Network Security
Security protects the network's confidentiality, integrity, and availability. This chapter covers access control, common attacks and defenses, secure network design, and authentication. It stresses layered defenses and least-privilege principles that limit the impact of any single failure.
Access Control and Authentication
Security rests on the CIA triad, confidentiality, integrity, and availability, and access control is how a network enforces the first of these by deciding who may use which resources and to what degree. Sound access control begins with the principle of least privilege: grant only the minimum access a user or device needs to do its job, so a compromised account can damage only a small part of the environment. Related to it is separation of duties, which prevents any single person from controlling an entire sensitive process. Authorization models put least privilege into practice. Role-based access control (RBAC) assigns permissions to job roles and places users in those roles, simplifying administration and audits, while mandatory and discretionary models suit stricter or more flexible environments. Authentication proves identity before authorization applies, and it grows stronger by combining factors from different categories: something you know (a password or PIN), something you have (a token, smart card, or phone), and something you are (a fingerprint or face). Multifactor authentication (MFA) that mixes at least two categories dramatically raises the bar against stolen passwords. At the network edge, IEEE 802.1X provides port-based network access control: a supplicant (the device) authenticates through an authenticator (the switch or AP) to an authentication server, almost always RADIUS, and the port stays closed to normal traffic until authentication succeeds. RADIUS and TACACS+ are the two central AAA (authentication, authorization, accounting) protocols; RADIUS combines authentication and authorization and is common for network access, while TACACS+ separates the functions and is favored for administering devices. Directory services such as LDAP and Active Directory, single sign-on with SAML or OpenID Connect, and Kerberos ticketing tie identity together across many systems. Accounting closes the loop by logging who did what and when. Layering strong authentication, least-privilege authorization, and thorough accounting means that even when one control is bypassed, others still constrain and record an attacker's actions.
Common Attacks and Defenses
Defending a network requires recognizing how it is attacked at each layer. At Layer 2, MAC flooding overwhelms a switch's CAM table so it fails open and floods frames out every port, letting an attacker sniff traffic; port security, which limits the number of MAC addresses learned per port and can shut down a violating port, stops it. ARP poisoning (or spoofing) sends forged ARP replies so the attacker becomes an on-path (man-in-the-middle) position between a victim and the gateway; Dynamic ARP Inspection paired with DHCP snooping validates ARP against known bindings and blocks the forgery. Rogue DHCP servers hand out malicious gateway or DNS settings, which DHCP snooping prevents by trusting only authorized ports. VLAN hopping abuses trunking or double tagging to reach other VLANs and is countered by disabling auto-trunking and hardening the native VLAN. At higher layers, denial-of-service and distributed denial-of-service (DoS/DDoS) attacks exhaust bandwidth or resources; defenses include rate limiting, upstream scrubbing, and anti-spoofing filters. DNS attacks include cache poisoning and DNS spoofing, mitigated by DNSSEC and trusted resolvers. On-path and replay attacks are blunted by strong encryption and session protections. Many breaches begin with social engineering rather than technical exploits: phishing and spear phishing trick users into revealing credentials or running malware, while pretexting, tailgating, and shoulder surfing exploit human trust and physical access. Because no switch feature stops a user from typing a password into a fake site, security awareness training is a primary control, reducing successful credential theft and teaching users to report suspicious messages. Wireless faces its own threats, including evil twin and rogue access points that impersonate legitimate SSIDs, deauthentication attacks that force clients off, and weak-passphrase cracking, all addressed by WPA3, 802.1X, and wireless intrusion detection. A defense-in-depth posture assumes some attacks will land and layers detection and containment behind prevention.
Secure Network Design
The most durable security decisions are made in the design, before any attacker appears, by shaping where traffic can and cannot go. Segmentation is the core idea: dividing the network into zones so that a breach in one area cannot spread freely. VLANs separate departments or device classes, and routing between them passes through controls that enforce policy, limiting both broadcast scope and lateral movement. A screened subnet, historically called a DMZ, isolates internet-facing services such as web, mail, and DNS servers between two layers of filtering, so that if a public server is compromised the attacker still cannot reach the internal LAN. Sensitive systems, guest Wi-Fi, IoT devices, and operational technology each belong in their own segment with tightly scoped access, an approach often described as micro-segmentation when taken to fine granularity. Firewalls enforce these boundaries. Stateful firewalls track connection state so return traffic is allowed automatically while unsolicited traffic is dropped, and next-generation firewalls add application awareness, intrusion prevention, and user identity. The governing principle is default deny, also called implicit deny: block everything and then permit only the specific flows the business requires, which is the network expression of least privilege. Access control lists on routers and switches apply the same idea at Layer 3 and 4. Detection complements filtering: an intrusion detection system (IDS) alerts on suspicious traffic, while an intrusion prevention system (IPS) sits inline and can block it, and both draw on signatures and behavioral baselines. Additional design controls include network access control (NAC) that posture-checks devices before admitting them, honeypots that lure and study attackers, jump boxes or bastion hosts that concentrate administrative access, and out-of-band management that keeps control traffic off the production path. Physical security, from locked wiring closets to badge access and cameras, protects the hardware these controls run on. Layered together, segmentation, default-deny filtering, and monitoring create a network where a single failure is contained rather than catastrophic.
Secure Remote Access and Trust
A distributed workforce means the network perimeter now extends to homes, coffee shops, and mobile devices, so remote access must be both convenient and secure. Virtual private networks (VPNs) create encrypted tunnels across untrusted networks so that data in transit stays confidential and tamper-evident. A remote-access (client-to-site) VPN connects an individual user's device back to the corporate network, while a site-to-site VPN links whole networks, such as a branch to headquarters. IPsec secures traffic at Layer 3 using IKE for key exchange, ESP for encryption, and either tunnel or transport mode, and it underpins most site-to-site links. SSL/TLS VPNs operate higher in the stack and are popular for clientless, browser-based remote access. A key design choice is split tunnel versus full tunnel: a full tunnel sends all traffic through the corporate gateway for inspection, while a split tunnel sends only corporate-bound traffic through the VPN and lets other traffic go directly out, trading some control for performance. Secure management of the devices themselves matters just as much: administrators should use SSH instead of clear-text Telnet, HTTPS instead of HTTP for web interfaces, and SNMPv3 instead of earlier versions, ideally over an out-of-band management network. The perimeter model is giving way to zero trust, whose motto is never trust, always verify. Zero trust assumes no user or device is trustworthy merely because it sits inside the network; every request is authenticated, authorized, and continuously evaluated against identity, device posture, and context, with access granted least-privilege and just-in-time. Micro-segmentation, strong MFA, device health checks, and continuous monitoring implement it in practice. Emerging frameworks such as secure access service edge (SASE) combine zero-trust network access with cloud-delivered security so that remote users reach applications securely without backhauling all traffic to a data center. Together, encrypted tunnels, hardened management, and zero-trust verification protect a network whose users and resources are everywhere.
Last updated: September 2026
练习一直免费。完整的 CompTIA Network+ (N10-009) 学习指南是知识本身,从头到尾讲清楚 —— 可下载的 PDF + EPUB,永久归你。