Network Security Design

Why this matters

One lock on the front door is a bad design, because the day it is picked everything behind it is open. Network security is built the opposite way: assume any single measure will eventually fail, and arrange things so that failing one does not lose you the building.

The idea

Three pieces do most of the work.

A firewall sits at the network's entry and exit and allows or denies traffic by rules you set beforehand. Typical rule: let the outside reach the web server, never let it reach the database server directly.

A VPN builds an encrypted tunnel across the public internet, so someone working from home or a branch office can join the organisation's network safely. Because the traffic inside the tunnel is encrypted, even public Wi-Fi stops being a serious eavesdropping risk.

A DMZ is where you put the servers that must be reachable from outside, web and mail servers, kept apart from the internal network. The point is containment: when a public-facing server is attacked, and eventually one will be, the attacker has not landed inside your internal network.

Defense in depth is the idea those three add up to. Layer the measures so a breach of one meets another:

Zero trust goes further and drops an assumption the older designs were built on. The perimeter model said inside is safe and outside is dangerous, so getting past the boundary was most of the battle. With cloud services and remote work, there is no clean inside any more. Zero trust therefore verifies identity and permission on every access, including one coming from a desk in the office.

Picture it

flowchart LR
  I[Internet] --> F[Firewall]
  F --> D["DMZ: web and mail servers"]
  F --> V[VPN tunnel for remote staff]
  D -.->|no direct path| N
  V --> N["Internal network: database, files"]
  N --> E["Endpoints: antivirus, OS updates"]

Worked example

A company runs a public web server. Where should it go?

Put it on the internal network and it is reachable from the internet by definition, which means the attacker who finds a flaw in it is now inside, on the same network as the payroll database. The web server's own security is then the only thing protecting everything else, which is the single-lock design again.

Put it in the DMZ and the firewall rules can say: the internet may reach this server, and this server may not open connections into the internal network. Now the same compromise costs you one web server. The attacker has to break a second control to go further, and that second attempt is the one your monitoring is most likely to catch.

Notice this is the same reasoning as multi-factor authentication in the previous lesson: not "make one barrier perfect", but "make sure one failure is not total".

Your turn

Try the practice questions for this lesson. Sort statements about firewalls, VPNs and DMZs into true and false, match each description to the right piece of infrastructure, and pin down what zero trust actually changes.

Take it further

A company is setting up its office network. It has a public website, staff working from home, and confidential customer data. Should it rely on a firewall only, or on layers plus zero trust?

1. Collect data. List the three assets and the main threat to each.
2. Rank the layers. Put the four defense-in-depth layers (network entry, communication path, server placement, endpoints) in order of importance for this company, and justify your top choice.
3. Decide. Recommend a design and give two reasons why layering beats a single firewall.

Start from the most exposed asset, the public website, and ask what an attacker reaches next if it falls.

Recap

• A firewall filters by rules, a VPN encrypts a path, a DMZ isolates public servers.
• Defense in depth layers them so one breach is not the whole system.
• Zero trust verifies every access instead of trusting the inside of the network.
• Cloud services and remote work are what made the perimeter model insufficient.