3.2Unauthorized Access and Network Security Controls (FW/IDS/IPS/WAF, DMZ, Zero Trust)

Network security is not a matter of "put up one wall at the entrance and you are done." Which layer and unit of communication a mechanism inspects determines what it can effectively protect against. A firewall mainly judges allow/block based on the outer shape of traffic — IP addresses and port numbers — while a WAF goes further, inspecting the content of HTTP requests at the application layer. This section organizes each mechanism around the axis of "what does it look at, and what does it stop," and connects this to the more recent idea of zero trust, which does not assume perimeter defense is sufficient.

3.2.1The division of labor among firewalls, IDS, IPS, and WAF

• A firewall (FW) allows or blocks traffic according to predefined rules based on communication information such as IP addresses and port numbers (the header). Because it does not inspect the content (payload) of the traffic, an attack that rides over an allowed port (e.g. 80/443) passes through unimpeded — this is its limitation.
• An IDS (Intrusion Detection System) monitors network or host traffic and logs, detecting signs of an attack and notifying an administrator — it does not itself block anything (detection only). An IPS (Intrusion Prevention System) adds to IDS's detection capability by automatically blocking malicious traffic once detected. Whether it merely "detects and alerts" or "detects and actively blocks" is the key difference between IDS and IPS.
• A WAF (Web Application Firewall) inspects the content of HTTP requests/responses, detecting and blocking attacks against the web application layer such as SQL injection and XSS. Its value is that it can stop "attacks riding over a legitimate port (e.g. 443)" that a firewall would let through, because it inspects all the way up to the application layer. Distinguish the scope: FW covers the outer shape of traffic (IP/port); WAF covers the content (HTTP payload).

3.2.2DMZ, VPN, proxies, zero trust, and wireless LAN

• A DMZ (DeMilitarized Zone) is an intermediate network segment belonging to neither the external internet nor the internal LAN. Placing externally facing servers (web servers, mail servers, etc.) in the DMZ means that even if such a server is compromised, the attacker cannot directly reach the internal network (traffic to the internal LAN is separately restricted by a firewall). The design principle is: never place an externally facing server on the same segment as the internal LAN.
• A VPN (Virtual Private Network) builds an encrypted virtual dedicated line over a public network like the internet, protecting inter-site traffic and remote workers' access to internal resources. A proxy (proxy server) relays external communication on a client's behalf, providing roles such as access control (filtering harmful sites), centralized logging of traffic, and speed-up via caching.
• The zero trust approach does not assume "inside the corporate network is safe, outside is dangerous" (the traditional perimeter-defense premise); instead it starts from trusting nothing and verifies every access attempt each time. The background is that cloud adoption and the spread of remote work have blurred the very notion of a "boundary" to defend. The practical core is applying user authentication, device posture checks, and traffic encryption consistently, regardless of whether the access originates inside or outside the office.
• For wireless LAN security, avoid the weak WEP and WPA/WPA2 (TKIP) encryption schemes and use WPA3 (stronger encryption, improved resistance to offline dictionary attacks). Operationally, countermeasures include watching for a rogue access point (an "evil twin") impersonating a legitimate one, proper SSID management, and separating a guest network from the business network.

Trace an incident at an online retailer to see how network controls divide responsibility. An attacker used port 443 (HTTPS), a legitimate port used for normal business, to attempt SQL injection against the order form. The company's firewall judges rules based on IP address and port number combinations, so traffic to port 443 was allowed and passed straight through. But the WAF installed downstream inspected the content of the HTTP request and detected a suspicious SQL syntax pattern, automatically blocking that traffic. This shows that the firewall and WAF divide responsibility between the outer shape of traffic and its content, covering different layers. Meanwhile, the company's IDS, monitoring logs across the network, detected many similar requests arriving from the same attacker in a short time and alerted the administrator — but an IDS only detects; it does not automatically block, so the actual blocking was the WAF's job. Had the company deployed an IPS instead of an IDS, it might have automatically blocked traffic from that source IP the moment it was detected. Because the company's web server sat in the DMZ, even if the WAF had been bypassed and the web server compromised, a separate firewall rule would still prevent reaching the internal LAN holding the customer database — the layered design paid off by containing any cascading damage. Prompted by this incident, the company also decided to abandon the assumption that 'the internal network is safe' for remote workers accessing internal systems, moving instead to zero trust access control that verifies user authentication and device posture on every single access.

3.2.3Section summary

• FW = allow/block by IP/port; IDS = detection only; IPS = detection + automatic blocking; WAF = inspects HTTP content. These are distinct layers of coverage
• A DMZ isolates externally facing servers from the internal LAN to prevent a breach from cascading. VPNs and proxies protect, relay, and control traffic
• Zero trust verifies every access without assuming perimeter defense. Wireless LANs should use WPA3