Network security is the collection of technologies, policies, processes and practices used to protect networked systems, communications and services from unauthorised access, disruption, interception, misuse and attack. It encompasses controls that protect traffic moving between systems as well as controls that regulate which systems can communicate. Network security can apply to local-area networks, wide-area networks, wireless networks, data-centre networks, cloud environments, internet connections and hybrid infrastructures.
Common technologies include firewalls, intrusion-detection and intrusion-prevention systems, network access control, VPNs, segmentation, secure protocols, DNS security, network monitoring and denial-of-service protections. The objective is not simply to keep outsiders away from a network; modern network security also limits lateral movement and controls communication among systems that are already inside an environment.
Firewalls are one of the best-known network-security mechanisms. A firewall evaluates network traffic according to rules concerning addresses, ports, protocols, applications or other attributes and then allows, blocks or otherwise handles the traffic. Packet-filtering firewalls can make decisions using network-layer and transport-layer information, while stateful firewalls track connection state. Next-generation firewalls may include application awareness, user identity, threat detection and deeper inspection. Web application firewalls are specialised differently: they protect web applications by examining HTTP and HTTPS requests rather than acting as a general network firewall. Correct configuration is essential because an overly permissive rule can expose services, while an overly restrictive rule can interrupt legitimate operations.
Network segmentation divides an environment into separate logical or physical security zones. Examples include separating user workstations from servers, guest wireless networks from internal resources and production systems from development environments. Microsegmentation can apply controls at a more granular level, including between individual workloads or applications. Segmentation limits the paths available to an attacker who compromises one system. It can also reduce accidental access and make security policies easier to apply. Virtual local-area networks, routing policies, internal firewalls, software-defined networking and cloud security groups can all contribute to segmentation. Segmentation is not identical to physical isolation, and its effectiveness depends on whether traffic between zones is actually controlled and monitored.
Network security also protects the confidentiality and integrity of communications. Encryption protocols such as TLS protect application traffic against interception and tampering when correctly implemented. IPsec can provide security at the network layer and is used in various VPN architectures. Secure administrative protocols such as SSH protect remote management. Wireless networks use protocols such as WPA2 or WPA3 to provide security for Wi-Fi communications. Encryption does not by itself establish authorisation: it protects communications while authentication and access-control mechanisms determine who can use a service. Network-security architecture therefore normally combines cryptographic protection with identity controls, segmentation and traffic filtering.
Intrusion-detection and intrusion-prevention systems analyse network activity for patterns associated with attacks or policy violations. Network detection and response platforms can use packet information, flow records, metadata and other telemetry to identify suspicious behaviour. Detection can rely on signatures for known patterns, behavioural analysis, statistical models or combinations of techniques. Examples of suspicious activity can include scanning, unexpected protocol use, command-and-control communication, unusual data transfers or attempts to exploit vulnerable services. Detection systems can produce false positives when legitimate activity resembles malicious behaviour, so operational effectiveness depends on tuning, contextual information and skilled investigation. Prevention systems may automatically block traffic, but automated blocking needs appropriate safeguards to avoid disrupting legitimate services.
Network security has evolved as network architectures have changed. Earlier enterprise models often focused heavily on a perimeter surrounding a corporate LAN. Cloud services, remote work, mobile devices, software-defined infrastructure and zero-trust approaches have reduced the usefulness of a single fixed perimeter. Modern network security can therefore be identity-aware, application-aware and distributed across cloud and on-premises environments. Security groups, service meshes, secure access services and cloud-native controls can enforce communication policies close to workloads. Network controls remain important, but they increasingly operate as part of a broader architecture in which identity, endpoint posture and application authorisation contribute to security decisions.
Common network threats include denial-of-service attacks, eavesdropping, spoofing, malware propagation, credential attacks, exploitation of exposed services, DNS manipulation and lateral movement following an initial compromise. Network security can reduce these risks through filtering, segmentation, encryption, monitoring and secure configuration. However, network controls have limitations. Encrypted traffic can reduce visibility unless appropriate inspection or endpoint telemetry is available, and attackers can sometimes use legitimate services to hide malicious activity. Misconfigured firewalls can create both security gaps and operational failures. Network security also cannot compensate for vulnerable applications or compromised credentials in every case. Effective defence therefore requires coordination among network, endpoint, identity and application controls.
Network security is ultimately about controlling and protecting communication and connectivity. A secure network architecture identifies which systems need to communicate, which protocols and destinations are legitimate, what traffic should be encrypted, which zones require isolation and what activity should generate alerts. Network administrators and security teams must maintain inventories, review firewall rules, monitor changes and test controls regularly.
The strongest approach combines preventive controls such as firewalls and segmentation with detective controls such as monitoring and intrusion detection and responsive capabilities such as automated containment and incident response. Network security is therefore not a single appliance or boundary but a continuing set of controls designed to make network communication authorised, protected, observable and appropriately constrained.
