Network Security Controls: Types, Devices, and Policies

Technical Controls

Technology-based protections enforced by hardware/software.

Administrative Controls

Human-centered policies, procedures, and rules.

Physical Controls

Tangible protections to secure physical equipment.

Preventive Controls

Controls that stop incidents before they occur.

Detective Controls

Identify and alert when threats occur.

Corrective Controls

Fix or recover after an incident.

IDS (Intrusion Detection System)

Monitors traffic and alerts on suspicious activity.

IPS (Intrusion Prevention System)

Detects AND blocks threats in real time.

SIEM (Security Information and Event Management)

Collects & analyzes logs from multiple systems.

Firewall

A security device/software that monitors and filters traffic based on rules.

Hardware Firewall

A physical device at the network perimeter.

Software Firewall (Host-Based)

Installed on individual devices.

Cloud Firewall (FWaaS)

Firewall hosted in the cloud by a provider.

Virtual Firewall

Software firewall inside virtualized environments.

Stateless Firewall

Evaluates packets based only on header rules.

Stateful Firewall

Tracks connection states to make smarter decisions.

NGFW (Next-Generation Firewall)

Advanced firewall with deep packet inspection, IPS, app filtering.

WAF (Web Application Firewall)

Protects web applications from attacks.

DMZ (Demilitarized Zone)

A network segment that separates public-facing servers from the internal LAN.

VLANs

Logical LANs that group devices regardless of physical location.

Broadcast Domain

A group of devices that receive Layer 2 broadcasts.

Trunking

Method of tagging VLAN traffic so multiple VLANs can share 1 cable.

Subnet

A logical division of an IP network.

MAC Spoofing

Attacker changes MAC to impersonate a trusted device.

MAC Flooding

Overloads CAM table with fake MACs → fail-open mode.

Port Security

Limits which MAC addresses a switch port allows.

DHCP Snooping

Blocks rogue DHCP servers.

DAI (Dynamic ARP Inspection)

Validates ARP packets to stop ARP spoofing.

Network Access Control (NAC)

Controls which users/devices can join the network.

Physical Security

Locks, cages, cameras to protect hardware.

Firewall Configuration

Proper rules ensure only approved traffic enters.