CompTIA Network+: Network Security Concepts & Solutions

1. Introduction

Network security protects an organisation's data, devices, applications, and network infrastructure from unauthorised access, misuse, and cyberattacks.

The main goals of network security are confidentiality, integrity, and availability. These are known as the CIA triad and form the foundation of information security.

Network security combines logical controls, physical protection, monitoring, access management, encryption, and compliance. Organisations must protect both their digital systems and the physical environments in which those systems operate.

This article covers the key concepts from the CompTIA Network+ course, including logical security, physical security controls, deception technologies, compliance, network segmentation, device hardening, network access control, key management, filtering rules, and security zones.

2. Logical Security Concepts

Logical security uses software, configurations, policies, and technical controls to protect network resources and information.

Encryption

Encryption converts readable information, known as plaintext, into unreadable information called ciphertext. A cipher and cryptographic key are used to perform the process.

Encryption helps protect sensitive information from people who are not authorised to access it.

There are two main types of encryption.

Symmetric encryption

Symmetric encryption uses the same key to encrypt and decrypt information. It is generally efficient for protecting large amounts of data. However, the key must be shared securely between the parties that need to communicate.

Asymmetric encryption

Asymmetric encryption uses a pair of related keys: a public key and a private key. The public key can be shared, while the private key must remain secret.

Asymmetric cryptography can support secure key exchange and identity verification. It is generally more computationally expensive than symmetric encryption.

How HTTPS uses encryption

HTTPS protects communication between a browser and a website using TLS.

During the TLS handshake, the parties establish the parameters needed for a secure connection and authenticate the server using its certificate. Modern TLS commonly uses asymmetric cryptography for authentication and key establishment, then symmetric encryption to protect the session data.

This combination provides security while maintaining good performance.

Identity and Access Management (IAM)

Identity and Access Management controls who can access systems and what they are permitted to do.

IAM commonly involves:

• Authentication: Verifying a user's identity.
• Authorisation: Determining what an authenticated user can access.
• Access permissions: Defining which resources and actions are allowed.
• Access management: Controlling and reviewing access to systems and information.

For example, an employee may be permitted to view customer records but not change payment details. IAM helps enforce these permissions.

3. Physical Security Controls

Physical security protects buildings, equipment, network devices, servers, and other assets against unauthorised physical access.

Logical security protects digital resources, while physical security helps prevent people from reaching or damaging those resources directly.

Common physical security controls

Fences and gates

Fences define boundaries around a site. Gates control entry and exit. Their effectiveness depends on their design, construction, placement, and access procedures.

Bollards

Bollards restrict vehicle access to protected areas. They may be fixed or retractable. Some retractable systems use sensors or other mechanisms to control movement.

Access control vestibules and mantraps

These systems use controlled doors to manage entry. A mantrap typically requires one door to close before another opens, helping prevent unauthorised people from following an authorised person into a secure area.

Access badges and cards

Badges and cards identify authorised personnel and allow access to approved areas. Organisations should monitor their use and prevent tailgating, which occurs when an unauthorised person follows someone through a controlled entrance.

Security guards

Security guards can deter unauthorised access, monitor activity, check credentials, and respond to incidents. Their effectiveness depends on suitable recruitment, training, supervision, and procedures.

Physical security is strongest when multiple controls work together rather than relying on a single measure.

4. Security Deception Technologies

Security deception technologies create decoys that attract potential attackers away from genuine systems or help security teams observe malicious activity.

Honeypots

A honeypot is a deliberately exposed or simulated system designed to attract attackers. It can help an organisation observe attack methods, identify suspicious behaviour, and improve its security controls.

Honeypots should be isolated and carefully monitored so that an attacker cannot use them to reach production systems.

There are several types.

• Low-interaction honeypot: Simulates limited services or behaviours. It is often easier to deploy and maintain, but provides less information about complex attacks.
• High-interaction honeypot: Provides a more realistic environment in which attackers can interact with systems. It can reveal more detailed behaviour but requires stronger isolation and monitoring.
• Specialised honeypots: Target particular threats or services, such as email systems, malware activity, or databases.

Honeynets

A honeynet is a collection of honeypots arranged to resemble a network or broader computing environment.

It allows security teams to observe how attackers interact with multiple systems and services.

Honeywalls and bait data

A honeywall is a monitoring and control mechanism used in some honeynet designs. It helps observe and control traffic entering or leaving the decoy environment.

Bait data consists of decoy information designed to attract attention or reveal unauthorised access attempts.

The purpose of deception technology is to improve threat detection and gather intelligence. It should complement, not replace, normal security controls.

5. Common Security Terminology

Understanding common security terms helps network professionals identify threats and select appropriate protections.

Risk

Risk is the possibility that an event will negatively affect systems, information, or business operations.

Risk assessment considers the likelihood of an event and the consequences if it occurs. Organisations use this information to decide which security controls are necessary.

Vulnerability

A vulnerability is a weakness in software, hardware, configuration, or a process that could be exploited.

Examples include outdated software, weak passwords, unnecessary open ports, and incorrect access permissions.

Exploit

An exploit takes advantage of a vulnerability to perform an unauthorised or harmful action.

Applying security patches promptly, removing unnecessary services, and maintaining secure configurations can reduce exposure to known exploits.

Zero-day exploit

A zero-day exploit targets a vulnerability for which an effective patch or fix may not yet be available to the affected organisation. These vulnerabilities can be difficult to defend against because normal patching may not immediately resolve the issue.

Social engineering

Social engineering manipulates people into revealing information, granting access, or performing actions that compromise security.

Examples include phishing messages, impersonation, and fraudulent requests for credentials.

Organisations can reduce social engineering risks through staff awareness training, clear verification procedures, and appropriate technical controls.

The CIA triad

The CIA triad describes three essential security objectives.

Principle	Meaning	Example
Confidentiality	Information is accessible only to authorised people or systems.	Encrypting sensitive customer records.
Integrity	Information remains accurate and is not changed without authorisation.	Using permissions and integrity checks to protect records.
Availability	Systems and information remain accessible when needed.	Using backups and resilient infrastructure.

A strong security strategy balances all three principles.

6. Compliance and Auditing

Organisations often have legal, regulatory, contractual, and industry obligations to protect information and demonstrate that appropriate security controls are in place.

Compliance involves following applicable requirements and maintaining evidence that the organisation is meeting them.

Important compliance activities

Documented policies: Written security policies explain expected behaviour, responsibilities, and required controls.

Defined roles: Employees and teams should understand who is responsible for security decisions, system administration, incident response, and data protection.

Security protocols: Procedures define how systems are protected, how access is managed, and how incidents are handled.

Employee training: Staff need to understand common threats, secure working practices, and their responsibilities.

Continuous monitoring: Monitoring helps identify suspicious activity, weaknesses, and potential policy violations.

Regular audits: Audits examine whether controls are designed appropriately and operating as intended.

Internal and external audits

Internal audits help an organisation review its own security arrangements and identify areas for improvement.

External audits provide an independent assessment and may identify issues that internal teams have overlooked. They can also provide evidence for customers, regulators, or other interested parties.

Examples of security standards and regulations

• PCI DSS: A security standard for organisations that store, process, or transmit payment card data.
• GDPR: A legal framework governing the processing and protection of personal data within its scope, including individuals' rights and organisational responsibilities.

Compliance requirements vary by organisation, sector, jurisdiction, and the type of data involved. Organisations should identify which requirements apply to their activities.

7. Network Segmentation and Enforcement

Network segmentation divides a network into smaller sections to control communication and limit unnecessary access.

Without effective segmentation, a compromised device may provide an attacker with a path to other systems on the same network.

Physical segmentation

Physical segmentation separates networks using distinct physical infrastructure or network devices.

It can provide strong separation, but may require additional equipment, cabling, and administration.

Logical segmentation

Logical segmentation separates networks using configurations on shared infrastructure. Virtual Local Area Networks (VLANs) are a common example.

VLANs allow devices to be grouped logically, even when they connect through the same physical switches. Traffic between VLANs can be controlled using routing rules, access control lists, and firewalls.

Microsegmentation

Microsegmentation applies more granular controls to communication between workloads, applications, or individual systems.

It can limit which services are allowed to communicate with one another, reducing the potential spread of an attack.

Benefits of segmentation

Segmentation can:

• Limit unauthorised access between network areas.
• Reduce the spread of malware and other attacks.
• Separate sensitive systems from general user devices.
• Improve traffic management.
• Help protect Internet of Things (IoT) devices.
• Isolate Bring Your Own Device (BYOD) connections.
• Separate industrial control systems from corporate networks.
• Reduce the scope of systems that must meet particular compliance requirements.

Segmentation is effective only when the organisation also controls the traffic that crosses segment boundaries.

8. Device Hardening Techniques

Device hardening reduces the number of weaknesses that attackers could exploit on network equipment, servers, computers, and other devices.

The goal is to configure each device securely and remove unnecessary features that increase risk.

Change default credentials

Default usernames and passwords are often publicly known. Administrators should replace default credentials with strong, unique passwords and apply appropriate controls to privileged accounts.

Multi-factor authentication should be used where supported and appropriate.

Use secure management protocols

Administrators should use secure protocols to manage network devices.

For example, Secure Shell (SSH) encrypts remote command-line sessions. Telnet does not encrypt its session traffic, so credentials and commands can be exposed to anyone able to intercept the connection.

Disable unnecessary ports and services

Open ports and running services can create additional attack opportunities. Administrators should identify which services are required and disable those that are unnecessary.

This reduces the device's attack surface.

Update or disable outdated protocols

Outdated protocols may contain known security weaknesses. Administrators should assess their use and replace or disable insecure options where possible.

Standardise configurations

Organisations can create secure baseline configurations for devices of the same type or role. These standard builds help maintain consistency across the network.

Document and centrally manage configurations

Configuration records help administrators understand how devices should operate and support troubleshooting, auditing, and recovery.

Centralised management tools can help apply updates and security settings consistently across multiple devices.

Device hardening should be an ongoing process. New vulnerabilities, software updates, and changing business requirements may require further adjustments.

9. Network Access Control (NAC) Solutions

Network Access Control helps determine which devices can connect to a network and under what conditions.

NAC can use device identity, authentication, security policies, and other information to control access.

Port security

Switch port security restricts which devices can connect through a switch port. One common method is to limit the MAC addresses permitted on a port.

This can help prevent unauthorised devices from connecting through an unused or restricted port.

However, MAC addresses can be spoofed, so port security should not be treated as a complete security solution.

IEEE 802.1X

802.1X provides port-based network access control. A device must complete an authentication process before receiving normal network access.

A typical arrangement involves:

• Supplicant: The client or device requesting access.
• Authenticator: The network device, such as a switch or wireless access point, that controls access.
• Authentication server: Commonly a RADIUS server, which validates credentials or authentication information.

This approach is widely used in enterprise wired and wireless networks.

MAC filtering

MAC filtering allows or denies network access based on a device's MAC address.

It can provide a basic access restriction, but it is not strong authentication on its own because MAC addresses can be copied or spoofed.

Wireless security

WPA3 provides modern wireless security capabilities and should be used where supported and appropriate.

MAC filtering should not replace strong wireless encryption and authentication. Organisations should combine suitable wireless security with firewalls, endpoint protection, VPNs where required, and other access controls.

10. Key Management Concepts

Cryptographic keys are essential to encryption, decryption, and some authentication processes. If keys are exposed, lost, or poorly managed, the security of the systems that rely on them may be compromised.

Key management covers the secure handling of keys throughout their life cycle.

Symmetric and asymmetric keys

Feature	Symmetric cryptography	Asymmetric cryptography
Keys used	One shared secret key.	A public and private key pair.
Main strength	Efficient for encrypting large amounts of data.	Supports public-key-based authentication and key establishment.
Main challenge	The secret key must be shared and protected securely.	Private keys must be protected, and the operations are generally more computationally expensive.
Typical use	Protecting data and secure communication sessions.	Certificates, digital signatures, authentication, and key establishment.

Modern secure communication often combines both approaches. Asymmetric cryptography helps establish trust or session keys, while symmetric cryptography efficiently protects the session data.

Key management life cycle

Good key management includes:

Secure generation: Keys must be created using appropriate cryptographic methods.

Secure storage: Keys should be protected against unauthorised access and theft.

Access control: Only authorised users, services, or systems should be able to use particular keys.

Key rotation: Keys may need to be replaced periodically or when compromise is suspected, according to the applicable policy.

Revocation and retirement: Keys that are compromised, expired, or no longer needed should be handled appropriately.

Backup and recovery: Where required, keys must be recoverable through secure procedures without exposing them unnecessarily.

Hardware Security Modules (HSMs)

A Hardware Security Module is a specialised device used to protect and manage cryptographic keys and perform certain cryptographic operations.

HSMs can help prevent sensitive keys from being exposed to ordinary applications or users.

Key management should be treated as a critical part of security, not simply as a one-time encryption setup.

11. Network Security Rules

Network security rules determine which users, devices, applications, and types of traffic are permitted or blocked.

These controls help organisations enforce security policies and reduce exposure to malicious or inappropriate content.

Access Control Lists (ACLs)

An Access Control List is a set of rules that allows or denies access to resources or traffic based on defined criteria.

Network ACLs can filter traffic using information such as source and destination addresses, protocols, and ports. Other ACLs can control access to files or other resources.

ACLs should be designed carefully. Rules that are too broad may permit unwanted access, while incorrect rules may block legitimate services.

URL filtering

URL filtering controls access to websites and web addresses.

Depending on the implementation, an organisation may block known malicious sites, restrict categories of websites, or permit only approved destinations.

Content filtering

Content filtering examines information or traffic to identify and block material that violates security policies.

Examples include blocking malicious downloads, harmful email attachments, or prohibited content.

Other filtering approaches

• DNS filtering: Blocks or redirects requests for specified domain names, including domains associated with known threats.
• Email filtering: Detects or blocks spam, phishing messages, malicious links, and harmful attachments.
• Search engine filtering: Restricts certain search results or content categories.
• Proxy filtering: Uses a proxy service to apply web access policies and inspect or control requests, depending on its configuration.

Centralised filtering tools can help organisations apply consistent policies across devices and servers.

Filtering is most effective when combined with endpoint protection, user awareness, access control, and monitoring.

12. Network Security Zones

Network security zones group systems and interfaces according to their trust level and security requirements. Firewalls and other controls regulate communication between the zones.

A common design uses three zones: the trusted internal network, the demilitarised zone (DMZ), and the untrusted external network.

Trusted internal network

This zone contains internal systems and services that require protection from external threats. Examples include employee workstations, internal applications, and business databases.

Being inside the trusted network does not mean that every device should automatically be trusted. Internal access should still follow security policies and least-privilege principles.

Demilitarised zone (DMZ)

A DMZ contains public-facing systems that must communicate with external users while remaining separated from the internal network.

Examples include public web servers, reverse proxies, and certain externally accessible services.

The DMZ acts as a controlled buffer between the Internet and the internal network. Firewall rules should restrict which connections are allowed into and out of the zone.

For example, a public web server may accept approved web traffic from the Internet but should not have unrestricted access to internal databases.

Untrusted external network

The external zone typically represents the Internet or other networks that the organisation does not control.

Traffic from this zone must be treated according to the organisation's security policies rather than being trusted by default.

Firewalls and three-zone designs

A firewall controls traffic according to configured rules. In a three-zone design, a firewall may have separate interfaces for the internal network, DMZ, and external network. A firewall with three network interfaces is sometimes described as a three-legged or triple-homed firewall.

Its rules determine which traffic can pass between zones.

A secure design should apply only the access required for legitimate business purposes. A DMZ should not be treated as a reason to allow unrestricted communication with internal systems.

13. Quick Comparison Table

Technology or control	Main purpose	Key point to remember
Symmetric encryption	Protects data using one shared secret key.	Same key encrypts and decrypts.
Asymmetric encryption	Supports public-key cryptography.	Uses a public and private key pair.
IAM	Controls identity, authentication, and permissions.	Determines who can access what.
Mantrap	Controls physical entry through secured doors.	Helps prevent unauthorised following.
Honeypot	Attracts and observes potential attackers.	A decoy system.
Honeynet	Provides multiple connected decoy systems.	A decoy network.
CIA triad	Defines core security objectives.	Confidentiality, integrity, availability.
PCI DSS	Protects payment card data.	Payment card security standard.
GDPR	Regulates personal data processing within its scope.	Personal data protection and rights.
VLAN	Logically separates network traffic.	Network segmentation.
Microsegmentation	Applies fine-grained controls between workloads or services.	Limits lateral movement.
SSH	Provides secure remote command-line management.	Prefer it over Telnet.
Port security	Restricts devices on switch ports.	May limit allowed MAC addresses.
802.1X	Provides port-based network access authentication.	Commonly works with RADIUS.
MAC filtering	Allows or denies devices by MAC address.	MAC addresses can be spoofed.
HSM	Protects cryptographic keys and performs cryptographic operations.	Specialised hardware for key security.
ACL	Allows or denies access or traffic according to rules.	Rule-based access control.
DNS filtering	Controls access using domain-name requests.	Can block known malicious domains.
DMZ	Separates public-facing services from internal systems.	A controlled buffer zone.
Firewall	Controls traffic between networks or zones.	Enforces traffic rules.

14. Practical Scenario

A company hosts a public website, stores customer records internally, and allows employees to connect remotely.

A business-minded network administrator could apply the course concepts as follows:

1. Protect communication: Use HTTPS with modern TLS to secure connections to the website.
2. Control access: Use IAM to ensure employees have only the permissions required for their roles.
3. Protect the building: Use badges, controlled entrances, and other physical security measures to restrict access to server equipment.
4. Separate systems: Place the public website in a DMZ and restrict its connections to the internal network.
5. Harden devices: Change default passwords, disable unnecessary services, apply patches, and use SSH for secure administration.
6. Control network access: Use appropriate NAC measures, such as 802.1X, where supported.
7. Protect cryptographic keys: Store and manage keys securely, applying access controls and rotation policies.
8. Filter threats: Apply suitable DNS, email, URL, and network traffic filtering.
9. Monitor threats: Use monitoring and, where appropriate, carefully isolated deception technologies to identify suspicious activity.
10. Maintain compliance: Document policies, train staff, monitor controls, and conduct appropriate audits.

These controls work together. No single technology provides complete protection.

15. Exam Revision: Key Points to Remember

Before taking the CompTIA Network+ N10-009 course test, review the following:

• Encryption converts plaintext into ciphertext using a cipher and key.
• Symmetric encryption uses one shared key. Asymmetric cryptography uses a public and private key pair.
• HTTPS uses TLS to protect communication. Modern TLS combines asymmetric cryptography with symmetric session encryption.
• IAM manages identities, authentication, and permissions.
• Physical security includes fences, gates, bollards, mantraps, access badges, and security guards.
• A honeypot is a decoy system. A honeynet is a network of decoy systems.
• Risk concerns potential adverse outcomes. A vulnerability is a weakness, and an exploit takes advantage of a weakness.
• Zero-day exploits target vulnerabilities for which an effective fix may not yet be available.
• The CIA triad means confidentiality, integrity, and availability.
• PCI DSS relates to payment card data security. GDPR governs personal data processing within its scope.
• Segmentation separates networks or workloads to limit access and contain attacks.
• Device hardening includes changing default passwords, disabling unnecessary services, patching systems, and using secure management protocols.
• Port security may limit MAC addresses on switch ports. MAC filtering alone is not strong authentication.
• 802.1X provides port-based network access control and commonly uses RADIUS for authentication.
• Key management includes secure generation, storage, access control, rotation, and retirement.
• ACLs regulate access or traffic. URL, DNS, email, and content filters apply different types of restrictions.
• A DMZ hosts public-facing services while helping protect the internal network.
• Firewalls enforce rules that control traffic between security zones.

16. Conclusion

Network Security Concepts and Solutions brings together the technologies, policies, and physical controls that organisations use to protect their networks.

The most important lesson is that security requires several layers of protection. Encryption protects information, IAM and NAC control access, segmentation limits communication, device hardening reduces weaknesses, and firewalls enforce rules between network zones. Physical security, monitoring, key management, staff training, and compliance support these technical controls.

For the Network+ exam, focus on understanding what each control does, where it is used, and how it differs from similar technologies. Being able to recognise the right control for a practical scenario is just as important as memorising definitions.