Network Security — Cheat Sheet

Tags: networking, security, firewall, tls, zero-trust, vpn, ddos

Level: intermediate

TL;DR: Core principles and defensive controls to protect network infrastructure, segment traffic, and secure data in transit.

Key concepts

Defense in depth: multi-layered defense covering perimeter, internal segmentation, endpoint, and application layers.

Zero Trust Architecture (ZTA): default-deny stance requiring explicit verification for every access request regardless of location.

Network segmentation: isolating sensitive workloads into discrete subnets using VLANs, subnets, and micro-segmentation.

Firewalls: stateful inspection, Next-Gen Firewalls (NGFW) with deep packet inspection (DPI), and Web Application Firewalls (WAF).

TLS/mTLS: cryptographic protocols providing data confidentiality, data integrity, and mutual endpoint authentication.

IDS/IPS: Intrusion Detection Systems detect anomalous traffic, while Intrusion Prevention Systems actively block malicious signatures.

VPN & WireGuard: encrypted tunnels ensuring privacy across public networks using IPsec or modern crypto suites.

DDoS mitigation: traffic scrubbing, rate limiting, and Anycast routing to handle volumetric and application-layer attacks.

DNS security: DNSSEC ensures DNS authenticity; DNS-over-HTTPS (DoH) encrypts recursive DNS resolutions.

Bastion hosts and jump boxes: strictly controlled single entry points for administrative network access.

Typical questions and ready answers

Q: How do you enforce network isolation in a distributed production environment?R: I divide services into dedicated private subnets, apply least-privilege security groups, and enforce mTLS with service mesh policies so no service communicates across boundaries without explicit authorization.

Q: What is the difference between a standard Layer 4 firewall and a WAF?R: A Layer 4 firewall inspects IP addresses and TCP/UDP ports, whereas a WAF operates at Layer 7 to inspect payload content, blocking threats like SQLi, XSS, and CSRF.

Q: When would you choose mTLS over standard one-way TLS?R: I implement mTLS in zero-trust service-to-service communication to verify the cryptographic identity of both the client and server, preventing spoofing inside internal networks.

Pitfalls and common mistakes

Relying entirely on perimeter security while leaving the internal network flat and unsegmented.

Allowing broad egress access without outbound domain filtering, facilitating data exfiltration and reverse shells.

Exposing administrative ports (SSH, RDP, Kubernetes API) directly to the public internet instead of through VPN/bastion.

Using outdated TLS versions (TLS 1.0/1.1) or weak cipher suites vulnerable to downgrade attacks.

Neglecting internal certificate renewal and rotation workflows, leading to unexpected outages.

Snippets and commands

# Verify TLS certificate chain and supported protocol versions
openssl s_client -connect api.example.com:443 -servername api.example.com -tls1_3

# Inspect active TCP listening sockets and associated process IDs
ss -tulpn

# Block incoming traffic from a suspicious IP address using iptables
iptables -A INPUT -s 198.51.100.42 -j DROP

To review

[ ] Review differences between IPsec tunnel mode and transport mode.

[ ] Audit outbound egress filtering rules and NAT gateway configurations.

[x] Configure mTLS verification between backend microservices.

[x] Enforce TLS 1.3 as the minimum protocol version on reverse proxies.