Network Security Fundamentals

Module 1: Introduction to Network Security

• Network security goals: CIA triad in networking
• Network threat landscape: Passive vs. active attacks
• Common network attack types overview
• Network security architecture principles
• Defence in depth for networks

Module 2: Firewalls

• Firewall types: Packet filter, stateful, NGFW, proxy
• Cisco ASA and Firepower overview
• Palo Alto Networks NGFW basics
• Firewall rule design: Least privilege, deny by default
• DMZ architecture design

Module 3: Intrusion Detection and Prevention

• IDS vs. IPS: Passive vs. inline
• Signature-based vs. anomaly-based detection
• Snort: Rules, preprocessors, configuration
• Suricata: Performance and configuration
• IPS tuning and false positive reduction

Module 4: VPN Technologies

• VPN types: Site-to-site, remote access, MPLS
• IPSec: IKEv1, IKEv2, ESP, AH, tunnel vs. transport mode
• SSL/TLS VPN: Cisco AnyConnect, Fortinet SSL-VPN
• Split tunnelling: Benefits and risks
• Zero Trust Network Access (ZTNA) as VPN replacement

Module 5: Network Access Control (NAC)

• NAC concepts and enforcement models
• 802.1X: EAP methods, RADIUS, supplicant, authenticator
• Cisco ISE: Policy configuration and device profiling
• Guest access and BYOD policies
• Posture assessment and remediation

Module 6: Network Monitoring and Logging

• SNMP for network monitoring: Polling and traps
• NetFlow and sFlow for traffic analysis
• Syslog: Collection, centralisation, analysis
• Network monitoring tools: SolarWinds, PRTG, Zabbix
• SIEM integration for network logs

Module 7: Wireless Security

• WPA2 Enterprise: 802.1X and RADIUS integration
• Rogue AP detection and prevention
• Wireless IDS/IPS
• WLAN security policy
• Wi-Fi security audit tools

Module 8: Network Cryptography

• Symmetric encryption: AES, 3DES in network context
• Asymmetric encryption: RSA, ECC in PKI
• SSL/TLS: Handshake, cipher suites, certificate validation
• SSH: Key exchange, public key authentication
• IPSec cryptographic algorithms

Module 9: DDoS Protection

• DDoS attack types: Volumetric, protocol, application
• On-premise DDoS mitigation: Scrubbing, rate limiting, ACLs
• Cloud DDoS protection: Cloudflare, AWS Shield, Akamai
• BGP black-hole routing
• DDoS incident response

Module 10: Network Segmentation and Zero Trust

• Network segmentation strategies: VLANs, subnets, firewalls
• Micro-segmentation with SDN and NGFW
• Zero Trust network design principles
• Software-Defined Perimeter (SDP)
• BeyondCorp implementation concepts

Module 11: Network Security Compliance

• PCI DSS network security requirements
• NIST SP 800-41: Firewall guidelines
• CIS Controls for network security
• Network security auditing
• Network security policy writing

Module 12: Capstone Projects

• Design a secure network for a small enterprise
• Configure Snort/Suricata IDS rules for common attacks
• IPSec VPN site-to-site configuration in GNS3
• 802.1X lab with FreeRADIUS
• Certification preparation: CompTIA Security+, Cisco CCNA Security, CySA+

Experience in the Industry Learn from network security engineers with hands-on experience deploying firewalls, IDS/IPS, VPNs, and NAC solutions in enterprise and service provider environments.

Backgrounds at the Top Our instructors have held network security engineer and security architect roles at IT companies, telcos, and enterprise organisations, with certifications including CCNP Security, CompTIA Security+, and Palo Alto PCNSE.

Clear & Effective Teaching Network security technologies are taught with live firewall configuration labs, IDS rule writing exercises, and real packet capture analysis.

Hands-On Learning Focus Students configure firewalls, write Snort rules, set up IPSec VPN tunnels, and deploy 802.1X NAC in lab environments.

Up-to-Date Knowledge Instructors stay current with ZTNA adoption, updated PCI DSS v4.0 network requirements, new DDoS attack vectors, and the latest Palo Alto and Cisco security platform features.