Network Security Concepts and Specifications · Topic 1 of 1
Network Security Definition, Trends and Standards
Learn the CIA triad, how security grew into cyberspace security, future trends like zero trust, and ISO/IEC 27001, MLPS 2.0 and GDPR for HCIA-Security.
- 6 min
- Confidentiality stops unauthorized reading, integrity stops unauthorized change, availability keeps the service usable.
- Security developed from communication security to computer security, information security and cyberspace security.
- Zero trust removes trust based on network location and checks every access.
What it is
Network security protects the hardware, software and data of a network system from accidental or malicious damage, change or disclosure, so that the system keeps running reliably and its services are not interrupted. It covers both the information itself and the network that carries it.
Security is measured against a set of properties. The core three, the CIA triad, are confidentiality, integrity and availability. Standards and laws then turn those properties into requirements that an organization must meet and can be audited against.
How it works
Security properties
| Property | Meaning | Broken by, for example |
|---|---|---|
| Confidentiality | Only authorized parties can read the information | Eavesdropping, data leak |
| Integrity | Information is not changed without authorization | Tampering with a packet or a file |
| Availability | Authorized users can use the service when they need it | DDoS attack, ransomware |
| Controllability | The owner can control how information and systems are used | Unauthorized access |
| Non-repudiation | A party cannot deny an action it performed | Missing signatures and logs |
The first three are the ones the exam tests most. The others extend the model for accountability and control.
How security developed
Security grew with the technology it protects. Each stage kept the concerns of the previous one and added new ones.
| Stage | Main concern |
|---|---|
| Communication security | Keeping messages secret in transit, mainly with encryption |
| Computer security | Protecting single computers and their operating systems |
| Information security | Protecting information through its whole life, with management as well as technology |
| Cyberspace security | Protecting the whole connected space, including infrastructure, data and national interests |
Future network security trends
The old model assumed a trusted inside and a hostile outside, with one firewall between them. Cloud services, mobile work and connected devices have blurred that border, and attacks have become organized and automated.
- Cloud and virtualization: workloads move between data centers and clouds, so protection must follow the workload, not a fixed port.
- IoT and 5G: huge numbers of simple devices join the network, many with weak passwords and no patches.
- Zero trust: no user or device is trusted by default because of its location. Every access is authenticated, authorized and checked continuously.
- AI and big data: defenders use analytics to spot unknown threats, while attackers use automation to scale their attacks.
- Collaboration: devices share threat intelligence and act together, for example a detection system telling a firewall to block an address.
- Security services: organizations buy protection as a managed or cloud service instead of only buying boxes.
Information security standards and specifications
| Standard or law | Issued by | What it does |
|---|---|---|
| ISO/IEC 27001 | ISO and IEC | Requirements for an information security management system (ISMS) |
| ISO/IEC 27002 | ISO and IEC | Guidance on implementing the security controls |
| MLPS 2.0 | China | Classifies systems into protection levels and sets controls per level |
| GDPR | European Union | Protects the personal data of people in the EU |
ISO/IEC 27001 is commonly run as a PDCA cycle: Plan, Do, Check, Act. The current edition, ISO/IEC 27001:2022, lists 93 controls in Annex A, grouped into organizational, people, physical and technological themes. Organizations can be certified against it by an accredited body.
MLPS 2.0 (Multi-Level Protection Scheme, also called Cybersecurity Classified Protection) is required by China's Cybersecurity Law. Its baseline standard, GB/T 22239-2019, took effect on 1 December 2019 and extends protection to cloud, mobile, IoT and industrial control systems. Systems are graded into five levels by the harm a breach would cause, and higher levels need stronger controls.
MLPS 2.0 describes the technical controls as one center with triple protection: a security management center, plus a secure communication network, a secure area boundary and a secure computing environment.
GDPR (General Data Protection Regulation) applies from 25 May 2018. It covers any organization that processes the personal data of people in the EU, wherever the organization is based. Serious breaches can be fined up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, and a personal data breach must normally be reported to the authority within 72 hours.
A worked example
An attacker floods a company's web portal until customers cannot log in. No data was read or changed, so confidentiality and integrity hold. Availability is broken.
The same company stores EU customer records and also serves the Chinese market. It runs an ISMS certified to ISO/IEC 27001, grades its order system under MLPS 2.0, and must report a customer data leak under GDPR within 72 hours.
How the exam asks about this
- "An attacker changes the amount in a bank transfer. Which property is broken?" → Integrity.
- "Which standard specifies requirements for an information security management system?" → ISO/IEC 27001.
- "How many protection levels does MLPS 2.0 define?" → Five.
What to remember for the exam
- Confidentiality stops unauthorized reading, integrity stops unauthorized change, availability keeps the service usable.
- Security developed from communication security to computer security, information security and cyberspace security.
- Zero trust removes trust based on network location and checks every access.
- ISO/IEC 27001 is the ISMS requirements standard, improved through a Plan, Do, Check, Act cycle.
- MLPS 2.0 grades systems into five levels and organizes controls as one management center plus network, boundary and computing environment protection.
ISO/IEC 27001 is the certifiable requirements standard. ISO/IEC 27002 is guidance on the controls, and an organization is not certified against it.
Common mistakes
Calling a DDoS attack a confidentiality problem. A flood that takes a service offline breaks availability. Confidentiality is about who can read the data.
Thinking GDPR applies only to European companies. It applies to any organization that processes personal data of people in the EU, including companies based elsewhere.
Treating security as a product. Every standard on this page mixes technical controls with management: policies, roles, training, audits and continuous improvement.
Check yourself
Which security property does a digital signature on a contract mainly support?
Non-repudiation, together with integrity. The signer cannot later deny signing, and any change to the document is detected.
What are the four steps of the cycle used to run an ISMS under ISO/IEC 27001?
Plan, Do, Check and Act, repeated so the management system keeps improving.
What does "one center with triple protection" mean in MLPS 2.0?
A security management center, plus protection of the communication network, the area boundary and the computing environment.
Topic 1 of 1 in Network Security Concepts and Specifications
Test yourself on Network Security Concepts and Specifications
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.