By Stephen Watts November 14, 2022
We live in a world of rapid technological advancements. Technologies such as big data, the internet of things (IoT) and artificial intelligence have created a world full of opportunities and solutions. However, it has also opened doors to increased threats, cyberattacks and network vulnerabilities.
This post will explain network security, including relevant concepts and issues, as well as best practices that can your organizations secure all your networks and surfaces. Here’s what you’ll learn:
- What network security is
- The importance of network security
- Types of network security
- Best practices
(Get the latest at these Cybersecurity & InfoSec events.)
What is network security?
Network security is a set of practices, tools and protocols that act as a perimeter around an organization — the goal of that perimeter is to prevent external security threats. This security perimeter permeates through several layers of the organization, ensuring the integrity of infrastructure, data and network.
Network vulnerabilities can come from practically anywhere: software and applications employees use, computers and devices hooked up to the network, the cloud (both storage and apps) and on-premises infrastructure. That means, essentially, that any hardware or software, whether virtual or on-prem, is a threat. Common security threats include:
- Wiretapping
- Denial-of-service (DoS) attacks
- Phishing
- SQL injections
- Cyberattacks
- Viruses
- Eavesdropping
These threats occur at different layers and affect various components within an organization. For instance, wiretapping, a passive security attack, involves snooping on telecommunication lines and internet connections within the network.
On the other hand, a DoS attack temporarily disables/disrupts an organization's website (or other resources). For instance, a hacker can bring down an organization's website by surging fake/artificial requests. This overflow of traffic will eventually crash the website. Such an attack on an e-commerce website can cause a loss of millions of dollars.
(Read about the CIA triad and vulnerabilities, threats and risk, two foundational concepts of cybersecurity.)
Importance of network security
As organizations become more data-centric and relocate their data infrastructure to the cloud, the risk increases. Although virtual environments can offer certain benefits, they significantly increase the area of the attack surface — there are now more areas you need to protect, and putting more perimeters around them is not easy.
On-cloud data is distributed and stored in several places, which means there are more and more security vulnerabilities. Moreover, most organizations often deal with highly sensitive data (customer data including personal data, credit card information, etc.), which increases the risk and consequences of network breaches.
A crucial part of any organization is to ensure its infrastructure, network and data are secure from external threats. To be able to optimize and grow their business, organizations must follow sound and robust network security protocols. These protocols prevent security breaches and strengthen the organization's network, increasing the efficiency of the overall network.
(See how overall cyber hygiene contributes to network security.)
Types of network security
Network security is an umbrella term that encompasses several different components and attacks. This section differentiates and explains the types of security protocols/techniques.
(See how NOCs and SOCs are vital to network security.)
Firewalls
As the name suggests, a firewall is a security wall built as the outermost (generally) security layer. It monitors and protects the network from malicious and anomalous traffic. Firewalls filter traffic using predefined protocols and rules.
Intrusion Detection and Prevention Systems (IDPS)
IDPS are security measures usually placed immediately after the firewall layer. Like firewalls, IDPS monitor and scan traffic penetrating the internal network. This involves inspecting the users that are trying to access the network and ensuring that they have relevant authorized access.
The overall goal of an IDPS is to defend your organization's infrastructure, data and devices.
Network Segmentation and Network Access Control (NAC)
Network segmentation is the practice of breaking a network into several smaller segments. Each segment is its own network with its own security protocols and access control.
This network security method improves security and enables the quick location of sub-network attacks. Moreover, each sub-network can also be assigned a list of roles that can access it (role-based access control).
This prevents unauthorized users from breaking into the internal network. Furthermore, NAC entails that each device is proofed with antivirus software and configured to the organization's network. NAC also keeps a record of all users and their respective access controls.
Virtual Private Networks (VPNs)
VPNs are one common way to mask the IP address and location of a user in order to protect the user from cyberattacks. More importantly, when users access a network through a VPN, their data is encrypted.
(Check out homomorphic encryption, an emerging technology.)
Cloud security
Cloud security has multiple layers and components that require protection. The cloud can be much more vulnerable, as it can be directly accessed through the internet. Additionally, data stored in the cloud is highly dynamic in nature and constantly moves from one location to another. This makes data security more challenging because it's difficult to track the exact location of the data.
Several security methods for cloud security are common:
- Data encryption
- Regular audits
- Data backups
- Multifactor authentication (MFA)
Data Loss Prevention (DLP)
Most businesses and organizations deal with sensitive user information that requires robust security measures. DLP entails using tools that prevent data leakage and data breaches.
One way to prevent such issues is to secure endpoint devices and laptops. Furthermore, keeping a track of sensitive data and access logs is beneficial.
More recently, organizations are using machine learning to detect intrusion attacks or anomalous breaches to prevent data leaks and cyberattacks.
Network security best practices
Of course, regardless of the industry you’re in or the technology you use, there are general practices that enhance overall security. These are a few best practices to consider while designing or updating your organization's network security:
- Perform regular audits to check any network vulnerabilities, unnecessary access controls and applications. Performing vulnerability assessment and penetration testing provides crucial information about the resilience and health of the current security standards.
- Educate employees on the security protocols and file-sharing policies followed by the organization. Furthermore, several organizations make it mandatory to go through a security training course. This helps educate and prepare the employees to identify cyber threats such as phishing emails and so on.
- Use data encryption throughout the network and the cloud platforms. At the bare minimum, organizations must follow the Advanced Encryption Standard (AES), which dictates how to use a 256-bit encryption key.
- Hire appropriate security experts who continuously monitor and maintain security systems.
- Apply a whitelisting strategy that selectively permits access to a company's resources. Whitelisting adds a layer of security, preventing easy access to hackers.
- Implement logging and on-demand logging analysis to identify malicious logins or accesses. By incorporating triggering alerts on the detection of any anomalous logins or activities, quick action can be taken. (Modern SIEMs offer a central way of doing just this.)
- Experiment with various frameworks and existing methods, including cyber kill chains and MITRE ATT&CK, which help you by stay ahead of attacks.
(Learn about log management.)
Securing networks summed up
Today, network security is more important than it has ever been. Organizations and businesses must prioritize and continuously develop, monitor and adapt their security protocols. This not only ensures the protection of data and infrastructure, but also improves network performance, optimizes business throughputs and maintains your organization’s integrity.
What is Splunk?
This posting does not necessarily represent Splunk's position, strategies or opinion.