L8. Network Security: Firewalls, IDS/IPS & Segmentation
Course outlineLesson 8 of 20
Network security controls form the first layer of defense for most organizations. This lesson covers firewall types, intrusion detection vs prevention, and the segmentation techniques that limit attacker movement.
Firewall Types
| Type | How It Works | Key Limitation |
|---|---|---|
| Packet-filtering | Checks IP headers and port numbers; stateless | Cannot track connection state; easy to spoof |
| Stateful | Tracks connection state table; allows return traffic automatically | Cannot inspect payload content |
| Application-layer / proxy | Inspects payload content; understands protocols | Performance overhead; higher cost |
| WAF (Web Application Firewall) | Inspects HTTP/HTTPS; blocks OWASP Top 10 attacks | Application-specific; not a general network firewall |
| NGFW (Next-Gen Firewall) | Combines stateful + application inspection + IPS + threat intel | Complex to configure |
IDS vs IPS
IDS (Intrusion Detection System): passive or out-of-band monitoring. Generates alerts but does not block traffic. False positives waste analyst time but do not affect availability. IPS (Intrusion Prevention System): inline; can block malicious traffic in real time. False positives can block legitimate traffic, affecting availability.Both use two detection methods:
- Signature-based: matches known attack patterns; fast but misses zero-days
- Anomaly-based: detects deviations from a baseline; catches unknowns but generates more false positives
Network Segmentation
Segmentation limits the blast radius of a breach by preventing lateral movement. DMZ (Demilitarized Zone): a network segment between two firewalls that hosts public-facing servers (web servers, mail servers). Isolates them from the internal LAN. VLANs: logical network segmentation using switch configuration. Devices on different VLANs cannot communicate without going through a router or firewall. Micro-segmentation: fine-grained east-west traffic controls within a data center or cloud environment. Used in Zero Trust architectures to isolate individual workloads. Exam tip: An IDS is better when you cannot afford false-positive blocking. An IPS is better when speed of response matters more than the risk of blocking legitimate traffic.
- ✓Stateful firewalls track connection state; packet-filtering firewalls only check IP headers and ports
- ✓IDS detects and alerts (passive); IPS is inline and actively blocks malicious traffic
- ✓Signature-based detection catches known threats; anomaly-based detects deviations from baseline (catches zero-days)
- ✓DMZ places public-facing servers between two firewalls, isolating them from the internal corporate network
- ✓Micro-segmentation controls east-west (lateral) traffic between workloads, limiting an attacker's ability to move inside the network
1. A security team wants to block SQL injection attacks targeting a web application without replacing their existing network firewall. Which technology should they add?
2. Which type of intrusion system is deployed inline and can automatically block malicious traffic in real time?
3. A company places its web servers and email servers in a network segment that sits between two firewalls, isolated from the internal corporate LAN. What is this segment called?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.