Network Engineering Basics Part 9:

If you’re learning networking, security can feel like a giant topic. However, the good news is this: you don’t need to memorize every tool on day one. Instead, you just need the core concepts that explain how networks get attacked and how we reduce risk.

In this beginner-friendly guide, you’ll learn the most important network security fundamentals—written in the same simple style as the rest of the Relay Rack 1 series.

Quick Summary (What You’ll Learn)

In this article, you’ll understand:

• Why security starts with visibility and control
• The difference between threats, vulnerabilities, and risk
• How least privilege and segmentation reduce damage
• What firewalls, VPNs, MFA, and encryption actually do
• What to watch for: phishing, malware, brute force, and misconfigurations
• Simple security habits you can apply at home or at work

Why Network Security Matters

A network is like a roadway system for your data. Unfortunately, once a device is connected, it can also become a pathway for threats.

So, network security is the practice of protecting:

• Devices (laptops, phones, printers, servers)
• Traffic (what moves across the network)
• Accounts (who is allowed to connect)
• Data (what you’re trying to keep private)

Just as importantly, good security helps you keep services online—even when something goes wrong.

The Security Triangle: Confidentiality, Integrity, Availability (CIA)

A simple way to understand security is the CIA triad:

Confidentiality

Only the right people (and systems) should see the data.

Integrity

Data should not be modified without permission.

Availability

Systems and services should stay online when needed.

For example, ransomware attacks often hit availability, while data breaches hit confidentiality. Meanwhile, man-in-the-middle attacks can impact integrity.

Threats vs Vulnerabilities vs Risk

These three terms get mixed up a lot, so let’s simplify them:

Threat = something bad that could happen

Example: a hacker trying to break in.

Vulnerability = a weakness that makes the threat easier

Example: a weak password or outdated software.

Risk = how likely it is + how bad it would be

Example: an exposed admin login on the internet is high risk.

In other words, security is about lowering vulnerabilities so threats are less likely to succeed, which reduces risk.

Authentication vs Authorization

This is one of the most important concepts in all of IT.

Authentication = proving who you are

• Passwords
• Multi-factor authentication (MFA)
• Certificates / keys

Authorization = what you’re allowed to do

• Can you access the server?
• Can you change settings?
• Can you delete files?

So, you might authenticate successfully, yet still be blocked if you’re not authorized. That’s a good thing.

The Principle of Least Privilege

Least privilege means users and devices should have only the access they need, and nothing more.

For example:

• A guest Wi-Fi network should not access your NAS
• A normal user should not have admin rights
• A printer should not be allowed to reach the internet unless required

Because of that, if one account or device gets compromised, the attacker’s “blast radius” stays small.

Network Segmentation (Why It’s a Security Superpower)

Segmentation means separating your network into zones so not everything can talk to everything else.

Common segments include:

• User devices (laptops/phones)
• Servers and NAS devices
• IoT (cameras, smart devices)
• Guest Wi-Fi
• Management interfaces (switch/router admin)

This is usually done with:

• VLANs
• Subnets
• Firewall rules between networks

As a result, segmentation slows attackers down and limits how far malware can spread.

Firewalls and Rules (Allow vs Deny)

A firewall controls traffic using rules. Typically, rules can:

• Allow approved traffic (like web browsing)
• Deny risky traffic (like inbound attacks)
• Log events for review

A helpful beginner approach is:

• Default deny inbound
• Allow only what you need
• Log suspicious attempts

Even a basic home firewall becomes powerful when you keep the rules simple and intentional.

Common Attacks (Beginner-Friendly)

Here are the most common threats you’ll hear about:

Phishing

Tricks people into giving up passwords or running malware.

Because humans are often the weakest link, awareness matters.

Malware and Ransomware

Malicious software that steals data or locks systems.

Therefore, backups and patching are critical.

Brute Force Login Attempts

Repeated login attempts against SSH, RDP, VPNs, or WordPress.

As a result, strong passwords, MFA, and rate limiting help a lot.

Man-in-the-Middle (MITM)

Traffic is intercepted between two systems.

However, HTTPS and encryption reduce this risk.

Misconfiguration

Open services, exposed admin panels, default passwords, weak firewall rules.

In many environments, misconfiguration is the #1 real-world problem.

Encryption (What It Protects)

Encryption protects data so it can’t be read without the correct key.

You’ll see it in:

• HTTPS (TLS) for websites
• VPNs for secure remote access
• Wi-Fi security (WPA2/WPA3)
• Disk encryption (BitLocker, FileVault)

So, encryption protects confidentiality—even if someone captures the traffic.

VPNs and Secure Remote Access

A VPN creates an encrypted tunnel between your device and a private network. As a result, remote workers can connect securely without exposing internal services to the public internet.

A few best practices:

• Use MFA on VPN logins
• Avoid exposing RDP/SSH directly to the internet
• Restrict what VPN users can access (least privilege)

Logging, Monitoring, and Alerts

Security isn’t only about blocking threats—it’s also about noticing problems early.

Useful things to monitor:

• Failed logins
• New admin accounts
• Firewall denies and port scans
• DNS changes
• Devices joining the network unexpectedly

Even basic logs can help you answer: “What happened?” after an incident.

Patching and Updates (The Most Boring, Most Important Thing)

Outdated software is one of the easiest ways attackers get in.

So, keep these updated:

• Routers and firewalls
• Switch firmware (when applicable)
• Operating systems (Windows/macOS/Linux)
• Browsers
• WordPress core, themes, plugins

In addition, remove plugins or services you don’t use—because fewer moving parts means fewer weaknesses.

Backups (Your Safety Net)

Backups aren’t just for accidents—they’re also for security.

A strong backup strategy includes:

• At least one offline or immutable backup
• Regular testing (restores)
• Separate credentials (backup system shouldn’t share admin passwords)

If ransomware hits, backups can be the difference between a bad day and a disaster.

A Simple Home Network Security Checklist

If you want quick wins, start here:

• Change router admin password (no defaults)
• Turn on WPA2/WPA3, disable WEP
• Use a guest Wi-Fi for visitors
• Put IoT devices on a separate network if possible
• Enable automatic updates where you can
• Use MFA on important accounts (email, hosting, WordPress)
• Back up your website and important files

Even small steps add up fast.

Common Beginner Mistakes (So You Can Avoid Them)

• Exposing admin pages to the internet unnecessarily
• Reusing passwords across services
• Skipping updates “because it still works”
• Putting printers/IoT devices on the same network as sensitive systems
• Not testing backups

Instead, keep things simple and consistent. Security is a habit, not a one-time project.

What’s Next in the Series

You now understand the core security concepts that show up in every network.

In the next article, we’ll cover beginner tools like ping, traceroute, ipconfig/ifconfig, nslookup/dig, Wireshark, Nmap, and more—plus when to use each one.