Secure communication over untrusted networks relies on cryptographic tunnels and well-understood protocols. A Virtual Private Network (VPN) creates an encrypted tunnel across a public network, providing confidentiality and integrity for the traffic that passes through it. At the application layer, TLS (Transport Layer Security) is the modern successor to SSL and is what makes HTTPS, S/MIME, and countless other encrypted services possible. SSL 3.0 is now deprecated and considered insecure; current systems use TLS 1.2 or 1.3. HTTPS is simply HTTP running over TLS, providing server (and optionally client) authentication, encryption, and integrity. Standard ports reflect these conventions: HTTP uses TCP 80, HTTPS uses TCP 443, and SSH uses TCP 22. SSH provides secure remote command-line access and file transfer, replacing the unencrypted Telnet protocol. For file transfer, two secure options exist: SFTP, which tunnels FTP-like commands over SSH on port 22, and FTPS, which adds TLS directly to FTP on ports 989 and 990.
At the network perimeter, firewalls enforce access policies between zones. A stateless firewall inspects each packet independently against a rule set, while a stateful firewall tracks active connections and uses that context to make decisions. A Web Application Firewall (WAF) is specialized for HTTP traffic, filtering and monitoring requests to and from a web application. Next-generation firewalls (NGFWs) combine traditional filtering with deep packet inspection, intrusion detection and prevention, application awareness, and threat intelligence feeds. Beyond the firewall, organizations structure their networks to limit damage: network segmentation divides the network into smaller zones (VLANs and subnets) so a compromise cannot spread everywhere; a DMZ (demilitarized zone) sits between the untrusted Internet and trusted internal networks, hosting public-facing services; and a jump server (or bastion host) is a hardened host used to access and manage devices in a separate security zone. Within data centers, traffic between servers is called east-west traffic, while traffic between clients and servers is north-south—segmentation and east-west controls matter especially for the former.
Many attacks target the protocols that underpin local networks. ARP (Address Resolution Protocol) maps IPv4 addresses to MAC addresses on a local segment, and ARP poisoning sends forged ARP messages to associate an attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks. DNS poisoning corrupts a resolver's cache so that users are redirected to malicious sites. A MAC flooding attack overloads a switch's MAC address table, forcing it to fail open into hub mode and broadcast traffic that can then be captured. Attackers can also deploy rogue DHCP servers handing out incorrect configuration—including a malicious default gateway—or perform VLAN hopping via switch spoofing or double-tagged 802.1Q frames to reach VLANs that should be unreachable.
A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and possibly alters communication between two parties who believe they are talking directly to each other. TLS stripping is a specific form: a MITM downgrades a user's HTTPS connection to unencrypted HTTP, exposing session data in plaintext. Replay attacks, in which an attacker captures and maliciously re-sends a valid transmission, are a related concern; TLS counters them with nonces, sequence numbers, and short-lived session tickets that must remain unique per session. Switch-level defense is also possible: port security is a feature that limits which MAC addresses can communicate on a given port, helping prevent rogue devices from attaching to the network. Together, these controls and awareness of underlying protocols form the backbone of practical network security.