Network Security

Network Security

Every application communicating over a network is exposed to attack. Understanding network security — encryption protocols, firewall design, zero trust architectures — is essential for building secure systems.

TLS: Encryption in Transit

TLS 1.3 handshake: Client sends ClientHello with key share → Server responds with ServerHello, certificate, and key share → both derive symmetric session key via Diffie-Hellman (key never transmitted). This is forward secrecy: even if the server's long-term private key is later compromised, past sessions cannot be decrypted.

Certificate validation: chain of trust to a trusted root CA, not expired, not revoked, SAN matches hostname.

Mutual TLS (mTLS): both client and server present certificates. Used for service-to-service authentication in microservices and zero trust.

Common misconfigurations: accepting TLS 1.0/1.1, weak cipher suites (RC4), missing HSTS header, no certificate revocation check.

PKI

X.509 certificate: Subject, Public key, Issuer, Validity, SANs, Signature. Certificate chain: leaf → intermediate CA → root CA. Root CAs are embedded in OS/browser trust stores.

Certificate Transparency: all public certificates must be logged in append-only CT logs. Detects mis-issuance.

Let's Encrypt: free automated CA; 90-day certificates; ACME protocol auto-renewal.

Firewalls

Stateless packet filter: rules on source/destination IP, port, protocol. No connection tracking.

Stateful firewall: tracks TCP state; only packets belonging to established connections pass.

WAF (Web Application Firewall): Layer 7 — inspects HTTP bodies and headers for SQL injection, XSS, CSRF, path traversal. OWASP ModSecurity Core Rule Set.

DMZ: internet-facing services in a DMZ between two firewalls; internal services behind the inner firewall.

Zero Trust

Never trust, always verify. Every request authenticated and authorized regardless of whether it originates inside or outside the corporate network.

Components: Identity Provider (SSO/OIDC), device management (MDM health attestation), microsegmentation (explicit service-to-service allow-lists), mTLS between services, continuous per-request authorization.

BeyondCorp (Google): employees access internal apps from any network via an access proxy verifying identity and device health. No VPN required.

Common Attacks

ARP spoofing: on LAN, respond to ARP requests with your own MAC to intercept traffic. Mitigated by dynamic ARP inspection.

DNS poisoning: return malicious IP for legitimate hostname. Mitigated by DNSSEC (cryptographic authentication of DNS records).

DDoS mitigation: rate limiting at edge, anycast scrubbing centers, CDN absorption, BGP blackholing (last resort).