Network security is the foundation of your cyber defence. It protects the pathways your data travels and the systems it resides on. Without solid network security, every other control — application security, data encryption, access management — can be bypassed. Understanding the fundamentals helps you make better decisions about protecting your business infrastructure.
Firewalls: Your First Line of Defence
A firewall controls traffic between your network and the outside world based on a set of rules. Network firewalls (hardware or virtual appliances) sit at your network perimeter and inspect traffic based on IP addresses, ports, and protocols. Web application firewalls (WAF) specifically protect web applications from attacks like SQL injection, XSS, and DDoS.
Next-generation firewalls (NGFW) go beyond basic packet filtering to include deep packet inspection, application awareness, intrusion prevention, and threat intelligence integration. If your firewall is more than 5 years old, it likely lacks these capabilities.
Key firewall rules: deny all traffic by default and explicitly allow only what is needed. Log all denied connections. Review and clean up rules quarterly — over time, rules accumulate and create unnecessary openings. Never leave “allow all” rules in production.
VPNs: Secure Remote Access
A Virtual Private Network creates an encrypted tunnel over the internet, allowing remote users to securely access your internal network. Site-to-site VPNs connect two office networks. Remote access VPNs connect individual users to the corporate network. SSL/TLS VPNs provide browser-based access without requiring client software.
VPN best practices: require MFA for all VPN connections. Use strong encryption (AES-256, IKEv2). Implement split tunnelling to route only corporate traffic through the VPN (improving performance). Monitor VPN logs for unusual connections — off-hours access, geographic anomalies, multiple simultaneous sessions.
Network Segmentation
Segmentation divides your network into isolated zones, limiting lateral movement if one zone is compromised. At minimum, separate: corporate network (employee workstations), server network (production and development), guest Wi-Fi (no access to internal resources), IoT devices (isolated from all other segments), and management network (admin access to infrastructure).
Use VLANs for logical segmentation and firewall rules to control traffic between segments. The principle: a compromised workstation should not be able to directly access your database server. Each hop between segments requires additional authentication and authorisation.
Intrusion Detection and Prevention
IDS (Intrusion Detection System) monitors network traffic for malicious activity and alerts your team. IPS (Intrusion Prevention System) goes further by automatically blocking detected threats. Deploy at network boundaries and between critical segments. Keep signatures updated. Tune to your environment to reduce false positives.
DNS Security
DNS is often overlooked but is a critical security control point. Malware uses DNS to communicate with command-and-control servers. DNS filtering blocks connections to known malicious domains, prevents data exfiltration via DNS tunnelling, and enforces acceptable use policies. Consider DNS security services like Cisco Umbrella or Cloudflare Gateway.
Network Monitoring
You cannot defend what you cannot see. Implement network monitoring to: detect unusual traffic patterns, identify rogue devices, track bandwidth usage, and spot potential data exfiltration. Use network flow analysis (NetFlow, sFlow) for traffic pattern visibility. Deploy network taps or port mirroring for deep inspection of critical segments.
Wireless Security
Secure your Wi-Fi with WPA3 (or WPA2-Enterprise at minimum). Use 802.1X authentication with RADIUS for corporate wireless. Maintain a separate guest network with no access to internal resources. Regularly scan for rogue access points. Disable SSID broadcasting for internal networks (though this provides minimal security, it reduces casual discovery).
Network Security Checklist
Audit your current state: Is your firewall current and properly configured? Are all remote access points protected with VPN and MFA? Is your network segmented appropriately? Are you monitoring network traffic? Are wireless networks secured? Are all network devices running current firmware? Do you have an inventory of all devices on your network? Address gaps starting with the highest-risk items.
