Cyber Wiki Learning Path
Network Defense
Follow network communication from packets and protocols through segmentation, access control, monitoring, and secure remote access.
Recommended Sequence
84 connected entries
802.1X Network Access Control
802.1X Network Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Network security concept · BeginnerAddress Resolution Protocol (ARP)
Address Resolution Protocol (ARP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Secure automation · AdvancedAutomation Blast-Radius Control
Automation blast-radius control limits the systems, accounts, data, regions, and actions a script, pipeline, agent, or remediation job can affect.
Routing security · AdvancedBGP Route Security
BGP route security applies policy, filtering, validation, monitoring, and operational discipline to reduce accidental or malicious route announcements.
Availability control · IntermediateCloud DDoS Protection
Cloud distributed-denial-of-service protection combines provider-scale network defenses, traffic filtering, rate controls, resilient architecture, and response procedures.
Cloud service concept · IntermediateCloud Edge Services and Content Delivery
Cloud edge services place content, acceleration, routing, filtering, or application functions closer to users and devices.
Network security control · AdvancedCloud Egress Control
Cloud egress control limits and monitors outbound communication from workloads, users, and services to reduce exfiltration, command-and-control, and unauthorized dependency risk.
Network architecture · AdvancedCloud Hybrid Connectivity
Hybrid connectivity joins cloud environments with data centers, offices, edge locations, or other providers through VPNs, dedicated links, and routing services.
Hybrid connectivity · AdvancedCloud Interconnect Security
Cloud interconnect security protects dedicated and virtual connectivity between enterprise networks, cloud providers, exchanges, and software-defined interconnection services.
Network telemetry · IntermediateCloud Network Flow Logs
Cloud network flow logs record summarized connection metadata from virtual networks, interfaces, gateways, and security controls for monitoring, troubleshooting, and investigation.
Network security control · IntermediateCloud Network Segmentation
Cloud network segmentation separates workloads and services into controlled communication zones to limit exposure and lateral movement.
Infrastructure concept · IntermediateCloud Networking
Cloud networking connects workloads, services, users, data centers, and the internet through software-defined networks, routes, gateways, load balancers, name services, and provider backbones.
Network architecture · IntermediateCloud Networking with VPCs and VNets
Virtual private clouds and virtual networks create logically isolated address spaces, subnets, routes, interfaces, and gateways inside cloud environments.
Network architecture · IntermediateCloud Private Connectivity
Cloud private connectivity creates controlled paths between users, data centers, cloud networks, and managed services without exposing traffic directly through public endpoints.
Network control · IntermediateCloud Security Groups and Network ACLs
Security groups, firewall rules, and network access-control lists restrict traffic at resource, subnet, or network boundaries.
Network concept · IntermediateCloud Subnets, Routes, and Gateways
Cloud subnets divide address space, route tables determine forwarding, and gateways connect workloads to other networks or provider services.
Adaptive access control · AdvancedConditional Access for Hybrid Networks
Conditional access for hybrid networks combines identity, device, location, risk, application, and session context to make dynamic access decisions across cloud and on-premises resources.
Container security · IntermediateContainer Network Security
Container network security controls service exposure, east-west communication, port publishing, name resolution, administrative planes, and traffic policy across container hosts and clusters.
Network security concept · BeginnerDHCP Security
DHCP Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network service · BeginnerDHCP and IP Address Management
DHCP automates network configuration for clients, while IP address management tracks address plans, allocations, reservations, and ownership.
DNS security · AdvancedDNS Encryption and Resolution Security
DNS encryption and resolution security protect name-resolution traffic and resolver behavior while preserving authentication, policy, observability, and operational reliability.
Network security concept · BeginnerDNS Resolution Process
DNS Resolution Process describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network security concept · IntermediateDNS Security
Domain Name System security protects the naming process that maps human-readable names to network information and directs clients toward services.
Network security concept · BeginnerDNS Security Extensions (DNSSEC)
DNS Security Extensions (DNSSEC) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Networking concept · FoundationalDNS and DHCP
DNS maps names to network resources, while DHCP supplies devices with addressing and configuration information needed to participate on a network.
Network security concept · BeginnerDemilitarized Zones
Demilitarized Zones is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Messaging security concept · AdvancedEmail Authentication and DNS Security
Email authentication and DNS security combine DNSSEC, SPF, DKIM, DMARC, TLS, certificate validation, and resolver protections to reduce spoofing, tampering, and delivery abuse.
Cloud concept · BeginnerEssential Characteristics of Cloud Computing
The essential characteristics of cloud computing describe the operating behaviors that distinguish cloud services from ordinary hosting.
Network control · BeginnerFirewalls
Firewalls enforce network communication policy by allowing, denying, inspecting, or recording traffic between defined security zones and endpoints.
Network security concept · BeginnerForward Proxies
Forward Proxies is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerHTTP and HTTPS
HTTP and HTTPS describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Network security · IntermediateHost Firewall Policy
Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
Systems security concept · IntermediateHost-Based Firewalls
Host-Based Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network architecture · AdvancedHybrid Network Architecture
Hybrid network architecture connects on-premises, cloud, edge, remote, and third-party environments through explicitly designed zones, routes, identities, controls, and failure domains.
Networking concept · FoundationalIP Addressing and Routing
IP addressing and routing explain how hosts identify network locations and how routers select paths that move packets between local and remote networks.
Network security concept · BeginnerIPv6 Neighbor Discovery
IPv6 Neighbor Discovery is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Protocol security · AdvancedIPv6 Security
IPv6 security applies secure architecture, filtering, neighbor-discovery protections, address management, monitoring, and transition controls to IPv6 traffic.
Network security concept · BeginnerInternet Control Message Protocol (ICMP)
Internet Control Message Protocol (ICMP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Detection control · IntermediateIntrusion Detection and Prevention
Intrusion detection systems identify suspicious activity, while intrusion prevention systems can also block or disrupt traffic that matches defined conditions.
Connected-device network control · IntermediateIoT Network Segmentation
IoT network segmentation places connected devices into controlled zones and communication paths according to function, trust, ownership, and consequence so compromise of one device does not provide unrestricted access to users, servers, management systems, or other devices.
Platform security practice · AdvancedKubernetes Security
Kubernetes security protects the cluster control plane, nodes, workloads, images, network paths, secrets, and administrative interfaces.
Networking foundation · FoundationalMAC Addresses
A media access control address is a link-layer identifier used by network interfaces and local network technologies to deliver frames within a broadcast domain.
Administrative access control · AdvancedManagement Plane Security
Management plane security protects the interfaces, protocols, identities, networks, and workflows used to configure infrastructure and security systems.
Network storage security · IntermediateNFS Security
NFS security protects shared Unix-style filesystems through controlled exports, identity mapping, network restrictions, transport protection, least privilege, and careful handling of root access.
Access control · IntermediateNetwork Access Control
Network access control evaluates who or what is connecting and applies an access decision based on identity, device posture, location, role, and policy.
Network design · IntermediateNetwork Address Planning
Network address planning allocates IPv4 and IPv6 space so networks can scale, summarize routes, isolate environments, avoid overlap, and support operations.
Network security concept · BeginnerNetwork Address Translation (NAT)
Network Address Translation (NAT) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Architecture assurance · AdvancedNetwork Architecture Validation
Network architecture validation proves that a design and its implementation satisfy documented business, technical, security, compliance, availability, and operational requirements.
Detection capability · IntermediateNetwork Detection and Response
Network detection and response uses traffic, flow, protocol, and metadata observations to identify suspicious behavior and support investigation across network boundaries.
Routing architecture · AdvancedNetwork Route Resilience
Network route resilience ensures that routing converges safely through link, device, provider, and policy failures without creating loops, blackholes, or uncontrolled paths.
Architecture control · IntermediateNetwork Segmentation
Network segmentation separates systems and traffic into controlled zones so access can be constrained, monitored, and aligned with risk.
Network security concept · BeginnerNetwork Segmentation and Microsegmentation
Network Segmentation and Microsegmentation is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerNetwork Time Protocol Security
Network Time Protocol Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Infrastructure security · IntermediateNetwork Time Security
Network time security ensures systems receive accurate, resilient, and authenticated time appropriate to their operational and security requirements.
Network monitoring concept · AdvancedNetwork Traffic Analysis
Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
Security operations practice · IntermediateNetwork Traffic Flow Records
Network Traffic Flow Records is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network storage security · IntermediateNetwork-Attached Storage Security
Network-attached storage security protects shared file appliances through hardened management, segmented data access, strong identity, protocol controls, snapshots, monitoring, and recoverable configuration.
Deep learning · FoundationalNeural Network Fundamentals
A neural network transforms inputs through weighted layers and nonlinear functions that are adjusted during training.
Operational technology architecture · AdvancedOPC UA Trust Management
OPC UA trust management governs application identities, certificates, trust lists, security policies, endpoint configuration, and lifecycle actions for industrial data exchange.
Network model · BeginnerOSI Model
The OSI model organizes network communication into seven conceptual layers, from physical transmission through user-facing application services.
Operational technology monitoring · AdvancedOT Network Monitoring Baselines
OT network monitoring baselines describe expected devices, peers, protocols, commands, direction, timing, volume, and maintenance behavior so meaningful deviations can be investigated.
Operational technology architecture · AdvancedOT Network Zones and Conduits
OT zones group assets with similar function, trust, criticality, and security requirements, while conduits define and control the communications allowed between them.
Operational technology security · AdvancedOT Wireless Security
OT wireless security controls radio-based monitoring, control, maintenance, telemetry, and backhaul across technologies with different range, bandwidth, reliability, and security properties.
Service management · IntermediatePCI Segmentation Validation
PCI segmentation validation demonstrates that controls intended to isolate the cardholder data environment are correctly designed, implemented, maintained, and resistant to bypass.
Security operations practice · IntermediatePacket Capture and PCAP Analysis
Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Infrastructure analysis technique · AdvancedPassive DNS Analysis
Passive DNS analysis uses historical domain-to-address observations to examine infrastructure changes, relationships, reuse, and timing without directly querying adversary systems.
Operational technology security · AdvancedPassive OT Asset Discovery
Passive OT asset discovery infers devices, roles, communications, protocols, and changes from observed traffic without actively interrogating sensitive control equipment.
Network security concept · BeginnerPort Address Translation (PAT)
Port Address Translation (PAT) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network reference · BeginnerPorts and Protocols
Ports help identify application services at transport endpoints, while protocols define the rules systems use to exchange information.
Identity and access concept · IntermediateRADIUS and TACACS+
RADIUS and TACACS+ is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerReverse Proxies
Reverse Proxies is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Application defense concept · AdvancedRuntime Application Protection
Runtime application protection observes and constrains application behavior while software is executing.
Network architecture concept · AdvancedSASE, SD-WAN, and Software-Defined Networking
SASE, SD-WAN, and software-defined networking separate policy and control from traditional appliances, enabling distributed connectivity and security while increasing dependence on identity, orchestration, and provider controls.
Architecture practice · IntermediateSecurity Control Placement
Security control placement determines where a preventive, detective, responsive, or recovery mechanism must sit in the architecture to see, decide, and act on the intended behavior.
Network detection concept · AdvancedSnort and Suricata Rules
Snort and Suricata rules describe network traffic conditions that an intrusion detection or prevention engine can alert on, record, reject, or otherwise handle using protocol, flow, content, metadata, and state-aware inspection.
Network security concept · BeginnerStateful and Stateless Firewalls
Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Network security concept · BeginnerTCP Three-Way Handshake
TCP Three-Way Handshake describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Networking concept · FoundationalTCP and UDP Communication
TCP and UDP provide different transport behaviors: TCP emphasizes connection state and reliable delivery, while UDP favors low overhead and application-managed reliability.
Network model · BeginnerTCP/IP Model
The TCP/IP model groups the protocols that support modern internetworking into practical layers for link access, internet routing, transport, and applications.
Network security concept · BeginnerVirtual LANs (VLANs)
Virtual LANs (VLANs) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Virtualization security · IntermediateVirtual Network Security
Virtual network security applies segmentation, traffic policy, monitoring, address controls, and management separation to software-defined switches, interfaces, overlays, and workload networks.
Secure connectivity · BeginnerVirtual Private Networks
A virtual private network creates a protected communication path across an untrusted or shared network for users, sites, or systems.
Host firewall control · IntermediateWindows Defender Firewall
Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
Network security concept · BeginnerWireless Network Security
Wireless security protects radio-based network access through strong authentication, encryption, secure configuration, monitoring, and controlled coverage.