Introduction

Network security is no longer considered applicable only for technical personnel. Business owners must also understand the foundations of network security to protect their business online. While it can seem complicated, this article introduces you to the basics of network security for you to refer to when making essential cybersecurity decisions.

OSI model

Open Systems Interconnection framework defines how applications communicate over the network. It contains seven layers within the model, as shown below. Business owners need to understand this basic concept to truly understand how to protect their network from outside attacks.

Below we share two resources that explain this fundamental concept for absolute beginners. As with any field, understanding the fundamentals is crucial for developing a robust cybersecurity structure for your organization.

Types of Network Devices

Understanding the various network devices that build (or break) your network is needed to build a strong business network. Following are the main types of network devices you are likely to implement in your business environment.

Hubs

Hubs connect multiple area network (LAN) devices and also help amplify signals that might have deteriorated after traveling long distances. These devices operate on the Physical Layer and do not perform packet filtering or addressing functions.

Switches

These devices work on the Data Link Layer and are an upgraded version of Hubs. With various LAN devices connected, these devices read the packet headers and process the packets appropriately. Switches route the incoming packets to the correct destination by reading the hardware addresses on the packets.

Routers

Routers work on the network layer, remove packets from the incoming frames, and assign them IP addresses after analyzing them individually. They chart out the path for the data packets to travel through to their destination. From a network security standpoint, routers are most often targeted by hackers to gain network-wide access.

Bridges

These devices work on the Physical and Data Link layers of the OSI model. Their primary role is connecting two or more network segments and storing and forwarding frames between them.

Gateways

Gateways work on the Transport and Session layers of the OSI model and deal with the numerous protocols and standards from different vendors.

Types of Network Security Defenses

Now that you have a basic understanding of the OSI model and the various network devices that make your network, it is essential to learn about the primary defenses that protect your network from outside attacks.

Firewall

A firewall is the first line of defense of your network and has the job of isolating one network from another. It can be available in both software and hardware form. Some network appliances that separate two networks come pre-installed with Firewall. A firewall has the potential of filtering the network traffic and prevent malicious connection requests from being granted.

Spam Filters

Email is one of the most significant sources of cyberattacks. Over 90% of cyberattacks originate from a malicious link or attachment in an email. Business Email Compromise results in over $12 billion loss annually! An effective spam filtering will help you prevent common cyberattacks. They detect and prevent unwanted emails from getting to a user’s mailbox. Through policies and patterns, spam filters identify spam before they reach the user. As a business owner, implementing an effective spam filter will protect you against most cyber threats.

Intrusion Detection System (IDS)

An IDS spots a hacker or malicious software on the network and removes them promptly to prevent a cyberattack. Investing in a good IDS solution enables you to respond to attacks quickly in a far less costly way than recovering from the damage of a potential cyberattack.

Proxy Servers

Primarily used for traffic filtering and performance improvement, proxy servers act as negotiators for requests from client software seeking resources from other servers. It evaluates the request and then allows or denies it.

Anti-DDoS

These devices detect DDoS attacks in their early stage, preventing them from causing widespread damage to your servers and company websites.

Load Balancers

Load balancers are physical units that direct computers to individual servers in a network based on server processor utilization, number of connections, or overall server performance. Load balancers minimize the chance of a server being overwhelmed and optimizes the bandwidth available for each computer in the network.

Best Network Security Practices

Network Segmentation

Segregating your network into different zones is one of the most recommended network security practices. Creating different zones for various departments (Sales, Finance, Research, Guest) will allow you to manage your network efficiently and protect you from a massive cyberattack.

Network segregation can be done via router or switches or using vLAN.  An attacker must now compromise each network for a company-wide cyberattack, making hacking your network more cumbersome. This technique also increases the attacker’s exposure to being discovered.

You can even go one step further and implement the Zero Trust security model across your organization. Your network infrastructure is segregated into multiple sub-networks in this model, each with a next-generation Firewall. This technique is easier to implement than you think, as all modern switches and routers have firewall capabilities. They need to be turned on and properly configured.

Domain Whitelisting

Whitelisting only those domains that are needed for your work will allow you to decrease your attack surface. If users can not go to an untrusted website, it will prevent many hacking attempts. As most hacks start with a phishing attack, whitelisting will prevent a user from loading a malicious link in an email as it blocks communication with the hacker’s server.

Proxy Server

All outbound web access must be routed through an authenticating server where access can be controlled and monitored. A proxy server ensures that a person, not an unknown program, is requesting a connection with the outside world.

Network Address Translation

NAT complements a firewall and provides an extra layer of security for a network. Systems located outside the network have to go through the NAT boxes to reach internal networks. Since it connects multiple computers to the internet using one IP address, it confuses the attackers about which particular host they are targeting.

Don’t disable Personal Firewall

Each computer has a software-based firewall that works in the same as large firewalls – they filter out certain packets to prevent them from leaving or entering the system. While you might be tempted to disable them if you already have a network firewall, we recommend that you do not disable them. With a personal Firewall, you have the chance of protecting your resource from internal threats. For robust network security, you must protect your business resources from both external and internal threats.

Centralized logging and analysis

While hackers are notorious for staying under the radar, an organization must record suspicious logins and other computer events to look for anomalies. Logging will help you in reconstructing what happened during an attack and the steps you can take to improve your threat detection process and protect against this threat in the future. In Network Security, logging is one of the fundamentals that also allows you to comply with various governmental regulations and helps in forensic analysis.

Honeypots and Honeynets

As the name suggests, honeypots appear to be an attractive target but, in reality, are traps for attackers (both internal and external). For example, you might set up a server that seems to hold a financial database but is only fake records. As no real user accesses these honeypots, you can monitor any activity on it with great detail and limit hacker’s movement in the network. Similarly, honeynets are attractive networks that serve no real purpose but to confuse and distract the hacker. Network Security engineers have used these techniques to trap and contain hackers in networks.

Insider Threats

As mentioned before, robust network security requires protection from both outsiders as well as internal threats. Insider threats are one of the primary attack vectors for small businesses. Whether malicious or not, insider threats can cause severe damage to an organization. To protect against it, we recommend applying the principle of least privilege – only allowing just enough access permissions required for a user’s job. This practice will limit the movement of an internal user, limiting the damage they can cause.

Other recommendations include system hardening, anti-sniffing networks, and strong authentication. Monitor user behavior by using both network and host-based intrusion detection systems. Most of all, train your employees in cyber awareness to spot phishing emails and implement strong passwords with MFA.

Virtual Private Network

The pandemic has forced many offices to adopt remote working, and we can expect this trend to stay for the future. With employees accessing company resources from their home network, it provides ample opportunity for a cyber attacker to gain unlawful access to your resources. However, using a good and paid VPN is a perfect solution to protect communication with your distributed workforce. While VPN traffic can be slower than a typical network (as it encrypts data before sending), it is one of the best security solutions available for the new normal.

Automating Response to Attacks

As most small businesses don’t have dedicated personnel or resources for cybersecurity, automating network security tasks can dramatically reduce the response time while maintaining your security posture. Luckily, most network devices and software solutions can be configured to take action when an alarm is triggered automatically.

Actions like blocking IP addresses, terminating connections, observing and tracking intruders are some ways you can automate your network security and learn from incidents to improve your security posture.

Physical Security

All the above practices and devices are useless if the network devices are physically accessible to everyone. Ensure that you limit direct access to network equipment to only authorized personnel to prevent any changes to your network and security settings. Network security must not be compromised by a lack of physical security.

Conclusion

Network security can seem overly complicated and technical. As a business owner, you do not need to go into great depth in this field to protect your business from online attackers. A surface-level understanding, as introduced in this article, will be enough to protect your organizations against the most common cyber threats.

Remember, cybersecurity is a journey and not a destination. So small, consistent efforts will help you staying current in protecting your business from all sorts of cyber threats.