Network Security & Defense

The traffic arrives. The earlier permit decides and the deny below it is never evaluated. The deny still sits in the policy, still reads as an enforced control in review and audit, and never logs anything.

An emergency permit survives because nothing removes it: the change was recorded as an outage fix rather than as a permit with an end date and a named owner, and later nobody can prove that deleting the rule is safe.

It denies them a network path they can start: no socket opened from a tier host reaches an interior service. It does not deny them the tier's own data, or content the interior later collects of its own accord.

It stops hosts inside your network from putting forged source addresses onto the internet. The victim of that spoofing is almost always another network, so the filter mostly protects strangers while you pay to keep the prefix list accurate.

Two guests on one hypervisor exchange packets switched in software inside that host; nothing crosses a wire, so no border device receives them. Blocking that pivot means paying for a filter inside the host — an in-guest agent or a hypervisor firewall.

An edge WAF judges only requests that arrive through the hostname it fronts. An attacker who addresses the origin directly never crosses it, so the honest claim is coverage of one path, not protection of the service.

A stopgap WAF rule changes nothing about the bug. The code is still vulnerable; only requests matching that pattern, arriving through that proxy, are stopped. It costs a permanent rule nobody owns and a fix that stops feeling urgent.

Software learns a proxy from an operating-system setting, a PAC file located by WPAD, or proxy environment variables. An agent with a hard-coded destination reads none of them, so you write a direct-egress exception every process on that host inherits.

A server segment talks to a finite, owned set of destinations that changes under change control, so it can be enumerated. A user population needs the whole internet, so no allow-list holds. Malware landing there leaves unblocked.

The endpoint has to send that query to your resolver. A filtering resolver is a control the client opts into: a host that asks a different resolver, or ships its own, is never offered the block.

Only a connection record - five-tuple, duration, byte counts, connection state - with the service field empty. No protocol facts, no filenames, no hashes, no certificate subjects. A byte-matching engine can still search that same payload for a fixed string.

In alert mode a wrong match costs an analyst an hour. Inline, the identical match severs a live session. The rule's accuracy does not change - only who pays for its mistakes, which moves to whoever owns that traffic.

A hardware bypass relay shorts the two inline ports together when the engine stops, so the branch link keeps carrying packets. You buy availability with inspection: everything in that window, an intruder's traffic included, crosses unjudged.

A suppression scoped to a /16 blinds the sensor for every host in that range, not just the scanner. Any address inside it can generate the matching traffic and the sensor emits nothing.

Everything past the first megabyte of that flow leaves uninspected, so an intruder puts the payload behind a benign prefix. The limit exists because deeper reassembly costs buffer memory on every concurrent flow and adds latency.

Nothing at your edge helps, because the transit link is already saturated before packets reach your firewall. A scrubbing provider has far more inbound capacity, absorbs and filters the flood upstream, and forwards only cleaned traffic to you.

It stops the flood from reaching your access link, because the upstream discards those packets inside its own network. It finishes the outage: every packet to that address is dropped, so legitimate users lose the service too.

Each site sees only its own share of the flood. A per-site threshold is compared against roughly one twelfth of the total, so an attack far above your planning number can stay under every local trigger and never alert anyone.

Because the threshold and the damage are measured in different units. Four hundred small, well-formed requests are a trivial number of bits and packets; the cost lands as work per request inside the service, which the border never counts.

Only that requests arrived. A rate count carries no sender identity, no intent and no outcome. A flood shaped to look like growth and a real launch draw the same curve, which is exactly why an attacker picks that hour.

A flow record only says bytes moved between two endpoints on a port. It carries no payload, no user and no purpose, so a compiler turning records into permits cannot separate a designed dependency from an intruder who was present.

You cannot fix the host, so the only control is what the segment permits it to originate and receive. The price is a standing exception with a named owner and a renewal date, and an intruder who lands there inherits it.

Every other host in that VLAN — with three devices a room, roughly 2,700 of them. Traffic between hosts in one broadcast domain is switched, never routed, so the inter-VLAN firewall neither filters nor logs it.

That permission already exists in every segment's rule set. Segmentation limits who may reach whom, but the shared tier is exempt by design, so owning it hands an adversary an approved path into every segment.

Almost nothing. It proves one named source group may reach one destination on those ports. What an intruder reaches is the union of every allow covering that workload's groups, then the same from each host it lands on.

MAC authentication bypass proves only that a frame carrying an allow-listed address reached the port. The address is a printed label, not a secret. Its value is inventory and logging, and each entry is a permanent exception someone must own.

PEAP-MSCHAPv2 authenticates a password, and a password travels: whoever holds it authenticates from any laptop. So 802.1X admits a credential, not a device. EAP-TLS binds admission to a per-device key, but every device must be enrolled first.

It stops an attacker's radio that beacons your SSID from becoming the server your device authenticates to. Without it the supplicant builds its EAP tunnel to whoever answered and sends the credential exchange inside it.

Only EAPOL. The port's uncontrolled channel carries 802.1X frames; DHCP, ARP and everything else are dropped until authentication authorizes the controlled channel. Anything with no supplicant - imaging, headless kit - therefore sees a dead socket.

A socket that never got admission control hands a stranger a DHCP lease and layer-2 adjacency to everything in that room's VLAN. Shutting unused ports removes that, at the cost of a ticket every time a room is re-cabled.

Nothing. Exempted traffic never enters the tunnel, so it never reaches the head-end or anything behind it. An exemption removes the vantage point entirely rather than reducing what gets logged.

A tunnel session reaches whatever the routing table and the filters behind the address pool allow, which by default is everything the concentrator can route to. Authentication decides who gets an address; it never decides which destinations that address may open.

It proves only that the far-end device held the agreed key or certificate — nothing about the hosts behind it. Traffic leaving the tunnel is ordinary unauthenticated traffic, so your side needs its own default-deny filter on the extranet zone.

Nothing except the concentrator itself. ESP is decapsulated at its inside leg, so plaintext appears already on the core and no independent device sees it. Enforcement there means paying for a second filter and a second hop.

Lockdown makes the endpoint's own packet filter drop every flow except the tunnel and a few named exceptions. It protects traffic, not the machine: the interface is still on the hostile segment, and whatever the exceptions allow is reachable there.

Reachability proves only that a packet arrived from an address the network will route; anything that lands inside inherits it. Replacing it means building the login the app never had - a front door on its host, or a rewrite.

Disabling an account only changes the answer given the next time something asks, and an established flow is never asked again. The broker must hold session state and actively terminate matching sessions, which also drops legitimate users the same rule catches.

Zero trust removed network position as evidence, so being inside no longer grants reach. It never claimed to remove credential theft: a real credential on a compliant device is a true input, and every enforcement point downstream will correctly allow it.

Only that something holding the device's credential sent a document containing those claims. The values are the endpoint's own word, and an attacker with code on it can write any of them. Distrusting them costs a narrower grant.

Usually several: an operator opening a shell inside a running workload, node-level access to the host, the platform's own control API on a management network, workload-to-workload calls that never leave, and outbound batch traffic. A front gateway only sees what routing sends it.