Topics / Defend Systems / Network Security
Network Security
Design and validate defensible network trust boundaries.
Intended audience: Beginners, practitioners, and security engineers relevant to this discipline.
9 results
Understanding Network Trust Boundaries
How to identify where trust actually changes in a network, place boundaries there instead of at the perimeter alone, and validate that a boundary fails closed — illustrated with a fictional multi-tier architecture.
Segmentation vs Isolation
Segmentation and isolation are two different controls, not two names for the same one. A decision test for choosing between them once a trust boundary exists, the failure patterns that come from conflating them, and how each is validated differently — illustrated with a fictional zone architecture.
DNS as a Security Control and Attack Surface
DNS is both a place to enforce security controls — filtering, monitoring, DNSSEC validation — and a protocol attackers abuse in its own right, through cache poisoning, subdomain takeover, and tunneling used as a covert command-and-control channel. A decision framework for treating DNS as a control point instead of invisible plumbing, illustrated with a fictional resolution and tunneling path.
TLS Certificate Validation Explained
How a TLS client actually decides to trust a certificate — chain-of-trust path building up to a root trust anchor, hostname verification, and revocation checking — and the specific, common ways that decision gets quietly weakened: soft-fail revocation, disabled verification left over from local development, and self-signed or hostname-mismatched certificates accepted anyway. Illustrated with a fictional certificate chain and a validation-bypass path.
Building Firewall Rules from Documented Requirements
A repeatable checklist for turning a documented business or technical requirement into a specific, least-privilege firewall rule, and confirming — through testing rather than assumption — that the deployed rule does exactly what it claims. Illustrated with a fictional two-tier example.
Safely Analyzing Packet Captures
A repeatable checklist for handling and analyzing a packet capture without introducing risk to the analyst's own system or corrupting its evidentiary value — covering environment isolation, integrity verification, and treating captured traffic as adversarial by default. Illustrated with a fictional example.
How to Validate That a Service Is Not Publicly Reachable
A repeatable checklist for confirming — through an actual external check, not an assumption drawn from a configuration file — that a service intended to be internal-only cannot be reached from the public internet. Covers the common ways a service becomes unintentionally exposed: a misconfigured load balancer, a cloud security-group rule broader than intended, a leftover NAT or port-forward rule, and a service binding to every interface instead of a loopback or internal one. Illustrated with a fictional example.
Common Causes of Unexpected Network Exposure
A repeatable audit checklist covering the specific, recurring ways a service ends up reachable from somewhere it was never intended to be reachable from: a load balancer or reverse proxy with a broader listener than intended, a cloud security-group rule left permissive after testing, a service bound to every interface instead of a loopback or internal one, a leftover NAT or port-forward rule, a default-allow rule on a newly provisioned resource, and an internal-sounding DNS record that actually resolves to a publicly reachable resource. Illustrated with a fictional example.
Building a Secure Internal Reverse Proxy
Design principles for an internal reverse proxy: why TLS termination creates a trust boundary, why proxy-added headers must never be trusted blindly, how to authenticate the proxy to its backends, how to prevent the proxy itself from becoming an SSRF vector, and how to enforce access control at the proxy layer — illustrated with a fictional internal service.
Related categories