This is about understanding how the foundational network fabric dictates your security architecture, risk posture, and cloud strategy.

---

1. What is Networking? (The Security Leader’s Perspective)

At its core, networking is the practice of connecting computing devices to share resources and communicate. However, in modern enterprise architecture, networking is the central nervous system of the business.

From a security leadership perspective, networking represents the fundamental tension between Business Enablement (connectivity, speed, agility) and Risk Management (containment, visibility, access control).

• The Architect’s View: Networking is the fabric that connects users to applications, microservices to databases, and branch offices to the cloud.
• The Security Leader’s View: Every network connection is a potential attack vector. The goal of network security is not to build an impenetrable wall, but to design a resilient fabric that allows legitimate business traffic to flow seamlessly while detecting, containing, and blocking malicious lateral movement.

---

2. Types of Networks (From Physical to Cloud-Native)

Traditionally, networks were defined by their physical or geographical scope. Today, as an Enterprise Architect, you must map these traditional concepts to Cloud-Native and Software-Defined equivalents.

A. Traditional Physical Networks

1. PAN (Personal Area Network):
   • Scope: Very small, centered around an individual (e.g., Bluetooth, NFC, connecting a phone to a smartwatch).
   • Security Focus: IoT security, rogue device pairing, and preventing unauthorized local data extraction.
2. LAN (Local Area Network):
   • Scope: A single building or campus (e.g., corporate office, data center). Uses Ethernet and Wi-Fi.
   • Security Focus: This is where East-West traffic lives. Security relies on 802.1X (Network Access Control), VLANs, and internal micro-segmentation to stop an attacker who plugs into a wall jack from accessing the whole network.
3. WAN (Wide Area Network):
   • Scope: Connects multiple LANs over large geographical distances (e.g., branch offices to a central data center). Uses MPLS, leased lines, or the public internet.
   • Security Focus: Securing data in transit. Relies on IPsec VPNs, secure routing protocols (BGP/OSPF), and increasingly, SD-WAN.
4. MAN (Metropolitan) & CAN (Campus):
   • Scope: Connects networks within a city (MAN) or a specific university/corporate campus (CAN).

B. Modern Cloud & Virtual Networks (Your Domain)

As you design Fintech and Enterprise platforms, you are no longer building physical LANs/WANs; you are building virtual ones.

1. VPC (Virtual Private Cloud) / VNet (Virtual Network):
   • The Modern LAN. In AWS or Azure, a VPC is your isolated virtual network.
   • Security Focus: You control the blast radius here using Subnets, Security Groups (Stateful firewalls), and NACLs (Stateless firewalls).
2. SD-WAN (Software-Defined Wide Area Network):
   • The Modern WAN. Decouples the control plane from the data plane. Allows enterprises to route traffic over cheap broadband internet instead of expensive MPLS, while maintaining application performance.
   • Security Focus: Ensuring all internet-bound traffic from branches is tunneled securely to a central cloud security stack (often via SASE).
3. SASE (Secure Access Service Edge):
   • The Convergence of Network and Security. It doesn’t matter if a user is on a LAN, WAN, or the public internet. SASE routes their traffic to the nearest cloud edge, where identity, device health, and application access are verified before they reach the Fintech platform.

---

3. Introduction to the OSI Model (The Blueprint for Defense in Depth)

(Note: We covered the deep technical dive of the OSI layers, TCP, and UDP in our earlier discussions. Here is the executive summary of why the OSI model matters to you as a Security Architect).

The Open Systems Interconnection (OSI) model is a 7-layer conceptual framework. For a security leader, the OSI model is not just a networking theory; it is the architectural blueprint for Defense in Depth.

If an attacker bypasses a security control at Layer 7, you must have controls at Layer 4 and Layer 2 to stop them.

Mapping Security Controls to the OSI Layers:

• Layer 7: Application (The Battleground)
  • What it is: Where the user interacts with the software (HTTP, APIs).
  • Security Controls: WAF/WAAP, API Gateways, IAM/OAuth, RASP (Runtime Application Self-Protection). Most modern breaches happen here via SQLi, XSS, or broken APIs.
• Layer 6 & 5: Presentation & Session (The Envelope)
  • What it is: Encryption, formatting, and session management.
  • Security Controls: TLS 1.3 enforcement, SSL Inspection, HSTS, secure session token generation.
• Layer 4: Transport (The Delivery Mechanism)
  • What it is: TCP/UDP ports and connection states.
  • Security Controls: Stateful Firewalls (NGFW), DDoS mitigation (stopping SYN floods), EDR (Endpoint Detection and Response) monitoring local port bindings.
• Layer 3: Network (The Routing)
  • What it is: IP addressing and routing (VPCs, Subnets).
  • Security Controls: Network ACLs, IPsec, BGP security, uRPF, Micro-segmentation (blocking traffic between subnets).
• Layer 2: Data Link (The Local Switch)
  • What it is: MAC addresses, VLANs, local switching.
  • Security Controls: 802.1X (Port-based NAC), Dynamic ARP Inspection, MAC filtering.
• Layer 1: Physical (The Hardware)
  • What it is: Cables, fiber, data center racks.
  • Security Controls: Badge access, biometric scanners, locked server racks, physical data diodes.