What Is Network Security?

Network security used to mean defending a boundary. That model assumed the things worth protecting were inside, the threats were outside, and a controlled crossing point between them was where security happened.

Very little of that holds now. Applications are hosted elsewhere, staff work from anywhere, and the majority of serious incidents begin with a credential rather than an intrusion — meaning the attacker arrives through the front door, authenticated.

What the network layer is still for

The perimeter did not become worthless; it became insufficient. What the network still does well is constrain movement. An attacker who compromises one workstation has to reach something valuable, and whether they can is decided by network design.

That reframes the priority. Preventing entry is a shared responsibility across identity, email and endpoint controls. Limiting what an entry is worth is largely a network problem, and it remains the most reliable way to convert a compromise into an incident rather than a breach.

Where assessments consistently find problems

Flat internal networks, where any workstation can reach any server, any database and any management interface. Firewall rule sets accumulated over a decade with nobody able to say why a rule exists. Management interfaces reachable from user networks. And no egress control at all, so a compromised host can connect outward to anything.

Egress is the one most often overlooked. Inbound is scrutinised because it feels like the threat; outbound is where data leaves and where command-and-control traffic returns.

East-west visibility is the common blind spot

Most monitoring watches traffic crossing the perimeter. Traffic between internal systems — which is where an intrusion becomes a breach — frequently passes no inspection point at all, because in a flat network it never has to.

That is the quiet argument for segmentation beyond its preventive value: boundaries create places where traffic can be observed. A network with no internal boundaries has no internal visibility, and lateral movement is invisible by construction.

Flow records are the cheapest route to some coverage. They do not show content, and they show which systems talk to which, in what volume and when — which is enough to notice a workstation suddenly connecting to forty servers it has never touched.

A note on assumptions worth re-testing periodically: most network designs encode a belief about where the threat comes from. Where that belief was formed before cloud adoption, remote working and widespread credential theft, the design is defending a perimeter that no longer describes the organisation. Revisiting it explicitly is more productive than adding controls to an architecture whose premise has quietly expired.

A common mistake worth avoiding

Whatever else is on the list, the answer worth establishing first is the design assumption, which is that internal position implies nothing. It is a question that can be settled in a day, it requires no procurement, and the answer determines whether the rest of the programme is addressing the largest exposure or a smaller one that happened to be easier to see.

Where to start

Ask whether a compromised workstation in reception can reach your most sensitive database. If the answer is yes or nobody is certain, segmentation is the whole programme until it is no.

See micro-segmentation in practice. GuardsArm runs security program reviews.