Security basics: threats, CIA and AAA

Why security is part of networking

A network that works but is not secure is a liability. One stolen password can let someone read customer data, change a router so traffic goes the wrong way, or switch off a service that thousands of people depend on. Network engineers are often the first to notice odd traffic, so security is part of the job, not a separate one.

Five words you must know

The CIA triad

Every security control protects one or more of three things. Confidentiality means only the right people can read the data (encryption, access control). Integrity means the data is not changed without anyone noticing (hashes, digital signatures). Availability means the service is up when people need it (redundant links, protection against floods of traffic).

Common threats, and how they are stopped

Defence in depth

Defence in depth means several independent layers, so one failure does not open everything. A typical stack: a firewall at the edge, ACLs between VLANs, port security on access ports, strong logins on devices, encrypted management, patched systems, logging, and trained users. An attacker who gets past one layer meets the next.

User awareness and training is a layer too, often the cheapest. Most real breaches start with a person clicking a link or sharing an OTP. Short, regular training and practice phishing tests reduce this a lot. Physical security also matters: a locked server room, a locked rack and a visitor register stop someone plugging a laptop into the core switch.

AAA: authentication, authorisation, accounting

• Authentication: who are you? Proving identity with a password, certificate or token.
• Authorisation: what may you do? For example, a junior engineer may run show commands but not change the configuration.
• Accounting: what did you do? A log of logins and commands, useful for audits and investigations.

Small networks keep usernames on each device (local AAA). Larger ones use a central AAA server, such as Cisco ISE, so one account works on every device and can be disabled in one place when someone leaves.

802.1X: port-based access control

802.1X stops a device using a switch port or Wi-Fi until it proves who it is. It has three roles. The supplicant is the client software on the laptop or phone. The authenticator is the switch or access point; it passes messages but does not decide. The authentication server, usually RADIUS, checks the credentials and tells the authenticator to allow or block the port. The messages use EAP (Extensible Authentication Protocol).

MFA and password policy

Multi-factor authentication (MFA) asks for two or more different kinds of proof: something you know (password), something you have (phone app, hardware key) and something you are (fingerprint). A stolen password alone is then not enough. A good password policy prefers long passphrases (12 or more characters), blocks common and leaked passwords, and avoids forcing changes every month, which makes people choose weak patterns. Current guidance, such as NIST SP 800-63B, says the same.

The law: practise only on your own lab

Learn attacks only to recognise and stop them. Practise on your own lab (Packet Tracer, GNS3, Cisco Modeling Labs) or on systems where you have written permission. Accessing or damaging someone else's computer or network without permission is an offence in India under the Information Technology Act, 2000 (Section 43 covers penalties and compensation, Section 66 covers computer-related offences), and similar laws exist in most countries.