CyberSecurity Deep Dive
by Sergey Okinchuk
Secrets ManagementFirewalls and Filtering in Practice

Chapter Four · Defending the Network

Network Security

You know how networks work from the Networking Deep Dive — here you defend one. This chapter segments Meridian's network, filters its traffic with real nftables rules, tunnels remote access, and watches the wire, drawing the perimeter the intruder must cross in Chapter 5. It assumes TCP/IP and recaps only in a sentence.

5 topics

A network is where an attacker's moves become visible and where their reach can be contained. The controls in this chapter decide two things: how far a foothold can travel — through segmentation and firewalls — and how much of the attacker's activity you can see, through monitoring and inspection. Both assume the beginner truth that no perimeter holds forever, so the network is designed to contain and reveal, not just to keep out.

Five topics build Meridian's network defense: filtering traffic with real nftables rules, segmenting and adopting zero-trust so a foothold reaches little, tunnelling remote access, detecting intrusions on the wire, and inspecting encrypted traffic — with its sharp tradeoff between visibility and the guarantees TLS was meant to give.

Two jobs of network defense — contain the attacker, and see them
Contain
Firewalls · segmentation · zero trust · VPNs
See
IDS/IPS · flow logs · TLS inspection

Topics in This Chapter

Topic 20
Firewalls and Filtering in Practice
A firewall's whole value is default-deny: permit what's needed, drop the rest. Real nftables rules, stateful filtering, and the egress control most teams skip — the part that strangles command-and-control.
Firewalls
Topic 21
Segmentation and Zero-Trust Networking
A flat network means one foothold reaches everything. Segmentation and zero trust keep a phished laptop from reaching the customer database — dropping the idea that "inside" implies trusted.
Segmentation
Topic 22
VPNs and Encrypted Tunnels
A VPN builds an encrypted tunnel across an untrusted network — and bakes in a trust assumption. How tunnels work, split vs full tunnel, and why zero-trust access is replacing "VPN equals inside."
VPN
Topic 23
IDS, IPS, and Network Monitoring
Firewalls decide what's allowed; IDS/IPS watch what actually flows. An IDS alerts, an IPS blocks inline — and encrypted traffic plus false positives make network detection harder than it sounds.
IDS / IPS
Topic 24
TLS Inspection and Proxies
Encryption protects users — and attackers, who hide C2 and exfiltration inside TLS. Forward proxies and TLS interception restore visibility but break end-to-end encryption. The visibility-vs-guarantees tradeoff.
Inspection