Network Security Basics

What Network Security Controls Are and Why Analysts Need to Understand Them

• Network security controls are the gatekeepers between users, systems, and the internet. They enforce what traffic is allowed, what is blocked, what is logged, and what is inspected.
• Every SOC analyst reads firewall logs, triages IDS alerts, and interprets network telemetry daily. Understanding the control that generated the log is the difference between “the firewall blocked something” and “the firewall blocked a C2 callback on a port that should not be open.”
• This article covers the core network security concepts every analyst needs: firewalls (stateful vs stateless), ACLs (standard vs extended), security zones (trusted vs untrusted), egress filtering, and network segmentation strategies.

Firewall Types — Stateful vs Stateless vs Next-Gen

Stateless (Packet Filter) Firewalls

The simplest type. Inspects each packet in isolation — no knowledge of connection state.

Stateful Firewalls

Tracks the state of active connections. If a packet is part of an established connection, it is automatically allowed without re-evaluating rules.

Next-Generation Firewalls (NGFW)

Stateful inspection plus application-layer awareness — inspects packet payloads, not just headers.

ACLs — Access Control Lists

ACLs are ordered lists of permit/deny rules applied to network interfaces. Every packet is evaluated against the rule list top-to-bottom until a match is found.

Standard vs Extended ACLs

ACL Wildcard Masks vs Subnet Masks

Do not confuse wildcard masks with subnet masks. Wildcard masks are inverted subnet masks:

The implicit deny rule: Every ACL ends with an implicit deny all — even if not explicitly configured. If traffic does not match any rule, it is dropped. This is the most common reason analysts see blocked traffic that appears to match no rule.

Security Zones — Trusted, Untrusted, and DMZ

Network segmentation starts with security zones — logical groupings of systems with similar trust levels.

The cardinal rule of zone-based firewalls: Traffic between zones must be explicitly permitted. Nothing passes between zones by default — including traffic from Trusted to DMZ.

Egress Filtering — The Most Overlooked Security Control

Egress filtering controls outbound traffic from your network to the internet. Most organizations invest heavily in inbound filtering but leave outbound ports wide open — which is why C2 beacons on port 443 work so reliably.

Why Egress Filtering Matters

Minimum Egress Profile (Recommended)

Everything else should be blocked. If a business need exists, permit it with exceptions and log all matches.

Network Segmentation — Containment Through Architecture

Segmentation limits lateral movement by dividing the network into isolated segments. If an attacker compromises one segment, they cannot see or reach the others without traversing a firewall.

Common Segmentation Models

How Analysts Detect Segmentation Failures

SPL query — cross-segment traffic from user workstations to sensitive servers:

index=network sourcetype=firewall_log
| search src_ip=10.0.1.0/24 (users) AND dest_ip=10.0.100.0/24 (sensitive servers)
| stats count by src_ip, dest_ip, dest_port
| where count > 5
| eval alert = "Cross-segment traffic from user subnet to sensitive server — possible lateral movement"
| table _time, src_ip, dest_ip, dest_port, count, alert

SPL query — hosts sending traffic to unusual ports:

index=network sourcetype=firewall_log action=allowed
| search NOT dest_port IN (53, 80, 443, 123, 22, 3389)
| stats count by src_ip, dest_ip, dest_port
| where count > 20
| eval alert = "Outbound traffic on non-standard port"
| table _time, src_ip, dest_ip, dest_port, count, alert

Log Sources for Network Security Investigations

Related

• Common Ports and Protocols — covers the common ports and protocols concepts
• Log Sources Overview — covers the log sources overview concepts
• Metasploit — detection and response for T1203 techniques
• Nmap — how nmap helps detect and analyze threats
• RITA — detection and response for T1071 techniques

Sources

• Cisco — Understanding Access Control Lists (ACLs)
• Palo Alto Networks — Next-Generation Firewall Overview
• NIST SP 800-41 — Guidelines on Firewalls and Firewall Policy
• MITRE ATT&CK — T1040 (Network Sniffing)
• MITRE ATT&CK — T1046 (Network Service Discovery)
• AWS — VPC Flow Logs Documentation