Lesson 2: Network Security and Perimeter Defense

A firewall is a network security device (software or hardware) that controls incoming and outgoing network traffic based on predefined rules. Basic firewalls operate at the packet-filtering level (examining IP addresses and ports), while advanced firewalls track connection state (stateful) or inspect application-level data. For example, a firewall rule can block all traffic on port 80 (HTTP) except from certain trusted IP addresses. Network segmentation divides a network into subnets or VLANs so that a breach in one segment cannot easily spread to others. By isolating sensitive systems (e.g., financial servers) from general user networks, segmentation limits the scope of an attack.

An Intrusion Detection System (IDS) monitors network or system activities for malicious behavior or policy violations and alerts administrators. An Intrusion Prevention System (IPS) goes further by actively blocking or preventing detected threats (such as dropping malicious packets). These systems use signature-based detection (matching known attack patterns) or anomaly-based detection (flagging unusual behavior). For example, an IDS might flag repeated failed login attempts as a possible brute-force attack. Properly tuned IDS/IPS tools help catch attacks that pass through firewalls, as they can identify suspicious patterns inside allowed traffic.