1. The Edge & Perimeter (North-South Traffic)

While the “perimeter” is no longer the only boundary, controlling ingress and egress remains critical.

• Next-Generation Firewalls (NGFW) & FWaaS (Firewall as a Service):
  • Evolution: Moved beyond Layer 3/4 port blocking to Layer 7 Application Identification (App-ID), user identity integration (User-ID), and SSL/TLS decryption.
  • Architectural Shift: In the cloud (AWS/Azure), physical NGFWs are replaced by FWaaS or cloud-native firewalls (like Palo Alto VM-Series or Fortinet in the cloud). The architecture shifts from hardware appliances to auto-scaling, software-defined firewall fleets.
• Secure Web Gateway (SWG) & Cloud Access Security Broker (CASB):
  • SWG: Enforces acceptable use policies, blocks malicious URLs, and prevents malware downloads for users browsing the web.
  • CASB: Specifically sits between users and SaaS applications (like Office 365, Salesforce). It enforces security policies (e.g., “Block downloading PII to a personal Gmail account via Office 365”) and provides visibility into Shadow IT.
  • Modern Convergence: Both are now typically consumed as cloud services, often bundled under the SSE (Security Service Edge) umbrella.
• DDoS Mitigation (Scrubbing Centers):
  • Fintech Context: Financial platforms are prime targets for volumetric (Layer 3/4) and application-layer (Layer 7) DDoS.
  • Architecture: You do not handle this on-prem. You use upstream “scrubbing centers” (e.g., AWS Shield Advanced, Cloudflare Magic Transit, Akamai Prolexic). Traffic is routed via BGP Anycast to the scrubbing center, which filters out malicious packets and forwards only clean traffic to your data center via GRE tunnels or direct connect.

2. Application & API Security (Layer 7)

For a Fintech or digital business, the API is the product. Securing Layer 7 is your highest priority.

• WAAP (Web Application and API Protection):
  • Evolution: The traditional WAF (Web Application Firewall) has evolved into WAAP. Gartner coined this term to reflect that modern tools must protect against OWASP Top 10, API abuse (BOLA/IDOR), bot management, and DDoS simultaneously.
  • Architecture: Deployed as reverse proxies (on-prem) or cloud edges (CDN-integrated). For Fintech, WAAP must support mTLS (Mutual TLS) and deep JSON/XML payload inspection without introducing unacceptable latency.
• API Gateways:
  • While WAAP is a security tool, the API Gateway is an integration tool. However, in modern architecture, they work in tandem. The Gateway handles rate limiting, OAuth/OIDC token validation, and traffic routing. The WAAP sits in front of it to inspect the actual payloads for malicious code.

3. Internal Segmentation & East-West Traffic

Once an attacker breaches the perimeter, internal network security components dictate the “blast radius.”

• Micro-segmentation:
  • Concept: Applying security policies at the workload/VM level, not the subnet level.
  • Components: VMware NSX (leveraging your VMware background), AWS Security Groups, Azure NSGs, or host-based agents (like Illumio).
  • Architecture: This ensures that if a web server is compromised, the attacker cannot pivot to the database server because the micro-segmentation policy explicitly denies Layer 4 traffic between them, even though they are on the same VLAN/VPC.
• NDR (Network Detection and Response):
  • Evolution: Replaces legacy IDS/IPS. While IPS relies on signatures, NDR uses machine learning, behavioral analytics, and traffic baselining to detect anomalies (e.g., a database server suddenly talking to an external IP on port 443).
  • Architecture: NDR sensors are deployed at strategic network TAPs or SPAN ports. They integrate directly with the SIEM and SOAR to automatically isolate a compromised switch port or EDR agent when a threat is detected.
• Data Diodes / Unidirectional Gateways (OT/ICS Specific):
  • Context: Drawing on your SCADA/PLC background. In highly critical OT environments (Level 2/3 of the Purdue model), we use hardware-enforced Data Diodes.
  • Function: They allow data to flow only out of the OT network (e.g., to a historian for monitoring) and physically prevent any data from flowing in, making remote compromise of the PLCs mathematically impossible via that path.

4. Access & Connectivity Architecture

How do users and devices securely connect to these network components?

• ZTNA (Zero Trust Network Access):
  • Evolution: Replaces the traditional VPN. A VPN grants network access; ZTNA grants application access.
  • Architecture: The user authenticates to a ZTNA broker. The broker verifies identity, device health (via EDR), and context. Only then is a micro-tunnel established directly to the specific application (e.g., the Fintech admin portal). The internal network remains entirely invisible to the user.
• SASE (Secure Access Service Edge):
  • The Ultimate Convergence: SASE is not a single box; it is an architectural framework that converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into a single, unified, cloud-native service.
  • Leadership View: As a Head of Platform Security, SASE allows you to retire hundreds of regional hardware firewalls and WAN appliances, replacing them with a single cloud tenant. You manage security policies centrally, and they are enforced at the nearest cloud edge to the user.

5. The “Glue”: Visibility and Orchestration

A network security stack is useless if the components don’t talk to each other.

• Network TAPs (Test Access Points) & SPAN Ports:
  • Hardware or switch-level configurations that copy network traffic and send it to monitoring tools (NDR, SIEM, Packet Brokers) without disrupting the actual traffic flow.
• Policy-as-Code (PaC):
  • Modern Architecture: In a cloud-native environment, you do not click through GUIs to configure firewall rules. Network security policies (Security Groups, WAF rules, NGFW rules) are written in code (Terraform, Ansible), stored in Git, and deployed via CI/CD pipelines. This ensures auditability, version control, and rapid remediation.