Network Security: Firewalls, IDS/IPS, VPN, PKI and SIEM

Stateless filters evaluate available packet fields against policy. Stateful controls maintain flow context and timers, including pseudo-state for connectionless protocols. Actual rule evaluation and logging are implementation-dependent.

A permit event can mean a packet or flow matched policy; it is not proof that an application transaction succeeded. Capture the rule identifier, direction, interfaces, translated addresses, action and log semantics.

Proxies can terminate and originate connections. Application visibility depends on protocol support, encryption and inspection settings; proxy placement alone does not provide every payload.

NGFW features may include application classification, IPS, identity context and authorised TLS inspection. A WAF focuses on web requests under its integration mode. Neither product label guarantees every feature is enabled or effective.

TLS inspection changes trust and connection boundaries and can affect applications. Preserve policy, bypasses, certificates and relevant records under applicable privacy and access requirements. A log saying “inspected” does not guarantee full plaintext was retained.

A passive network IDS typically observes a copy through a tap or mirror, while inline IPS can act on transit traffic. Other deployments include host sensors and active response. Detection delay still matters even when a sensor is not inline.

Snort and Suricata support rule-driven inspection and other protocol processing. Suricata EVE can record alerts, anomalies, metadata and selected protocol information, according to configuration.

Zeek is a programmable network security monitoring system with protocol analysis, structured logs and detection logic. It is not limited to retrospective queries or devoid of signature-related capabilities.

Host and network sensors offer different views. Host visibility depends on collected event types and privileges; a network sensor’s encrypted-payload visibility depends on available secrets or appropriately exposed plaintext. Neither source sees everything.

A signature match, anomaly or extracted file is a lead to validate. Preserve the rule/version, input coverage, packet loss and relevant source record. False positives and negatives are possible for each detection model.

Compare alert timing with actual source events and ingestion delays. Absence of an alert does not establish absence of activity when a rule, sensor or data source was disabled or incomplete.

IPsec protects traffic at the IP layer under security associations and policy. Transport and tunnel modes protect different packet regions. AH does not encrypt and excludes or normalises relevant mutable header fields in its integrity calculation.

ESP can provide confidentiality and integrity/authentication under the selected algorithms and mode. Modern authenticated-encryption configurations combine functions; do not assume every historical ESP deployment has identical guarantees.

IKE establishes authenticated keying and association parameters under its actual version and configuration. Preserve identities, proposals, authentication method and tunnel endpoints. Protected inner traffic can differ from the outer addresses visible to a sensor.

TLS provides a security channel used by applications; it is not simply a separate OSI layer-4 wrapper. QUIC uses TLS for handshake/key establishment but has its own packet protection rather than ordinary TLS records around UDP streams.

TLS 1.3 removes older cipher/key-exchange choices and encrypts later handshake messages after ServerHello. A passive observer normally cannot read the server certificate in that encrypted handshake without suitable secrets.

Forward-secrecy claims need the selected mode: TLS 1.3 can use PSK-only key establishment without a fresh Diffie–Hellman exchange, and 0-RTT data has weaker replay/forward-secrecy properties than ordinary application data. Do not describe every TLS 1.3 byte as universally forward-secret.

Certificate-path, name, validity and policy checks depend on the verifier. Revocation and OCSP stapling behaviour varies; absence of a visible stapled response in a passive capture is not proof of an invalid session.

A VPN protects traffic between defined tunnel endpoints. Site-to-site, remote access and application proxy models provide different reach and identity controls; the word VPN does not guarantee that every application or DNS query uses the tunnel.

IPsec, OpenVPN, WireGuard and vendor-specific solutions differ in protocols, credential management and operational features. Select and interpret them using actual requirements, implementation and configuration rather than naming one universal best choice.

Encrypted tunnelling does not authenticate every remote service or make endpoints trustworthy. Split tunnelling, routes, local-network exceptions and logging affect the evidence available before, inside and after a tunnel.

TCP/443 can be permitted in many environments, but a VPN using it does not automatically traverse every filtering or application policy. Capture the negotiated connection and gateway configuration.

Provider disclosure, organisational access, retention and incident-reporting requirements vary by jurisdiction and sector. Keep named regulatory requirements in the legal-framework material rather than apply a country’s baseline to all VPNs.

For an incident, preserve authentication events, assigned addresses, session intervals, routing policy and supported endpoint records. A gateway account session does not alone identify the person operating it.

Authentication proves a claim under a particular mechanism; authorisation decides permitted access. A password, ticket, certificate or factor can be compromised or misused, so a successful authentication event is not a complete person-level attribution.

Kerberos uses a KDC to issue tickets and session material for services. A client commonly obtains a ticket-granting ticket and requests a service ticket. Preserve realm, principal, encryption, time and service context.

Authenticators, time limits and replay caches contribute to replay handling. Ticket theft and reuse are different from replaying an identical rejected authenticator. Clock tolerance is configurable; a common default is not a universal legal or technical constant.

LDAP is a directory-access protocol and does not carry Kerberos “on top” of it. Active Directory uses both for different functions. Directory object membership, account configuration and ticket activity need separate interpretation.

MFA combines appropriate factor categories; two passwords are not two factors. TOTP periods and digit lengths can be configured, and OTP/push methods can be phished. Properly deployed WebAuthn/FIDO credentials use relying-party binding, but overall account recovery and endpoint security still matter.

PKI links public keys to asserted identities under certificate policy. Validate path, intended usage, name, validity and applicable revocation requirements. A trusted root is a verifier configuration decision, not proof that every signed action was authorised.

Hardware tokens can reduce key-export risk under their design, but protection depends on implementation, configuration and access controls. A compromised host may misuse an available signing operation even if it cannot export the key. Avoid claiming one token class makes all attacks infeasible.

Segmentation restricts permitted paths when correctly enforced. A VLAN alone separates broadcast scope; routing policy, host access and management paths determine lateral access. A DMZ is not a guarantee that compromise cannot reach other systems.

Zero trust avoids implicit trust solely from network location or asset ownership. NIST SP 800-207 describes resource-focused policy and explicit access decisions; it does not require one particular proxy product or an identical per-packet user challenge.

NAC and 802.1X can control network admission under their deployment. Exceptions, pre-authentication traffic, posture rules and fallback modes must be checked. Passing admission is not blanket trust for every resource.

SIEM collection, normalisation, enrichment and correlation create derived views. Preserve raw events, parser/version, source timezone, collection time and mapping logic so normalisation does not conceal a changed meaning.

Rules and threat feeds can flag suspicious combinations, but an indicator match or behavioural score needs validation. Event time, ingestion time and alert time can differ significantly.

Retention tiers should meet actual investigative, operational and applicable legal needs. Searchable, archived and provider-retained data have different access and completeness. Do not assume every event from every device was ingested.

Document coverage gaps, disabled sources, sampling and failed queries. A long retention setting cannot recover data that was never logged or successfully collected.