Network security used to be a question of drawing a line and defending it. That model has not disappeared, but it has stopped being sufficient, and the organizations in the most difficulty are usually the ones still operating as though the line is the whole answer.
This article covers what network controls still do well, where the boundary model breaks, and what maintaining these controls actually involves once they are in place.
What changed, in the sources own words
The shift is not a vendor narrative. NIST records it plainly in its firewall guidance, observing that threats have gradually moved from being most prevalent in lower layers of network traffic to the application layer, which has reduced the general effectiveness of firewalls in stopping threats carried through network communications.
That sentence is worth reading carefully. It does not say firewalls stopped mattering. It says the threats moved to a layer where a traditional packet filter has less to say, which is an argument for changing what you expect of the control rather than for removing it.
The second shift is the disappearance of a single interior. Cloud services, remote work and supplier integrations mean that a large share of the traffic that matters never crosses the corporate perimeter at all.
Firewalls and the rule set nobody prunes
Firewalls remain the primary mechanism for controlling what can reach what. Their characteristic failure is not misconfiguration at build time but accumulation afterwards.
Rule sets grow because adding a rule solves an immediate problem and removing one risks breaking something nobody can identify. After several years a typical rule set contains rules for decommissioned systems, rules that duplicate each other, rules that are shadowed by a broader rule above them, and permissive rules added during an incident and never narrowed.
The discipline that helps is a periodic review with three questions per rule: what is this for, who owns it, and is the source and destination still as narrow as it could be. Rules with no identifiable owner are the useful finding, and the safe way to remove them is to log and observe before deleting.
Segmentation, the control that limits a bad day
Segmentation is the practice of dividing the network so that reaching one part does not mean reaching all of it. It is the control with the highest impact on incident severity, and the one most often deferred because it is disruptive to retrofit.
The value is concrete. An intruder who obtains a foothold on a user workstation in a flat network can attempt to reach every server. The same foothold in a segmented network can reach the services that segment is permitted to reach, and the attempt to reach anything else is both blocked and visible.
Useful boundaries are usually not departmental. The ones that pay are between user devices and servers, between production and non production, around systems holding regulated data, around management interfaces, and around anything an external party can reach. Operational technology and building systems deserve their own isolation and are frequently discovered attached to the corporate network by accident.
Retrofitting is genuinely difficult, which is why the pragmatic approach is incremental: start by isolating the highest value or highest risk segment rather than attempting a full redesign that will stall.
Remote access
Remote access is where the perimeter is deliberately crossed, which makes it the most attacked entry point in most organizations.
A virtual private network extends the network to a device, and that framing is the problem: a compromised laptop on a full tunnel is inside. Where the platform allows it, granting access to specific applications rather than to the network limits what a compromised endpoint reaches, which is the practical expression of the zero trust idea below.
Whatever the mechanism, three things are not negotiable. Multifactor authentication on the access itself, covered in identity and access management. Some assessment of the device before granting access, so that an unmanaged machine is not treated as a corporate one. And logging of sessions with enough detail to answer who connected from where, discussed in security monitoring and incident detection.
Supplier remote access deserves separate mention because it is routinely the weakest path: standing accounts, shared credentials, permanent connectivity for occasional support. Time bound, scoped and monitored access is the correction.
Detection on the network
Intrusion detection and prevention systems inspect traffic for known bad patterns. They retain value, with two honest caveats.
The first is encryption. Most traffic is now encrypted, and a sensor that cannot inspect it is reading envelopes. Decryption is possible and carries cost, complexity and privacy considerations that have to be decided deliberately rather than by default.
The second is that signature matching finds what is already known. It will not find a novel technique, and an organization relying on it alone is protected against last year.
What still works well is the metadata. Connection records, unusual destinations, volumes at unusual hours and internal traffic between systems that have no business communicating are all visible without decryption, and lateral movement is frequently more obvious in that data than in the payloads.
Wireless, DNS and the parts that get forgotten
Two network services carry more security weight than their profile suggests.
Wireless networks are frequently the least reviewed part of an estate. The recurring findings are a guest network that is not actually isolated from the corporate one, a legacy network kept alive for a handset or a printer using a weak authentication method, and a pre shared key that has not changed through several staffing generations. Enterprise authentication tied to the identity system, genuine isolation of guest traffic, and a periodic check of what is actually broadcasting address most of it.
Domain name resolution is both an attack path and one of the cheapest detection surfaces available. Almost everything an intruder does involves a name lookup, so logging resolution and filtering known malicious destinations catches activity that other controls miss, including the early stages of a ransomware deployment. Internal resolvers should be the only ones clients can reach, because a device configured to use an external resolver silently bypasses the filtering and the logging together.
Both are unglamorous, both are inexpensive relative to their value, and both are commonly discovered during an incident rather than before one.
Zero trust, stated accurately
Zero trust is the most oversold term in the field and has a precise meaning. NIST defines an architecture in which there is no implicit trust granted to assets or user accounts based solely on their physical or network location, and describes it as a set of principles applied to planning infrastructure and workflows rather than as a product.
Read that way it is a direction rather than a purchase. Being on the corporate network stops being a credential. Access decisions consider identity, device state and context, and are made per request rather than once at connection.
No organization completes this as a project. What is achievable is moving specific access paths onto that model, usually starting with remote access and administrative access, and being honest that the rest still runs on the older assumption.
Maintaining the controls
Every control above degrades without attention. Rule sets accumulate. Segmentation is breached by an exception made during a migration. Remote access exclusions are granted and not revisited. Sensors stop reporting and nobody notices, because a quiet sensor and a quiet network look identical.
The maintenance work is therefore unremarkable and continuous: rule review, configuration backup and comparison against baseline, certificate expiry tracking, firmware currency, and monitoring of the controls themselves. It is the same argument made throughout the managed cybersecurity lifecycle, and the configuration half is covered in security hardening and configuration management.
Where the network ends
A closing caution. In an environment using cloud services heavily, a diminishing share of the interesting traffic passes through anything the network team controls. Access to a software as a service application from a home network touches no corporate infrastructure.
That does not make network security unimportant. It makes it insufficient, and it moves weight onto identity, endpoint and cloud configuration controls, covered in endpoint and server security and cloud security. An organization investing exclusively in network controls while its data sits in platforms those controls never see is defending a building people have stopped entering.
LABUSA operates firewall policy, segmentation, remote access and network monitoring within LABUSA managed security operations.
Sources
- NIST, Guidelines on Firewalls and Firewall Policy, SP 800-41 Rev. 1.
- NIST, Zero Trust Architecture, SP 800-207, August 2020.
- NIST, Guide to Computer Security Log Management, SP 800-92.