UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 10.1 Free with a free account
Fundamental Concepts of Network Protection
Ethics in Technology · Chapter 10: Defending the Network: Firewalls, VPNs, and Security PoliciesSection 10.1 · lesson 52 of 11613 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Authentication, Access Control, and Identity Verification →← Malware Functions: Spyware, Ransomware, Adware, and BeyondNext lesson: Authentication, Access Control, and Identity Verification →
In this lesson
Intended communication, limited trust, separated zones, and layered controls.
- Turn protection goals into questions about access.
- Explain the perimeter model and changing boundaries.
- Apply zero trust, segmentation, and DMZ concepts.
- Review layered defenses through failure scenarios.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,536 words). Read along, or search it.
Chapter 10
Network Protection
Network protection supports intended communication with suitable safeguards. Stopping every connection would defeat the purpose of a network. We turn six protection goals into practical questions about access and evidence. Authentication asks who is requesting access, while authorization asks what that party may do. Integrity, confidentiality, availability, and accountability address different aspects of dependable service. The perimeter model used a strong boundary, often with broad trust inside. Cloud services, remote work, personal devices, and partner access complicated that assumption. Zero trust removes automatic trust from location and grants justified narrow resource access. Segmentation, security zones, and a DMZ reduce unwanted reachability. Defense in depth combines controls with different purposes and examines their failure consequences. A manufacturer scenario shows why public services, visitors, records, machinery, and management need considered separation.
Six Protection Goals
A Network Must Permit Intended Communication, with Suitable Safeguards
A request needs more than one kind of assurance. Authentication establishes evidence of the requesting party's identity. Authorization limits the resources and actions that identity may use. Integrity protects against improper alteration, such as changed supplier payment details. Authenticated encryption or signatures can provide stronger assurance than an untrusted ordinary checksum alone. Confidentiality limits unauthorized reading, including exposure of credentials on unprotected connections. Availability keeps necessary services usable through appropriate capacity, resilience, and protective controls. Accountability preserves useful evidence of decisions and activity. Certificates, device identity, permissions, communication protection, and logs answer different questions. No single control automatically provides every goal or perfect assurance. Judge whether the actual design supports intended communication while addressing each relevant failure.
Accountability
Useful Records Support Detection, Response, and Later Reconstruction
Useful records support both timely detection and later reconstruction. Account events, traffic metadata, system activity, and application records contribute different views. Consistent timing helps investigators correlate events across those sources. Protected transport, storage, appropriate retention, and accessible analysis make the evidence more dependable. Recording an event alone does not block it. Timely analysis and response can identify suspicious activity and limit ongoing harm. Afterwards, records can help assess affected systems, actions, and timing. Missing evidence increases uncertainty, but does not prove every possible harmful action occurred. Notification duties depend on applicable requirements and the incident's facts. There is no universal rule that missing logs require every imaginable worst-case notification. Justify collection, restrict access, and protect sensitive records instead of assuming more data guarantees complete visibility.
Perimeter Model
A Strong Boundary Was Useful, but Location Alone Was an Incomplete Basis for Trust
The perimeter model places a strong boundary between the internal network and outside traffic. A castle-and-moat analogy emphasizes difficult entry and a relatively trusted interior. This matched centralized offices and locally hosted applications more closely than many modern environments. The structural problem appears when crossing the edge grants broad internal trust. An allowed web connection may lead to a deceptive sign-in page and stolen credentials. Permitted supplier or remote access can carry a compromised account or device. Physical access or an internal foothold can challenge assumptions about outside traffic. Further movement becomes easier when interior connections and permissions are broad. Not every historical perimeter network lacked internal safeguards. Likewise, one foothold does not automatically mean total compromise. The lesson is to examine what follows entry, rather than treating the edge as complete assurance.
Changing Boundaries
Business Changes Made One Building a Poor Stand-In for the Whole Organization
Four business changes made one office boundary a weaker representation of the whole organization. Cloud and rented environments host resources outside the building. Remote workers request access from homes, hotels, and other workplaces. Personal devices introduce different ownership, visibility, and management conditions. Suppliers and partners need connections to selected internal services. These changes can support useful business work without being security failures by themselves. They create new questions about identity, device condition, resource policy, and responsibility. Internal location and organizational ownership alone do not establish permission. Edge filtering still rejects unwanted traffic and reduces exposure. Its role complements identity checks, internal separation, and suitable resource controls. Keep useful boundaries, while stopping the assumption that one boundary answers every trust question.
Zero Trust
Remove Automatic Trust from Location, and Grant Narrow Resource Access
Zero trust removes automatic permission based solely on being inside a network. Assess the requesting identity, device, resource, and relevant policy conditions. Grant only the access and actions needed for the legitimate task. Reassess relevant context instead of carrying broad trust indefinitely. The phrase, verify every request, expresses a design principle rather than constant manual sign-in. NIST describes individual resource access on a per-session basis, with dynamic policy and ongoing evaluation. Authentication to one resource does not automatically authorize another. Specific enforcement and timing depend on the implemented design. Plan for a compromised identity or device, and reduce its ability to reach other resources. Other stolen rights, flaws, or compromised controls can still expand an incident. Zero trust relies on trusted components and justified access; it is an ongoing approach, rather than a complete purchased guarantee.
DMZ Placement
Separate Public Exposure from Internal Resources, and Govern Each Allowed Path
A DMZ is a separated area for public-facing services. The diagram shows conceptual placement, with explicit policy needed for each illustrated path. The internet may reach the intended public service, rather than every port or administrative interface. A public server may need a narrow connection to a named internal application. That requirement does not justify unrestricted access to the general internal network. Filter permitted paths and record useful activity. Harden, patch, and monitor the public server while planning for possible compromise. Exposure does not make compromise certain. Separation limits onward reachability if the server is compromised. Allowed application paths can still carry risk, and the server may itself hold sensitive information. Hardening, zoning, and suitable application permissions therefore work together rather than replacing one another.
Security Zones
Group Systems by Purpose and Risk, then Define Permitted Connections
Segmentation divides reachability so that access to one part does not automatically open every other part. A security zone groups systems with appropriate purposes, risks, and connection rules. Public web servers, mail relays, or access gateways can occupy a DMZ. Staff devices, printers, and shared storage belong to suitable general internal zones. Records, payroll, and payment handling need more restricted workflows. Named application services can receive necessary access without broad direct database permission for staff devices. Management includes administration, monitoring, and backup control. Limit its access to approved administrative devices, appropriate identities, and supported actions. A zone name alone enforces nothing; configured controls must implement the rules. Management compromise can affect many assets, while actual safety and business impact determine priority. Policies should support necessary work and constrain unnecessary paths, rather than reproducing broad trust under new labels.
Defense in Depth
Use Different Controls at Different Points, and Consider Shared Failure Causes
Defense in depth combines safeguards with different purposes at different points. Perimeter filtering can reject some unwanted exposure. Segmentation limits onward reachability, while identity controls constrain account use. Host hardening and patching reduce vulnerable execution and provide additional protection. Application checks govern actions and reduce exploitable behavior. Data permissions, protected communication, and tested backups address reading and recoverable loss. Consider what remains effective when an earlier layer fails. A second edge filter can add value or redundancy at that point. It does not compensate for unrestricted interior access, weak accounts, or unpatched hosts. Shared credentials, administration, configuration, or dependencies can defeat several layers together. Layering manages failure and reduces consequences, while not guaranteeing that every layer fails independently.
Manufacturer Scenario
Separate Office Work, Public Services, Visitors, Records, Machinery, and Management
The manufacturer begins with office computers, payroll, a public website, visitors, and factory machinery on one flat network. A replacement separates visitor wireless and limits it to the approved internet path. Office devices receive needed business services, without direct payroll-database or machinery-control access. The public website belongs in a DMZ with narrow required application connections. Restricted records and payroll accept named application requests with suitable account permissions. Factory systems permit necessary operational communications and controlled maintenance. Management and backup control accept approved administrative devices and limited supported actions. Refuse unrelated paths by default, while validating essential business flows. Management compromise may influence many systems, and machinery compromise may threaten physical operations and people. Review actual dependencies, emergency access, restoration paths, and safety consequences. The most damaging zone depends on this plant, rather than a universal ranking inferred from zone names.
Failure Review
Ask What an Intruder Can Still Reach When Each Control Fails
Review the design by assuming a particular control has failed. If edge filtering is bypassed, ask which internal and resource safeguards remain. If a password is stolen, examine appropriate multifactor protection, permissions, session controls, and account investigation. If a DMZ server is compromised, review onward paths and separate administration. If management is compromised, consider independent recovery and protected evidence. If monitoring misses an event, preserve uncertainty and seek other relevant sources. Follow necessary flows and examine correlated failures. Document the permitted path, enforcement point, owner, evidence, and remaining consequences. Test that intended work succeeds and unintended access is denied. Unusable restrictions can encourage unsafe workarounds, so use operational feedback and staged improvement. Security architecture is an ongoing practice that includes proportional monitoring and recovery, rather than a one-time promise.
Review
Explain Trust, Reachability, Failure Consequences, and Evidence
A strong firewall can coexist with allowed activity that exposes a password. Appropriate identity protection, limited permissions, segmentation, and records add safeguards beyond that edge. Zero trust grants justified access while removing automatic trust from location. A DMZ complements hardening by limiting exposure and onward reachability. Another edge filter can help that layer, while leaving other kinds of protection necessary. Adequate logs support detection and reconstruction without guaranteeing a complete history. Applicable obligations and evidence quality still determine what conclusions can be drawn. For each likely failure, explain which resources and people remain exposed. Identify independent safeguards and realistic recovery options that still function. Permit intended communication, protect data and availability, and maintain proportionate evidence. Revisit assumptions whenever users, devices, applications, partners, or business needs change.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Fundamental Concepts of Network Protection
What are the core goals of network security?
What is the perimeter or castle-and-moat security model?
What does zero trust mean in network security?
What is a DMZ in network security?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →