1. Core Networking Fundamentals (The Architectural View)
Before securing the network, an architect must understand where security controls map to the OSI and TCP/IP models.
- Layer 2 (Data Link): MAC addressing, VLANs, and Switching.
- Security Focus: VLAN hopping, MAC flooding, ARP spoofing. Controls include 802.1X (Port-based NAC) and Dynamic ARP Inspection (DAI).
- Layer 3 (Network): IP addressing, Routing (BGP, OSPF), and NAT.
- Security Focus: Route injection attacks, BGP hijacking, IP spoofing. Controls include Routing Authentication, uRPF (Unicast Reverse Path Forwarding), and strict ACLs.
- Layer 4 (Transport): TCP/UDP ports and sessions.
- Security Focus: SYN floods, session hijacking. Controls include Stateful Firewalls and TCP sequence validation.
- Layer 7 (Application): HTTP/S, DNS, DHCP, APIs.
- Security Focus: SQLi, XSS, DNS tunneling, API abuse. Controls include WAFs, API Gateways, and Deep Packet Inspection (DPI).
2. Traditional Network Security Components
These are the foundational building blocks of perimeter and internal network security.
- Firewalls (Packet Filtering to NGFW):
- Stateful Firewalls: Track the state of active connections (TCP streams).
- Next-Generation Firewalls (NGFW): Perform deep packet inspection (DPI), application awareness (identifying the app, not just the port), and integrate IPS and user identity.
- Web Application Firewalls (WAF):
- Specifically designed to protect L7 (HTTP/HTTPS). It inspects traffic for OWASP Top 10 vulnerabilities (e.g., SQL injection, Cross-Site Scripting). Crucial for Fintech web/mobile applications.
- IDS vs. IPS (Intrusion Detection vs. Prevention):
- IDS (Passive): Monitors network traffic via a SPAN/mirror port and alerts on signature or anomaly matches. Does not block traffic.
- IPS (Inline): Sits directly in the traffic path. Can actively drop malicious packets or reset connections.
- Modern Evolution: NDR (Network Detection and Response) uses machine learning and behavioral analysis to detect encrypted threats and lateral movement, replacing legacy signature-based IPS.
- Proxies and Gateways:
- Forward Proxy: Sits between internal users and the internet. Enforces acceptable use policies, filters web content, and hides internal IP addresses.
- Reverse Proxy: Sits in front of internal servers (e.g., load balancers, API gateways). Protects backend servers, offloads SSL termination, and handles rate limiting.
- Secure Web Gateway (SWG): An enterprise-grade forward proxy that enforces security policies and prevents users from clicking malicious links or downloading malware.
3. Modern & Cloud Network Security (Crucial for Enterprise Arch)
As organizations move to AWS, Azure, and hybrid models, the traditional “castle-and-moat” perimeter dissolves.
- Micro-segmentation:
- Applying security policies at the workload or instance level rather than the subnet level. In VMware, this is NSX; in AWS/Azure, these are Security Groups and NACLs. It stops East-West (lateral) traffic.
- Zero Trust Network Access (ZTNA):
- Replaces traditional VPNs. Instead of granting a user access to the whole network upon authentication, ZTNA grants access only to specific applications based on identity, device health, and context.
- SASE (Secure Access Service Edge) & SSE (Security Service Edge):
- SASE converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into a unified, cloud-native service model.
- SSE is the security subset of SASE, focusing strictly on securing access to web, cloud, and private applications regardless of the underlying network.
- Cloud-Native Networking Security:
- VPC/VNet Peering & Transit Gateways: Secure routing between cloud environments.
- PrivateLink / Azure Private Endpoints: Allows private connectivity to services without exposing traffic to the public internet or traversing public IP space.
4. Specialized Contexts (Tailored to Your Background)
A. ICS / OT Security (SCADA, DCS, PLC)
Given your experience with industrial protocols (Modbus, OPC), you know IT security controls can break OT processes.
- The Purdue Model: The architectural framework for ICS. It separates the network into levels (Level 0-3 for OT, Level 4-5 for IT).
- Industrial DMZ (IdMZ): A critical security boundary (often between Level 3.5 and 4) containing jump hosts, data historians, and patch management servers. IT and OT do not connect directly; they communicate through the IdMZ.
- OT Security Tools: Traditional IT firewalls often fail with industrial protocols. OT environments require specialized firewalls (e.g., Fortinet, Claroty, Nozomi) that understand Modbus/OPC command sets to prevent malicious PLC logic changes.
B. Fintech & DeFi Security Architecture
In Fintech, network security must balance extreme security with ultra-low latency.
- API Security: Fintechs are essentially API companies. API Gateways must enforce OAuth2/OIDC, rate limiting, payload validation, and mTLS (Mutual TLS).
- DDoS Mitigation: Financial services are prime targets for volumetric and application-layer DDoS. Architecture must include scrubbing centers (e.g., AWS Shield Advanced, Cloudflare Magic Transit).
- mTLS (Mutual TLS): Ensuring not just the client authenticates to the server, but the server authenticates to the client. Vital for microservices and open banking (PSD2) communications.
5. Key Metrics & Concepts for Security Leadership
As you interview for Head of Platform Security or board-level roles, you will be evaluated on how you measure network security effectiveness:
- Attack Surface Reduction: How effectively are you decommissioning legacy ports, closing public-facing ingress points, and enforcing private endpoints?
- Blast Radius Containment: If an attacker compromises a single web server, how much of the network can they reach? (Measured by the effectiveness of micro-segmentation and least-privilege routing).
- Encryption in Transit: Enforcing TLS 1.3 for all internal and external communications, and managing the cryptographic lifecycle (certificate expiration tracking).
- Shadow IT / Rogue APs: How effectively is the network identifying and quarantining unauthorized devices or cloud instances spun up by developers?
