Defensive Security Handbook, 2nd Edition

Chapter 16. Secure Network Infrastructure

When we talk about securing network infrastructure, we’re referring to the hardware and software that enables network connectivity, communication, operations, and management of business networks. This includes routers, switches, wireless access points (WAPs), cables, firewalls, network security devices, and management software often used for network orchestration.

When we think about securing our IT environments, it’s easy to focus our attention on application and operating system security while overlooking fundamental building blocks of an environment, such as the network infrastructure.

However, attacks against network infrastructure can have a very real business impact. The threats include denial of service (DoS) attacks, which cause unexpected outages, and man-in-the-middle attacks, where the attacker reroutes traffic on a network to a system they control, allowing them to intercept, inspect, and possibly modify it.

A solidly built network with proper segmentation, access controls, monitoring, and hardening will significantly hamper an attacker’s efforts to move laterally within a network or to exfiltrate data and help to keep them contained within a particular area of the network in the event that a breach should occur.

There are many books specializing in network security, of all shapes and sizes. In this brief chapter, we won’t dive deeply into every single aspect of how to secure a network; we’ll focus on the general concepts ...