Communication and Network Security · Topic 3 of 3
Network Components and Secure Channels
Securing firewalls, proxies, IDS and IPS, transmission media, NAC and endpoints, plus secure remote access, voice and video, and third-party connectivity.
- 3 min
- Know firewall types, proxies, WAFs, load balancers, IDS and IPS.
- Fiber resists tapping and interference.
- NAC checks identity and health before access.
What it is
Networks are made of components that must be operated securely, and channels that must protect what passes through them. This page covers the devices and media, controlling which endpoints may connect, and the channels used for remote work, collaboration and partners.
How it works
Network devices
| Component | Function |
|---|---|
| Firewall | Filters traffic; packet filter (stateless), stateful, application-level and next-generation firewalls |
| Forward proxy | Filters and caches outbound requests for internal users |
| Reverse proxy | Fronts back-end servers, terminating inbound client sessions and hiding servers |
| Web application firewall (WAF) | Inspects HTTP for attacks such as injection and cross-site scripting |
| Load balancer | Spreads sessions across servers and removes failed ones |
| IDS / IPS | Detects (IDS) or blocks inline (IPS) malicious traffic; signature or anomaly based |
| Switches and routers | Forwarding; secure with port security, management access controls and hardened configurations |
Anomaly-based IDS needs a good baseline. If normal but periodic activity (such as month-end transfers) causes false alarms, extend the learning period so the baseline includes it rather than blinding the sensor.
Operation of infrastructure
Redundant power, redundant links and devices, warranties and support contracts, hardened configurations, and patched firmware keep components available and secure.
Transmission media
| Medium | Notes |
|---|---|
| Twisted pair | Common; vulnerable to tapping and interference |
| Coaxial | Better shielding |
| Fiber optic | Immune to electromagnetic interference, hard to tap |
| Wireless | Broadcast; must be encrypted |
Physical security of cabling and wiring closets matters: an attacker with physical access can tap or add devices.
Network access control and endpoint security
Network access control (NAC) checks identity and device health before granting network access, often using 802.1X. Non-compliant devices go to a quarantine or remediation network. Endpoint security includes host firewalls, endpoint detection and response, disk encryption, patching and application allow-listing.
Secure communication channels
| Channel | Controls |
|---|---|
| Voice, video and collaboration | Encrypted signalling and media (for example SRTP), authentication for meetings, segmentation of VoIP |
| Remote access | VPN with MFA, or zero trust network access; no split tunnelling for sensitive work where policy requires |
| Remote administration | Jump hosts or bastions, privileged access management, MFA |
| Data communications | TLS, IPsec, secure file transfer |
| Third-party connectivity | Dedicated, firewalled connections; least access; contracts; monitoring; time limits |
| Virtualized networks | Virtual switches and firewalls with the same policies as physical ones |
For partner connections, give access only to the specific systems needed, through a monitored and firewalled path, rather than joining networks broadly.
Remote access authentication protocols
| Protocol | Notes |
|---|---|
| RADIUS | Combines authentication and authorization; uses UDP; encrypts only the password |
| TACACS+ | Separates authentication, authorization and accounting; uses TCP; encrypts the whole payload |
| Diameter | Successor to RADIUS for modern networks |
How the exam asks about this
- "Device that ends inbound sessions on behalf of back-end servers to hide them." Reverse proxy.
- "Only healthy, authenticated laptops may join the network." NAC with 802.1X.
- "Which protocol encrypts the entire authentication exchange?" TACACS+.
What to remember for the exam
- Know firewall types, proxies, WAFs, load balancers, IDS and IPS.
- Fiber resists tapping and interference.
- NAC checks identity and health before access.
- Remote access: VPN or zero trust access with MFA; admin via jump hosts.
- RADIUS encrypts only the password; TACACS+ encrypts everything.
An IDS only alerts. If the requirement is to block, an IPS or firewall is needed.
Common mistakes
Lowering IDS sensitivity across the board to stop false positives.
Broad VPN access for partners instead of specific, monitored access.
Forgetting physical protection of cabling and closets.
Check yourself
What does a forward proxy do?
Filters and caches outbound requests from internal users.
Which authentication protocol separates authentication, authorization and accounting and uses TCP?
TACACS+.
What should happen to a device that fails a NAC health check?
It is placed in a quarantine or remediation network.
Topic 3 of 3 in Communication and Network Security
Test yourself on Communication and Network Security
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.