Tech, ExplainedNetworking, infrastructure and security
Zone

Network security

The gate between staff and the internet.

Email security+Identity and access management (IAM)+Endpoint security+Network securityThe gate between staff and the internet.Next-generation firewall (NGFW)The gate every connection passes through.+Network detection and response (NDR)The attacker already inside, seen in the traffic.+SASE and SSEThe firewall moved into the cloud.+Micro-segmentationOne break-in no longer opens every door.+Network access control (NAC)Every device checked before it joins.+Web and API security+Cloud security+Application security+Data security+CONCEPTS IN THIS SCENEPhishingZero trustEndpoint agentLeast privilegeShared responsibility modelEncryptionData protection law (DPDP Act, GDPR)Non-human identityCVE (Common Vulnerabilities and Exposures)Shift left securityOpen-source dependenciesHard-coded secretsEmail security+Identity and access management (IAM)+Endpoint security+Network securityThe gate between staff and the internet.Next-generationfirewall (NGFW)The gate every connectionpasses through.+Network detection andresponse (NDR)The attacker already inside, seen inthe traffic.+SASE and SSEThe firewall moved into the cloud.+Micro-segmentationOne break-in no longeropens every door.+Network accesscontrol (NAC)Every device checked before it joins.+Web and API security+Cloud security+Application security+Data security+CONCEPTS IN THIS SCENEPhishingZero trustEndpoint agentLeast privilegeShared responsibility modelEncryptionData protection law (DPDP Act, GDPR)Non-human identityCVE (Common Vulnerabilities and Exposures)Shift left securityOpen-source dependenciesHard-coded secretsEmail security+Identity and access management (IAM)+Endpoint security+Network securityThe gate between staff and the internet.Next-generation firewall (NGFW)The gate every connection passes through.+Network detectionand response (NDR)The attacker already inside, seen in the traffic.+SASE and SSEThe firewall moved into the cloud.+Micro-segmentationOne break-in no longer opens every door.+Network access control (NAC)Every device checked before it joins.+Web and API security+Cloud security+Application security+Data security+CONCEPTS IN THIS SCENEPhishingZero trustEndpoint agentLeast privilegeShared responsibility modelEncryptionData protection law (DPDP Act, GDPR)Non-human identityCVE (Common Vulnerabilities and Exposures)Shift left securityOpen-source dependenciesHard-coded secrets
The zone holds the five products that guard a company's network: the next-generation firewall at the office edge, SASE and SSE in the security cloud, network access control at the moment a device joins, micro-segmentation between servers, and NDR watching the traffic inside.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

Network security is the set of products that guard a company's network: the connections between its staff, its offices, its machines and the internet. It covers the office firewall, the security cloud that staff connect to from home, and the tools that watch for an attacker who is already inside. It is one of the zones of enterprise cybersecurity.

For about thirty years, the main guard was one device at the edge of the office network. This device is the firewall. Every connection between the office and the internet passes through it, and it allows or blocks each one. The firewall also runs the VPN, the encrypted connection that lets staff reach the office network from home.

Then staff began to work from home, and the company's applications moved to the cloud. A firewall in an empty office protects very little. So the checks moved into the cloud as well. With SASE and SSE, every laptop connects first to a security company's cloud, wherever the laptop is. That cloud checks the user and filters the traffic. The idea behind it is zero trust: nobody is trusted just because they are on the company network.

Consider a pharmaceutical company in Ahmedabad with 800 staff. Its head office has a firewall. Its sales team works from home and from the road, through the security cloud. Two more products protect the inside of its network. Network access control (NAC) checks every laptop, phone and printer before it may join the office network. Micro-segmentation divides the network into small zones. So an attacker who breaks into one server cannot reach the server that holds the company's drug formulas. Finally, network detection and response (NDR) watches the traffic inside the network for signs of an attacker who has already got in.

Most of these products are sold through resellers and IT firms, not directly by their makers. This is called channel sales. The network itself, with its switches, routers and Wi-Fi, is covered under enterprise networking.

This zone guards the company's own staff and offices. Two neighbouring zones guard other things. Web and API security protects the website and apps that the company offers to the public. Cloud security checks the company's own part of the cloud, and the business software it rents.

In this zone

Next-generation firewall (NGFW)Network detection and response (NDR)SASE and SSEMicro-segmentationNetwork access control (NAC)

Concepts

Zero trustLeast privilegeChannel salesEncryptionCVE (Common Vulnerabilities and Exposures)Alert triage
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.