Chapter 2 · Cybersecurity
2-2 Network Security Design
An organization's network holds confidential data — customer records, financial files, private messages. Attackers constantly look for a way in. A single lock on the front door is not enough: if it is picked, everything inside is exposed. So modern network security uses several layers, so that even when one defence is breached, the next one still protects the system.
Guiding question
How can an organization design its network so that, even if one defence is breached, the system stays protected?
Learning outcome. Explain the roles of firewalls, VPNs and DMZs in protecting a network, and describe defense in depth and zero trust — and why layered, verified access is stronger than a single barrier.
With a partner. Think about how a school building is kept safe — a gate, a locked office, a safe inside it. Ask: if someone got past the gate, what would still stop them? Now hold that idea. A network is defended the same way, and this lesson gives the parts their proper names.
1 · The role of firewalls
Firewall … a system installed at the entry/exit point of a network that allows or denies communication based on rules set in advance.
e.g., allow access to the web server, but deny direct external access to the database server.
2 · VPN (Virtual Private Network)
VPN … a technology that creates an encrypted virtual private line (tunnel) over the Internet, allowing safe connection to a network from a remote location.
Main uses:
① Remote work — connecting safely to an organization’s network from home or while away.
② Connecting branches — connecting offices in different locations safely.
Because communication content is encrypted when using a VPN, the risk of eavesdropping is reduced even when using public Wi-Fi.
3 · DMZ (Demilitarized Zone)
DMZ … an area where servers exposed to the external network (web servers, mail servers, etc.) are placed separately from the internal network.
By providing a DMZ, even if a public-facing server is attacked, damage to the internal network can be prevented.
Why not just put the web server inside? Because a web server has to be reachable by anyone on the Internet — that is its job. Anything reachable by everyone is the most likely thing to be broken into. Putting it in its own zone means a break-in there is as far as the attacker gets.
Defense in depth
Defense in depth … the concept of layering multiple security measures so that, even if one measure is breached, the next can still protect the system.
| Layer | Examples of measures |
|---|---|
| Layer 1: Network entry | Block unauthorised communication using a firewall |
| Layer 2: Communication path | Encrypt communication using a VPN |
| Layer 3: Server placement | Separate public-facing servers from the internal network using a DMZ |
| Layer 4: Endpoints | Install antivirus software and keep the OS updated |
Switch layers off, pick an attack, and send it. This is the lesson’s whole argument, and it is easier to see than to be told.
the four layers — switch them off and see
Unauthorised connection from the Internet
Try switching off just the firewall and sending attack 4. It still gets through — but it would have got through anyway, because malware on a USB stick never crossed the network. No single layer covers everything, and that is the entire argument for layering.
“Several layers are better than one” sounds so obviously right that it is easy to nod along and learn nothing. It is worth putting a number on it — partly to see how big the gain is, and partly because the arithmetic reveals the one condition the whole argument depends on.
🧮 Four layers, each imperfect — what gets through?
- 1
Suppose one defence is good but not perfect: it stops 90 attacks out of every 100. So 10% get past it.
Why this step: No real defence stops everything, and pretending otherwise is what produces a single-barrier design. Starting from “this will sometimes fail” is what leads to layering in the first place.
- 2
Add a second, different layer that is also 90% effective. Of the 10% that got past the first, it stops 90% — leaving 10% of 10%.
Why this step: The second layer never sees the 90 attacks the first one already stopped. It only ever works on the leftovers, which is why the effect compounds instead of adding.
Most people slip here: Do not add the percentages. Two 90% layers do not give 180%, which is meaningless. Each layer takes a tenth of what reaches IT, so the fractions multiply.
- 3
Work it out: 10% of 10% = 0.10 × 0.10 = 0.01 = 1%.
Why this step: One layer let 10 attacks in 100 through; two let 1 in 100 through. The second layer did not make things 10% better — it cut the failures by a factor of ten.
- 4
Now four layers — firewall, VPN, DMZ, endpoint protection: 0.10 × 0.10 × 0.10 × 0.10 = 0.0001, which is 0.01%.
Why this step: One attack in ten thousand instead of one in ten. Not one of those four layers had to be excellent; they only had to be different from each other, and there had to be four.
- 5
Now read the condition hiding in that multiplication: it only holds if an attack must pass through EVERY layer in turn.
Why this step: This is the important step, and it is where the arithmetic becomes honest. Multiplying assumes each layer gets its own independent chance to stop the attack. An attack that goes AROUND a layer never gives it that chance, and the sum silently stops applying.
Most people slip here: Go back to the demonstration above and send attack 4 — the USB stick — with every layer switched on. It still lands. Not because the firewall is weak, but because the malware never crossed the network, so the network defences were never in its path. 0.0001 was never its probability.
Where the comparison breaks down: A castle has one clear inside and one clear outside. A modern organisation has staff at home, files in the cloud and phones on the train — there is no wall to be inside of. That is why the perimeter model is not merely insufficient but increasingly meaningless, and why the next section replaces the assumption rather than adding to it.
This is exactly attack 4 in the demonstration above, at national scale. The defences were not defeated; they were bypassed, because every one of them was built to inspect things arriving over a network and the attack did not arrive over a network. It is the clearest possible argument for the book’s next point — that inside cannot be assumed safe.
The Stuxnet malware, analysed publicly from 2010 onward.
The concept of zero trust
Zero trust … a security concept meaning the system does not trust any communication, including from within the organization’s own network, and always verifies it.
e.g., even for access from inside the organization, identity verification and access permission checks are performed every time.
What it replaced, and why.
Conventional network security was designed around protecting a perimeter, on the premise that “inside the organization’s network is safe, and outside is dangerous.” But with the spread of cloud services and remote work, the boundary between “inside” and “outside” has become blurred, and designs that protect only the perimeter have become insufficient.
Zero trust is not a fifth layer.
Defense in depth is about how many barriers there are. Zero trust is about who you believe — and the answer is nobody, not even someone already inside. A network can have four layers and still trust everything on the inside; adding zero trust is a different decision from adding another layer.
How the real paper is built
The ministry sets half multiple choice and half written answer in every subject. The two halves are not the same skill. In the multiple-choice half you have to spot the wrong options quickly — and the wrong options are built out of the mistakes students really make. In the written half nobody gives you the answer to recognise; you have to produce it, in your own words, with a reason.
Practise both. Being good at one half and weak at the other costs you exactly half the paper.
- firewall
- — allows or denies communication at a network’s entry/exit point based on preset rules.
- VPN
- — an encrypted tunnel for connecting safely from a remote location.
- DMZ
- — a zone for public-facing servers, separated from the internal network.
- defense in depth
- — layering measures so one breach is not the end.
- zero trust
- — verify every access, including from inside.
- perimeter
- — the old “inside is safe” boundary that cloud and remote work have blurred.
Worked Example
(1) Mark each statement with ○ if it is true or × if it is false.
A A firewall allows or denies communication based on rules set in advance.
B Using a VPN can reduce the risk of eavesdropping even on public Wi-Fi.
C A DMZ is a system that exposes all servers to the outside.
D Defense in depth is the concept of layering multiple security measures.
(2) Match each description (a–c) with the choice that fits: A Firewall, B VPN, C DMZ.
a A technology that creates an encrypted virtual private line over the Internet for safe connection from a remote location
b An area where servers exposed to the outside are placed separately from the internal network
c A system that allows or denies communication based on rules set in advance
1 · Answer the following questions.
2(1) · Which is NOT an appropriate use of a VPN?
Mark ○ for each one that IS an appropriate use of a VPN, and × for the one that is not.
Connecting safely from home to an organization’s network
Connecting offices in different locations safely
Automatically deleting files infected with viruses
Encrypting communication content on public Wi-Fi
2(2) · For each measure, which layer of defense in depth does it belong to?
Match each description with the choice that fits it.
Blocking unauthorised communication with a firewall
Encrypting communication with a VPN
Installing antivirus software
Separating public-facing servers from the internal network using a DMZ
Think as an Engineer — Investigate & Decide
A company in your city is setting up its office network. It has a public website, staff who work from home, and confidential customer data. You advise on the security design.
1 · Collect data.
List the company’s three assets — public website, remote staff, customer database — and the main threat to each.2 · Rank the layers.
For this company, rank the four defense-in-depth layers (network entry, communication path, server placement, endpoints) from most to least critical, and justify your top choice.3 · Decide.
Recommend a design and give two reasons why layering is safer than a single firewall. In pairs, compare your designs and agree together on the strongest reason before you write it down. Give evidence for your answer.
In a New Context
Lesson Question — Answered
The lesson asked how to design a network so that one breach does not expose everything. The answer is layering. A firewall controls what enters and leaves the network; a VPN encrypts communication from remote locations; a DMZ separates public-facing servers so that an attack on them cannot reach internal data; and endpoint measures protect each device.
Because cloud services and remote work have blurred the line between “inside” and “outside”, zero trust adds a further principle: no access is trusted automatically, and every request is verified. Together, defense in depth and zero trust keep the network protected even when a single measure fails.
1 · Quiz yourself first.
Cover the Point! sections and say what a firewall, a VPN and a DMZ each do, name the four layers of defense in depth, and explain zero trust in one sentence.
2 · Read the passage and fill in the blanks.
To protect an organization’s network, it is important to combine multiple security measures. First, a ( a ) is installed at the entry/exit point of the network to block unauthorised communication based on rules. Web servers and other servers exposed to the outside are placed in a ( b ), separated from the internal network. To connect safely from outside, such as with remote work, communication is encrypted using a ( c ). The concept of layering multiple measures in this way is called ( d ).
3(1) · What is the most appropriate reason for providing a DMZ?
Mark each statement with ○ if it is true or × if it is false.
To improve communication speed.
To expose all servers to the outside.
To prevent damage to the internal network even if a public-facing server is attacked.
To automatically detect and remove viruses.
3(2) · Which most appropriately describes the concept of zero trust?
Mark each statement with ○ if it is true or × if it is false.
Access from within the organization’s network is safe, so verification is unnecessary.
A firewall alone is sufficient to protect the network.
No communication is trusted and it is always verified.
Only access from outside needs to be monitored.
Notice what the wrong options are. The first is the old perimeter assumption, and the last is a softer version of it. Both sound reasonable, and both are exactly what zero trust exists to reject — which is why this question is worth reading twice.
Reflect: Which layer of defense do you think is easiest for an attacker to get past, and why?
Challenge: Suggest one measure a small company could add beyond a firewall, and one threat it would still not remove.
Sign In to Keep Going
You've reached the end of the free preview. Sign in — and upgrade to Plus or Pro — to keep going with Programming and Artificial Intelligence.
Full Access
Unlock all 30 lessons