Network Security · Topic 1 of 7
Core Network Security Concepts
Learn the CIA triad, threats, vulnerabilities and exploits, risk assessments, defense in depth, least privilege, RBAC, zero trust and honeypots.
- 5 min
- The CIA triad: confidentiality, integrity and availability.
- A threat uses a vulnerability, an exploit is the tool for it, and risk is likelihood combined with impact.
- A vulnerability scan finds weaknesses. A penetration test exploits them with permission.
What it is
Network security protects the data and services that a network carries. Almost every security decision comes back to three goals, a few key terms and the idea that no single control is enough.
This page covers the vocabulary and the design principles that the rest of the security chapter builds on.
How it works
The three security goals
The CIA triad (confidentiality, integrity and availability) names the three goals of security.
| Goal | Meaning | Example control |
|---|---|---|
| Confidentiality | Only authorized people can read the data | Encryption, access control |
| Integrity | Data is not changed without permission | Hashing, digital signatures |
| Availability | Systems and data are usable when needed | Redundancy, backups |
An attack usually targets one of the three. Ransomware hits availability, a data theft hits confidentiality, and tampering with records hits integrity.
Threat, vulnerability, exploit and risk
A threat is anything that could cause harm, such as an attacker or a natural disaster. A vulnerability is a weakness, such as unpatched software or a default password.
An exploit is the method or code that takes advantage of a vulnerability. Risk is the chance that a threat will use a vulnerability and the impact if it does.
Assessing risk
| Activity | Purpose |
|---|---|
| Threat assessment | Identifies who or what could harm the organization |
| Vulnerability assessment | Scans systems to find weaknesses |
| Penetration test | Authorized attempt to exploit weaknesses to prove impact |
| Posture assessment | Checks a device's security state, for example patches and antivirus, before allowing access |
| Business risk assessment | Weighs the impact on the organization of the identified risks |
A vulnerability scan finds and lists weaknesses. A penetration test goes further and tries to exploit them, with written permission.
A security information and event management (SIEM) system collects logs and alerts from many devices so analysts can detect attacks and review incidents.
Defense in depth
Defense in depth places several layers of control, so that one failure does not expose everything. Examples are a firewall at the edge, segmentation inside, endpoint protection, strong authentication and monitoring.
Least privilege and related controls
Least privilege gives users and systems only the access needed for their job. Role based access control (RBAC) assigns permissions to roles, and users get the role that matches their work.
Separation of duties splits a sensitive task between several people so one person cannot misuse it alone. Geofencing limits access based on location, and time based access limits it to certain hours.
Zero trust and segmentation
Zero trust does not trust a user or device just because it is on the internal network. Each request is verified. Network segmentation, such as a screened subnet (formerly called a demilitarized zone, or DMZ) for public servers, limits how far an attacker can move.
Special devices get their own segments. Internet of Things (IoT) devices and industrial control systems (ICS), such as supervisory control and data acquisition (SCADA) equipment, are often hard to patch, so they sit in isolated segments. Guest and bring your own device (BYOD) networks are also kept apart from internal servers.
Honeypots
A honeypot is a decoy system that looks valuable but has no real business use. Any contact with it is suspicious, so it reveals attackers and teaches defenders about their methods.
A honeynet is a whole decoy network of honeypots, built to look like a real environment. It lets defenders study attacker behavior across several systems at a larger scale than a single honeypot.
Compliance
Rules and standards apply to how data is handled. The Payment Card Industry Data Security Standard (PCI DSS) covers card data, and the General Data Protection Regulation (GDPR) covers the personal data of people in the European Union. Data locality rules can require that data stays within certain countries.
What to remember for the exam
- The CIA triad: confidentiality, integrity and availability.
- A threat uses a vulnerability, an exploit is the tool for it, and risk is likelihood combined with impact.
- A vulnerability scan finds weaknesses. A penetration test exploits them with permission.
- A posture assessment checks a device's security state before access is allowed.
- Defense in depth uses layered controls so one failure does not expose everything.
- Least privilege gives only the access needed. RBAC grants it through roles.
- Separation of duties splits critical tasks among several people.
- Zero trust verifies every request and does not trust location alone.
- A screened subnet holds public facing servers between the internet and the internal network.
- A honeypot is a decoy used to detect and study attackers.
Name the CIA goal that an attack violates. "Data was read" is confidentiality, "data was changed" is integrity, and "service was down" is availability.
Common mistakes
Confusing a vulnerability scan with a penetration test. A scan lists weaknesses, while a test actively exploits them.
Mixing threat and vulnerability. A threat is the source of harm, and a vulnerability is the weakness it uses.
Thinking a firewall is enough. Layers matter, because a single control can be bypassed or misconfigured.
Granting broad access for convenience. This breaks least privilege and increases the damage of any compromise.
Treating DMZ and screened subnet as different things. Screened subnet is the current name for the DMZ concept.
Never run a penetration test without written authorization. Testing a network you do not have permission to test can be illegal.
Check yourself
Work through these three.
An attacker deletes records so a service cannot be used. Which part of the CIA triad is hit?
Availability.
What is the difference between a vulnerability scan and a penetration test?
A scan finds weaknesses, and a penetration test tries to exploit them with permission.
What is the purpose of a honeypot?
To act as a decoy that detects attackers and shows their methods.
Topic 1 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.