Skip to content
Knowledge Hub/Article
Article

What Is Network Security? Layers and Core Controls

Network security protects a network and its traffic from unauthorized access. We explain firewalls, IPS, segmentation, ZTNA, NAC and DDoS protection.

Oğuzhan Gerçek··9 min read
What Is Network Security? Layers and Core Controls

Short answer: Network security is the protection of an organization's network, and the traffic that crosses it, against unauthorized access, misuse and disruption. It is a domain of cybersecurity built from complementary layers: firewalls that filter traffic by rule, segmentation that divides the network, IDS/IPS that catch and stop attacks, VPN and ZTNA for controlled remote access, 802.1X and NAC that verify a device before letting it on, DDoS protection, and flow monitoring. Under zero trust, being inside the network confers no trust on its own; every access is verified separately.

What is network security?

In Cisco's definition, network security combines policies and technologies to protect systems and digital assets from unauthorized access, misuse and disruption. It is one of the domains of cybersecurity: endpoint, application and identity security protect devices, software and identities, while network security looks at the traffic flowing between them. CIS Controls v8.1 has two separate controls for the network: Control 12 covers network infrastructure management, and Control 13 network monitoring and defense. There is a short definition of the term in our glossary.

Firewalls and next-generation firewalls (NGFW)

NIST SP 800-41 Rev. 1 defines firewalls as devices or programs that control the flow of network traffic. The most basic type, the packet filter, looks at IP addresses, ports and protocols; we explain the default-deny principle in our port article. Stateful inspection builds on this by tracking the state of connections. According to NIST, some firewalls also analyze application protocols (deep packet inspection), and some include IPS technology. The same guide notes that using multiple layers of firewalls for defense in depth is quite common.

The next-generation firewall (NGFW) is where this evolution stands today. According to NIST SP 800-215, what distinguishes an NGFW is application data awareness: it looks at traffic not only at layers 3 and 4 of the OSI model but also at layer 7. The document lists deep packet inspection, TLS decryption with payload inspection, and IPS among NGFW capabilities; an NGFW can run as an appliance in the data center, as software in a VM in the cloud, or as a cloud service (FWaaS). We cover the risks of TLS inspection in our proxy article, and protection specific to web applications in our WAF article.

Segmentation and microsegmentation

Segmentation means dividing the network into segments and putting the traffic between them under rules. We explain how to separate users, servers and the guest network with VLANs in our LAN article.

Microsegmentation takes this division down to the workload level. In SP 800-215's definition, an internal network, such as a data center or a cloud provider region, is divided into isolated segments so that the traffic in and out of each segment can be monitored and controlled. According to NIST SP 800-207, each resource or small group of related resources can sit on its own segment, protected by an intelligent switch, an NGFW or a special-purpose gateway. An attacker who compromises one server then cannot reach its neighbors unless a rule allows it.

IDS and IPS

NIST SP 800-94 defines intrusion detection as the process of monitoring the events occurring in a system or network and analyzing them for signs of possible incidents. An IPS (intrusion prevention system) also attempts to stop the incident, for example by terminating the network connection or user session used for the attack. According to the guide, most prevention techniques require the sensor to be deployed inline, where traffic has to pass through it, while a passive sensor monitors a copy of the traffic. NIST recommends deploying sensors inline if prevention will be used and passive if it will not.

NIST names three primary classes of detection methodology: comparing events against known attack signatures, spotting deviations from normal behavior (anomaly-based detection), and checking whether protocol activity matches its expected behavior (stateful protocol analysis). According to NIST, it is not possible to eliminate all false positives and false negatives.

Remote access: VPN and ZTNA

In SP 800-215's words, a VPN extends an organization's perimeter-based security across a public network. That is exactly why VPN servers are on the attacker's list. According to joint guidance from the NSA and CISA, VPN servers are entry points into protected networks, which makes them attractive targets. The guidance recommends applying patches promptly, using strong authentication such as MFA, and shrinking the attack surface by disabling features unrelated to the VPN. The ENISA Threat Landscape 2026 also records ransomware operators exploiting vulnerabilities in VPN and firewall appliances.

ZTNA (Zero Trust Network Access) grants access per application rather than per network. In Cloudflare's comparison, a user logged in to a VPN gains access to the entire network and all the resources on it, whereas ZTNA grants access only to the specific application requested and denies everything else by default. We cover SASE, the architecture that converges networking and security functions into a cloud service, in our SD-WAN article.

Network access control: 802.1X and NAC

The IEEE 802.1X standard limits the use of LAN ports to communication between authenticated and authorized devices. NAC (network access control) lifts this to a policy layer: according to Cisco, NAC verifies who and what is connecting, checks whether a device meets security policy, manages guests through a self-service registration portal, and applies separate access policies to IoT devices by device category. It commonly relies on 802.1X to do so.

DDoS protection

The ENISA Threat Landscape 2026 classifies 51.3% of the 8,257 incidents recorded in 2025 as low-impact DDoS attacks. Cloudflare divides these attacks into three groups:

  • Volumetric: Creates congestion by consuming the bandwidth between the target and the internet.
  • Protocol attacks: Exploit weaknesses at layers 3 and 4 of the protocol stack and exhaust the resources of servers or of network equipment such as firewalls and load balancers.
  • Application-layer attacks: Flood the layer where web pages are generated with requests; answering a single HTTP request can be expensive for the server.

According to Cloudflare, the key difficulty is telling attack traffic apart from normal traffic; the methods it lists include rate limiting, a WAF and spreading traffic across an anycast network. You cannot stop an attack that saturates your link at your own firewall; the traffic has to be absorbed before it reaches you. We handle this layer in our network protection service.

Monitoring: NetFlow, IPFIX and SIEM

Flow records are the basic way to see what is happening on a network. The IETF's IPFIX standard (RFC 7011, September 2013) defines a flow as a set of packets passing an observation point in the network during a certain time interval and sharing common properties, such as the destination IP address or destination port. A flow record holds the flow's characteristic properties, such as the source IP address, and its measured ones, such as the total number of bytes: who talked to whom, and how much. Cisco's NetFlow version 9 format (RFC 3954, October 2004) does the same job.

When firewall, IPS, VPN and NAC logs go to a SIEM together with flow data, events that look harmless on their own can be linked. We cover logging in our log article, and correlation and the SOC in our SIEM and SOC article.

Zero trust: network location confers no trust

NIST SP 800-207 (August 2020) defines zero trust as the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets and resources. Two of its tenets change network security directly: all communication is secured regardless of network location, and access to resources is granted on a per-session basis. The policy engine makes the access decision, the policy administrator establishes and shuts down the communication path, and the policy enforcement point (PEP) enables, monitors and terminates the connection. In microsegmentation, an NGFW or a gateway plays the PEP role.

According to NIST's June 2025 announcement, SP 1800-35 offers 19 example zero trust architectures built with commercial, off-the-shelf technologies. There is a short definition of the concept in our glossary, and we describe how we run the network layer on our network security page.

Frequently asked questions

What does network security mean? It means protecting an organization's network, and the traffic that crosses it, against unauthorized access, misuse and disruption.

What is the difference between network security and cybersecurity? Cybersecurity is the broader field that also covers devices, applications, identities and data. Network security is part of it and focuses on the traffic on the network.

What is the difference between a firewall and an IPS? A firewall allows or blocks traffic based on rules such as address, port and protocol. An IPS looks inside traffic for signs of an attack and can cut the connection when it finds one; next-generation firewalls combine both in one device.

What is an NGFW (next-generation firewall)? A firewall that adds capabilities such as application awareness, deep packet inspection and IPS on top of traditional filtering.

Will ZTNA replace VPN? The two follow different models: a VPN connects the user to the network, while ZTNA grants access only to permitted applications. Whether to switch depends on knowing which users need which applications.

Sources