneling hides data in ICMP payloads to cross boundaries, showing that necessary network protocols can be abused; detect based on business need and abnormal behavior.
Covert channels can use legitimate protocol fields, timing, or allowed communication paths to transmit unauthorized information; strict protocol validation and behavior analysis can reduce risk.
AI training nodes, model APIs, vector databases, and tool services should communicate only over explicit minimum-required paths rather than receiving broad network connectivity because they belong to one AI platform.
Distributed AI nodes and model services should use authenticated TLS or mTLS or another appropriate protected channel for datasets, prompts, model outputs, and control messages.
AI or ML-based NDR can analyze east-west behavior in training clusters and data centers to find anomalous connections and lateral movement, but detections still require rule, context, and human validation.