Defending the Network: Security Strategies and Techniques

UPI Study › Courses › System Analysis and Design › Free lessons › Lesson 8.5 Free with a free account

Defending the Network: Security Strategies and Techniques

System Analysis and Design · Chapter 8: Maintenance, Risk, and SecuritySection 8.5 · lesson 57 of 698 min · free with a free account

← Types of Information Security ProtocolsNext lesson: Multi-Layered Systems Security: Firewalls, Encryption, Authentication, and Data Center Protection Strategies →

Earn 3 college credits for System Analysis and DesignRecommended for credit by NCCRS · Computer Science 390 · self-paced · one payment, lifetime access
Enroll in System Analysis and Design · $250 →Download the syllabus (PDF)

In this lesson

Threats, IDS and IPS, segmentation, VPNs, zero trust, patching, and incident response.

  • Identify malware, denial of service, phishing, and man-in-the-middle attacks
  • Distinguish an intrusion detection system from a prevention system
  • Explain segmentation, VPNs, and zero trust
  • Describe patch management and the incident response lifecycle

Transcript

Everything said in the video, section by section (1,074 words). Read along, or search it.

Maintenance, Risk, and Security

Defending the Network

A network is under constant pressure, so defending it takes more than one technique. This section covers the common threats, the tools that detect and block them, and three ways of structuring a network to limit damage. Then the two ongoing processes that hold it all together, patch management and incident response.

Common Threats

4 Shapes Threats Take

Defending a network starts with recognizing the shapes threats commonly take. Four categories cover most of them. Malware is malicious software, including viruses, worms, ransomware, and spyware. It is built to damage a system, disrupt it, or gain unauthorized access, often so the device can be controlled, or used to steal information. A denial-of-service attack overwhelms a system with traffic or requests, until it can no longer respond to legitimate users. A distributed attack floods it from many sources at once. Phishing is a deceptive message, often an email, that impersonates a trusted source. An email that looks like it came from your bank, asking you to confirm your login on a linked page, is phishing. It targets the person, not the technology. And in a man-in-the-middle attack, an attacker secretly intercepts, and may alter, communication between two parties who think they are talking directly. The aim is to read or tamper with data in transit, such as credentials sent over an unsecured connection.

IDS and IPS

Detect and Alert, or Block Inline

Two kinds of system watch the network for attacks. An intrusion detection system, or I D S, monitors a copy of the traffic, outside the direct path. When it finds a known attack pattern or suspicious activity, it alerts an administrator. It watches and reports, but does not act on its own. An intrusion prevention system, or I P S, sits inline, directly in the path of live traffic. It can block or reject suspicious traffic automatically, in real time. The trade-off is false positives. A false alert from an I D S is simply reviewed and dismissed. But an I P S acting on a false positive can block legitimate traffic. So where wrongly blocking traffic is unacceptable, an organization may choose an I D S, letting a person review before anything is blocked.

Figure 8.5a

Network Segmentation

Network segmentation divides a network into smaller, isolated zones. On the left is a flat network. Guest Wi-Fi, employee workstations, and the finance database all share one space. A breach that starts at the guest Wi-Fi can reach every other system, following the red dashed arrows. On the right, the same three systems sit in separate zones, each behind a firewall boundary. The same breach at the guest Wi-Fi is stopped at the boundary, marked with an X. It cannot reach the workstations, or the finance database.

Containing and Protecting Traffic

Segmentation and VPNs

So segmentation means a breach in one zone does not automatically grant access to everything else. Sensitive systems, such as a finance database, sit in their own zone, separated from general traffic by a firewall. It also makes monitoring easier, because traffic within one zone can be watched and understood on its own terms. A virtual private network, or V P N, creates an encrypted tunnel across a public or untrusted network, such as the internet. Traffic in the tunnel cannot be read or altered by anyone intercepting it along the way. Remote employees use a V P N to reach company resources. A site-to-site V P N connects two office networks the same way. Now imagine a company that keeps its finance database in the same zone as its guest Wi-Fi. The most direct fix is segmentation, giving the finance database its own isolated zone.

Zero Trust

Never Trust, Always Verify

Traditional perimeter security works like a castle and a moat. Once a device or user is inside the perimeter, usually past a firewall, it is implicitly trusted to reach most of what is inside. The zero trust model rejects that assumption. Its principle is, never trust, always verify. Every access request is verified, based on identity, device health, and context, whether it comes from inside or outside the perimeter. Perimeter security verifies mainly once, at entry. Zero trust verifies continuously, for every request. The difference matters most when an internal device is compromised. Under perimeter security, it can often move freely once inside. Under zero trust, it still has to verify its access to each resource, one by one. That is why zero trust is a shift in the underlying assumption, not just an extra layer on the old model.

Patch Management

Closing Known Holes First

Patch management is the ongoing process of identifying, testing, and applying updates that fix known vulnerabilities. Many real breaches exploit a vulnerability for which a patch already existed, but had simply not been applied. That makes patch management one of the highest-leverage security practices an organization runs. A disciplined process starts with an inventory of what is running where. It prioritizes critical security patches. It tests a patch before deploying it widely. And it tracks compliance, so gaps are visible, rather than assumed away.

Figure 8.5b

The Incident Response Lifecycle

Incident response is the organized process an organization follows once a security incident is detected. It aims to contain the damage, remove the threat, and return to normal operations. And it runs as a cycle. It begins with preparation, being ready before anything happens. Then detection and analysis, spotting the incident, and understanding what it is. Then containment, limiting the damage, followed by eradication, removing the threat. Then recovery, returning to normal operations. And finally, lessons learned. Those lessons feed directly back into preparation, so the organization is better ready for the next incident.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. Phishing deceives a person into giving up credentials. A man-in-the-middle attack intercepts traffic between two parties. An I D S detects and alerts. An I P S sits inline and blocks. Network segmentation divides a network into isolated zones that contain a breach. A V P N is an encrypted tunnel across an untrusted network. Zero trust verifies every request, regardless of location. And patch management finds, tests, and applies fixes for known vulnerabilities.

Key Takeaways

What to Carry Forward

To pull this together. Malware, denial-of-service attacks, phishing, and man-in-the-middle attacks are four common categories of network threat. An I D S detects and alerts. An I P S sits inline, and can block malicious traffic automatically. Segmentation contains a breach to one zone, and a V P N encrypts traffic crossing an untrusted network. Zero trust verifies every request individually, rather than trusting devices simply because they are inside the perimeter. And patch management closes known holes, while incident response is a cycle whose lessons strengthen the next round of preparation.

About System Analysis and Design at UPI Study

System Analysis and Design (Computer Science 390) is a self-paced online course of 69 video lessons in 9 chapters, from the analyst's role and requirements to UML modeling, interface and database design, testing, maintenance and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take System Analysis and Design with UPI Study

From business problem to working systemSystem Analysis and Design teaches how analysts study a business need and turn it into a system design: requirements, UML and data-flow models, interface and database design, implementation and project management. It is a core course in information systems and IT degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

System Analysis and Design carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Defending the Network: Security Strategies and Techniques

What is the difference between an IDS and an IPS?
An intrusion detection system, or IDS, monitors a copy of network traffic and alerts an administrator, while an intrusion prevention system, or IPS, sits inline and can block suspicious traffic automatically. The trade-off involves false positives. A false IDS alert is simply reviewed and dismissed, but an IPS acting on a false positive can block legitimate traffic, so some organizations prefer human review first.
What is zero trust security?
Zero trust is a security model built on the principle of never trust, always verify. Every access request is checked based on identity, device health, and context, whether it comes from inside or outside the network. Traditional perimeter security trusts whatever gets past the firewall. Under zero trust, a compromised internal device still has to verify its access to each resource, limiting how far it can move.
Why is network segmentation important?
Network segmentation divides a network into smaller, isolated zones so a breach in one zone does not automatically reach the others. In a flat network, an attacker entering through guest Wi-Fi could reach employee workstations and a finance database. With segmentation, firewall boundaries separate those zones and stop the breach. Segmentation also makes monitoring easier, because traffic in each zone can be watched on its own.
What are the steps of the incident response lifecycle?
The incident response lifecycle runs through preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation means being ready before anything happens. Detection and analysis spot and understand the incident, containment limits the damage, and eradication removes the threat. Recovery returns operations to normal, and the lessons learned feed back into preparation for the next incident.

About the System Analysis and Design course

How many college credits is System Analysis and Design?
System Analysis and Design (Computer Science 390) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does System Analysis and Design cost and what is included?
$250, paid once, with lifetime access: all 69 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does System Analysis and Design take?
It is self-paced with no deadlines. The 69 lessons total about 9 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in System Analysis and Design.

69 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in System Analysis and Design →Download the syllabusEvery course with PRO →
System Analysis and Design
3 credits · NCCRSEnroll →