Communication and Network Security · Topic 2 of 3
Segmentation, Wireless and Modern Network Designs
Network segmentation and micro-segmentation, screened subnets, wireless and cellular security, SDN, SD-WAN, VPCs, CDNs, edge networks and network monitoring.
- 4 min
- Includes a diagram
- Segment by trust; screened subnets for public services; micro-segmentation for east-west control.
- WPA3 or enterprise 802.1X; WEP, WPA, MAC filtering and hidden SSIDs are weak.
- CDNs improve performance and absorb DDoS; protect the origin.
What it is
Secure network architecture divides the network into zones by trust, controls traffic between them, and extends the same discipline to wireless, cellular, cloud and software-defined networks. The goal is that one compromised device cannot reach everything.
How it works
Segmentation
| Approach | Meaning |
|---|---|
| Screened subnet (DMZ) | Zone for internet-facing services, separated from internal networks |
| VLANs and subnets | Logical separation of groups such as users, servers and guests |
| Physical segmentation | Separate hardware for the most sensitive networks |
| Micro-segmentation | Fine-grained policy per workload, often in software, limiting east-west movement |
| Air gap | No network connection at all |
A public web tier belongs in the screened subnet; the database belongs on an internal segment that only the web tier can reach. A compromised web server then cannot freely reach the data.
Wireless security
| Item | Guidance |
|---|---|
| WPA3 | Current standard; SAE replaces the pre-shared key handshake |
| WPA2-Enterprise / WPA3-Enterprise | 802.1X with a RADIUS server: individual credentials per user |
| WEP and WPA (TKIP) | Broken; do not use |
| MAC filtering and hidden SSIDs | Easily bypassed; not real security |
| Guest networks | Isolated from internal resources |
| Rogue and evil twin access points | Detect with wireless intrusion detection or prevention |
Other wireless technologies: Bluetooth (bluejacking, bluesnarfing), Zigbee for IoT, satellite links, and Li-Fi (light-based).
Cellular networks
4G and 5G provide encrypted radio links and stronger subscriber identity protection in 5G, but traffic still crosses carrier networks. Use VPNs or TLS end to end for sensitive data, and manage devices with mobile device management.
Content distribution networks
A CDN caches content close to users at edge locations, improving performance and absorbing DDoS traffic. Security concerns include protecting the origin server, TLS between CDN and origin, and trusting the provider with content.
Software-defined and cloud networks
| Technology | Security point |
|---|---|
| Software-defined networking (SDN) | Separates the control plane from the data plane; central control is powerful, so protect the controller |
| SD-WAN | Uses broadband links with an encrypted overlay; combine with central security policy for local internet breakout |
| Virtual private cloud (VPC) | Isolated network in a public cloud; secure with security groups, network ACLs and private connectivity |
| Virtual extensible LAN (VXLAN) | Overlay networks across data centers |
| Edge networks | Processing near the data source; devices are physically exposed |
When branches move from MPLS to SD-WAN with local internet breakout, keep central policy by steering internet traffic through a cloud security service, rather than backhauling it all to headquarters or running different appliances at each branch.
Monitoring and management
Use network flow data, IDS and IPS, packet capture where justified, and centralized logging. Manage devices through a separate management network with strong authentication, and keep configuration baselines.
How the exam asks about this
- "Web servers and the customer database share one flat network." Put the web tier in a screened subnet and the database on an internal segment reachable only from it.
- "MAC filtering and a hidden SSID as main wireless protection." Insufficient; use WPA3 or 802.1X with encryption.
- "Overlapping address ranges after an acquisition, minimal trust." A firewalled interconnect with address translation allowing only required flows.
What to remember for the exam
- Segment by trust; screened subnets for public services; micro-segmentation for east-west control.
- WPA3 or enterprise 802.1X; WEP, WPA, MAC filtering and hidden SSIDs are weak.
- CDNs improve performance and absorb DDoS; protect the origin.
- SDN centralizes control: protect the controller.
- SD-WAN needs encryption and central security policy.
Flat networks let one compromised host reach everything. Missing internal segmentation makes lateral movement easy for attackers.
Common mistakes
Trusting VLANs alone without controlling traffic between them.
Relying on MAC filtering.
Backhauling all branch traffic when the goal is local breakout with consistent policy.
Check yourself
Where should an internet-facing web server be placed?
In a screened subnet (DMZ), separate from internal networks.
What does SDN separate?
The control plane from the data plane.
Why is MAC filtering weak?
MAC addresses can be observed and spoofed.
Topic 2 of 3 in Communication and Network Security
Test yourself on Communication and Network Security
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.