Network defenses begin with the firewall, a device or software that filters traffic based on rules covering source, destination, port, and protocol. A stateless firewall inspects each packet independently against its rule set, while a stateful firewall tracks active connections and makes decisions based on the full context of the traffic session, so return traffic from an established connection is correctly permitted. A Web Application Firewall (WAF) is a specialized firewall that protects web applications from common attacks such as XSS and SQL injection. Reverse proxies sit in front of servers to terminate connections, enabling TLS offloading, caching, and WAF integration, while Content Delivery Networks (CDNs) distribute content across edge servers and provide DDoS protection. Network segmentation divides a network into zones to limit lateral movement after a breach, and microsegmentation applies that principle at the workload or process level, a cornerstone of zero trust.
Encryption secures traffic wherever it travels. Encryption at rest protects data stored on disk from physical theft; encryption in transit, typically via TLS, protects data moving between systems; encryption in use protects data during processing through confidential computing or homomorphic encryption. A Virtual Private Network (VPN) creates an encrypted tunnel between a user's device and a VPN server, protecting data from interception on untrusted networks and masking the user's IP address for privacy and to bypass geographic restrictions. Split tunneling routes some traffic through the tunnel while sending other traffic directly to the internet, trading security for performance. Zero Trust Network Access (ZTNA) is the modern successor to VPNs, granting per-application access based on identity and device posture rather than network location. Tamper-resistant hardware security modules (HSMs) store cryptographic keys and perform operations, validated under standards like FIPS 140 for federal use cases.
Detection and prevention systems sit on the wire to spot malicious activity. An Intrusion Detection System (IDS) monitors network traffic and alerts administrators about suspicious activity but does not block it. An Intrusion Prevention System (IPS) actively blocks detected threats in real time, sitting inline with traffic to intercept malicious packets. Modern deployments often combine the two. Endpoint Detection and Response (EDR) agents run on endpoints to detect threats, while Extended Detection and Response (XDR) extends that visibility across network and cloud telemetry. Security Operations Centers (SOCs) are the teams that monitor, detect, and respond to events, supported by Security Information and Event Management (SIEM) platforms that collect, correlate, and alert on logs, and Security Orchestration, Automation and Response (SOAR) platforms that automate SOC workflows. SIEM correlation rules identify suspicious patterns across multiple log sources, and SOAR playbooks codify automated responses to specific alert types. Bring Your Own Device (BYOD) introduces complexity because personal devices access corporate data; Mobile Device Management (MDM) centralizes policy enforcement across those devices.