6Network security

• 6.1Secure protocols and VPN

  Covers IPsec (ESP, AH, IKE) with its transport/tunnel modes for encrypting and authenticating IP packets, TLS underlying secure web communication, SSL-VPN usable from a browser alone, site-to-site VPN connecting locations and remote-access VPN for remote workers, and NAT-T for passing IPsec through NAT.

• 6.2Perimeter defense

  Covers firewalls (packet filtering, stateful inspection, application gateway) that block unauthorized traffic at the network perimeter, IDS/IPS (signature-based and anomaly-based) that detect and block attacks, WAF protecting against attacks targeting web applications, UTM that integrates multiple functions, DMZ that isolates externally published servers, and proxies that mediate communication.

• 6.3Authentication, cryptography, and PKI

  Covers RADIUS for centralized network access authentication, EAP (EAP-TLS, PEAP) extending authentication methods, IEEE 802.1X and authentication VLAN for port-based access control, symmetric-key and public-key cryptography with their differing key handling, and digital certificates, PKI, and CAs that guarantee a peer's identity, plus hashing and digital signatures for tamper detection and authenticity proof.

• 6.4Attacks and countermeasures

  Covers DoS/DDoS (SYN Flood, reflection attacks, amplification attacks) that overwhelm a service with traffic, DNS cache poisoning that forges DNS responses, ARP spoofing that forges MAC addresses within a LAN and the resulting man-in-the-middle attack, port scanning used for reconnaissance, and the countermeasures DNSSEC, DHCP snooping, and sender domain authentication (SPF/DKIM/DMARC), plus zero trust and SASE, which assume no trusted perimeter.