CISSP Network Security: Components, VPNs, and Communication Channels

Introduction

Secure network components turn segmentation policies into controlled access, resilient services, and protected communication channels. This CISSP lesson covers tasks 4.2 and 4.3 of Domain 4, Communication and Network Security (13% of the exam, ISC2 exam outline effective 15 April 2024): secure network components, and implement secure communication channels according to design. It follows secure network architecture and segmentation: now you choose and harden the devices and channels that realize the design.

The exam asks you to pick the right device for a job (firewall type, proxy, NAC), to understand how hardware operates (switches, routers, load balancers), to secure remote access and collaboration tools, and to treat third-party connectivity as an extension of your trust boundary. Questions are scenario-based and ask for the most appropriate control, so you need to know both what each component does and what it cannot do.

Learning objectives

After this lesson you can:

1. Explain the operation of switches, routers, firewalls, proxies, load balancers, IDS/IPS, and wireless controllers, and secure each.
2. Choose transmission media with security, distance, and interference in mind.
3. Implement network access control (NAC) with 802.1X and posture checks.
4. Secure endpoints with EDR, host firewalls, and hardening.
5. Secure voice, video, and collaboration channels.
6. Compare remote access options: VPN types, ZTNA, jump hosts, and virtual desktops.
7. Secure data communications and third-party connections, including redundancy and support contracts.

1. Network hardware and how it operates

1.1 Hubs, switches, and bridges

• Hub (layer 1): repeats every signal to all ports. No security; collisions and sniffing are trivial. Obsolete.
• Bridge / switch (layer 2): forwards frames using a MAC address table learned from traffic. Switches create separate collision domains per port. Attack: MAC flooding can exhaust the learning table and cause unknown-unicast flooding through eligible ports in the VLAN, depending on platform and configuration. It does not necessarily flood all traffic or cross VLAN boundaries. Defenses: port security (limit MACs per port, sticky MAC), DHCP snooping, dynamic ARP inspection (DAI), IP source guard, BPDU guard against spanning-tree manipulation, and shutting unused ports.
• Layer 3 switch: a switch with routing; common for inter-VLAN routing with ACLs.

1.2 Routers

Routers forward packets between networks based on routing tables. Hardening: disable unused services, authenticate routing protocols (OSPF, BGP with MD5/keychains or TCP-AO), filter bogons and spoofed sources (uRPF, ingress/egress filtering), use SSH, AAA via TACACS+, and keep firmware current. Access control lists on routers provide basic stateless packet filtering.

1.3 Firewalls

Deployment designs: screened subnet (DMZ) separating untrusted, DMZ, and trusted zones through a suitable multi-interface firewall or a two-firewall design (dual-firewall designs from different vendors reduce shared-flaw risk), bastion hosts for exposed services, and default-deny rule sets with explicit allows. Rules should be reviewed regularly; shadowed and obsolete rules are common findings.

1.4 Proxies and gateways

• Forward proxy: clients go through it to reach the internet; enforces URL filtering, caching, data-loss rules, and logs usage.
• Reverse proxy: sits in front of servers, hiding them and offloading TLS, load balancing, and WAF.
• Transparent proxy: intercepts traffic without client configuration.
• TLS inspection requires a trusted inspection CA on endpoints, a clear privacy policy, and exemptions for sensitive categories such as banking and health.
• Secure web gateway / CASB: cloud-delivered inspection of web and SaaS access.

1.5 Load balancers

Distribute connections across servers for availability and scale; many terminate TLS and offer health checks and WAF features. Secure them as exposed assets: patch, restrict the management interface, and ensure session persistence cookies do not leak internal information.

1.6 IDS, IPS, and network taps

• IDS detects and alerts (passive, off a SPAN port or tap). IPS sits inline and blocks. Inline devices add a failure mode: fail-open keeps traffic flowing but unprotected, fail-closed protects but can cause an outage.
• Detection methods: signature-based (known patterns), anomaly or behavior-based (deviation from baseline), and heuristic. Signatures may miss novel attacks, while anomaly detection can generate false positives.
• Network taps provide a monitoring copy, but insertion, power behavior, capacity, and maintenance can affect availability or capture completeness. SPAN ports can also drop packets under load. Design and test the actual capture path.

1.7 Wireless infrastructure

Access points managed by a wireless LAN controller, with WIPS, rogue AP detection, client isolation, and certificate-based authentication (covered in the architecture lesson). Place controllers on management networks and restrict their administration.

1.8 Modems, gateways, and other devices

Consider cable and DSL modems, cellular routers, and protocol gateways (for example, serial-to-IP converters in industrial settings). Each is a device with firmware and default credentials; inventory, patch, and change defaults.

2. Transmission media

Design points: use fiber between buildings and in electrically noisy places, protect cable runs with conduits and locked closets, use protected distribution systems (PDS) for high-classification cabling, and keep copper away from power lines to reduce interference. Label and document the cabling plant so unauthorized taps or devices can be found.

3. Network access control (NAC)

NAC decides whether a device may connect and where it lands.

• IEEE 802.1X defines port-based access control with three roles: the supplicant (client), the authenticator (switch or access point), and the authentication server (RADIUS). The EAP method carries credentials: EAP-TLS (mutual certificate authentication), PEAP, or EAP-TTLS. Configure expected server names and trusted CAs and validate certificates; the EAP method name alone does not prove a secure deployment.
• Posture assessment: checks OS patch level, EDR running, disk encryption, and certificate before granting access.
• Outcomes: full access, restricted VLAN (remediation), guest VLAN, or denial. Use dynamic VLAN assignment from the RADIUS reply.
• MAC authentication bypass (MAB) supports devices that cannot run 802.1X (printers, cameras) but is weak because MAC addresses are spoofable; compensate with device profiling and restrictive VLANs.
• Agent-based versus agentless NAC: agents give richer posture data; agentless uses scans and profiling.

Properly enforced NAC can limit the visitor-laptop path from the previous lesson. Test unauthenticated admission, MAB exceptions, fallback behavior, and quarantine isolation; fail-open or permissive fallback can defeat the intended boundary.

4. Endpoint security

Endpoints are where users, data, and the network meet.

• EDR/XDR record process, file, and network activity, detect malicious behavior, and allow containment (isolate host) and investigation.
• Host-based firewall enforces local policy, important when users travel and for east-west control.
• Hardening: remove unnecessary software, apply baselines (CIS Benchmarks), disable unused services, enforce full-disk encryption, and restrict administrative rights.
• Application control (allowlisting) restricts unauthorized code; trusted interpreters, scripts, and permitted tools also need appropriate policy.
• Mobile devices: MDM/UEM for enrollment, remote wipe, containerization of corporate data, and compliance checks. BYOD requires clear agreements and separation of work and personal data.
• Patching and vulnerability management reduce the exposed surface; endpoint exposure remains a significant attack path, without assuming one universal incident ranking.
• IoT and OT endpoints often cannot run agents: segment them, monitor their traffic passively, and restrict their communications to known peers.

5. Voice, video, and collaboration

5.1 VoIP and video

SIP signals call setup, while RTP carries the media. Threats: eavesdropping on unencrypted RTP, call hijacking, caller ID spoofing, toll fraud, SIP registration attacks, and denial of service on the voice VLAN. Controls: SRTP for media, TLS for SIP signaling, a dedicated voice VLAN with QoS, session border controllers at the edge, strong credentials on phones, and monitoring for unusual call patterns (international calls at night).

5.2 Conferencing and collaboration tools

Chat, file sharing, and web conferencing platforms introduce data-leakage and account-takeover risks. Controls: SSO with MFA, meeting passcodes and waiting rooms, end-to-end encryption options for sensitive meetings, retention and eDiscovery settings, DLP integration, guest access governance, and review of third-party app integrations. Recording and transcript storage must follow classification and retention rules.

5.3 Email and messaging

Use SPF, DKIM, and DMARC for domain-based authentication and policy. DMARC checks alignment of the visible From domain with a passing SPF MAIL FROM identity or a passing DKIM signing domain; both are not required to pass. It does not prove the human author or stop every phishing message. MTA-STS can require authenticated SMTP TLS to reduce downgrade risk; S/MIME or PGP protects message content separately.

6. Remote access

Key concepts:

• Split tunneling sends only corporate traffic through the VPN, while the rest goes directly to the internet. It reduces VPN load, while internet traffic bypasses that gateway unless covered by other inspection controls; full tunnel routes intended traffic through the corporate gateway. Choose based on risk and coverage; neither design alone guarantees complete inspection or a trustworthy endpoint.
• IPsec modes: transport (protects payload, original IP header kept; host-to-host) and tunnel (encapsulates the whole packet; gateway-to-gateway). Protocols: AH (integrity and authentication, no encryption) and ESP (services depend on negotiated algorithms; use an approved authenticated-encryption profile for confidentiality and integrity). NULL encryption does not hide payloads. Key exchange: IKE (IKEv2 recommended).
• Remote access authentication: MFA, certificate-based device identity, RADIUS/TACACS+, and posture checks before connection. Log every connection and review anomalies (impossible travel).
• Out-of-band management: a separate path (console server, cellular) used to reach devices when the main network is down; secure it as strongly as the production network.

7. Data communications and third-party connectivity

7.1 Securing data in transit

Apply TLS 1.2 or 1.3 for application traffic, IPsec for network-level tunnels, SSH for administration, and mutual TLS for service-to-service. Disable weak ciphers and protocol versions (SSLv3, TLS 1.0/1.1), use certificates from a managed PKI with monitoring for expiry, and consider HSTS for web properties.

7.2 WAN technologies

Private circuits, MPLS, SD-WAN over broadband, and cloud direct connections. SD-WAN adds centralized policy, application-aware routing, and encrypted overlays, but the controller and edge devices need the same protection as any SDN control plane.

7.3 Third-party connectivity

Vendors, partners, MSPs, and cloud providers connect to your network. Treat each as a risk:

• Contracts and SLAs state security requirements, incident notification, audit rights, and responsibilities.
• Technical controls: terminate third-party links in a dedicated extranet zone behind a firewall, allow only the specific hosts and ports required, use VPN or private links with mutual authentication, and give vendors individual accounts with MFA, time-limited access, and logging. Avoid shared vendor credentials.
• Monitoring and review: log and review vendor sessions, re-certify access periodically, and remove it when the contract ends.

7.4 Redundancy, support contracts, and physical protection

• Redundancy: dual power supplies, dual uplinks, diverse physical paths (two fibers entering the building at different points), and multi-homing to two carriers. Test failover.
• Support contracts: hardware replacement time (for example, four-hour or next-business-day), firmware and security patch entitlement, and end-of-life dates drive availability and patch posture. Keep spares for critical devices.
• Physical protection of media: lock wiring closets, use conduits and tamper-evident seals, inspect for unauthorized taps, and document patch panels. A cut fiber can deny availability, and an unlocked closet permits physical tampering; properly authenticated encryption can still protect content confidentiality and integrity.

8. Worked example: choosing the remote access design

Scenario. Alder Engineering has 400 employees, 60 of whom travel. A contractor firm needs access to one internal ticketing application and a test server, for six months. Administrators currently use RDP directly from home to production servers over the internet. Requirements: reduce exposure, preserve auditability, and keep costs reasonable.

Step 1: Group users by need.

• Employees: access to many internal apps from managed laptops.
• Contractors: two systems only, unmanaged devices.
• Administrators: privileged access to servers.

Step 2: Choose controls per group.

• Employees: remote-access VPN or ZTNA with MFA, device certificates, and posture checks. A full tunnel on managed devices allows inspection; split tunneling requires an explicit risk decision and appropriate endpoint, web, DNS, and traffic controls, not merely the existence of an agent.
• Contractors: ZTNA or a published application behind a reverse proxy, or a VDI session, with individual accounts, MFA, and automatic expiry at contract end. ZTNA controls reachability, not data copying. VDI or browser controls can restrict download, clipboard, and drive redirection, but screens, screenshots, and compromised endpoints remain risks.
• Administrators: stop exposing RDP. Require VPN or ZTNA first, then a jump host with MFA and session recording; production servers accept administrative connections only from the jump host.

Step 3: Monitor and review. Log VPN and jump host sessions to the SIEM, alert on anomalous locations and times, and review contractor access monthly.

Why not the alternatives? A poorly filtered site-to-site VPN may expose excessive resources. A site-to-site tunnel can be restricted, but application-level access better matches this scenario. Opening RDP with a stronger password still exposes a high-value service to internet attacks. An unrestricted employee VPN profile would grant more access than needed; a VPN itself does not require unrestricted permissions.

9. Mini case study

Scenario. Harbor Retail connects 120 stores to headquarters. Findings from an audit: (a) store switches have all ports enabled and no port security; (b) a payment-terminal vendor connects through a shared account with a static password and no logging; (c) the store firewall rule set contains "any-any allow" from the vendor VPN; (d) telephone systems use unencrypted SIP across the internet between stores; (e) the single WAN link to each store has no backup and the support contract offers only next-business-day replacement; (f) wiring cabinets in stock rooms are unlocked.

Task. Prioritize fixes and justify them.

Commented solution.

1. Vendor access (b, c) first: it is internet-facing, privileged, and unmonitored. Create a dedicated vendor zone, restrict the VPN to the specific terminal addresses and ports, require individual accounts with MFA and time-limited approval, and log sessions.
2. Switch ports (a, f): enable 802.1X or at least port security, shut unused ports, and lock cabinets so a visitor cannot plug in a rogue device or tap a link. Add DHCP snooping and DAI.
3. Voice (d): enable TLS for SIP and SRTP for media, or route inter-store voice over the encrypted WAN overlay.
4. Availability (e): add a second carrier or cellular backup with automatic failover for stores that process card payments, and negotiate faster replacement for critical devices (or hold spares in the region).
5. Governance: review all firewall rules quarterly, document owners, and include third parties in the incident response plan.

This is an illustrative priority order. Confirm exposure, payment obligations, safety, and outage impact before deciding the actual sequence; the findings alone do not establish event probabilities.

10. Common pitfalls and exam tips

• Pitfall: choosing a stateless packet filter when the question needs awareness of connections or applications.
• Exam tip: "block SQL injection and cross-site scripting" points to a WAF, not a network firewall.
• Exam tip: "authenticate the device before it gets a switch port" is 802.1X/NAC; "limit the number of MAC addresses per port" is port security.
• Pitfall: confusing AH (no encryption) with ESP (payload protection; select a non-NULL encryption transform for confidentiality).
• Exam tip: a jump host protects administrative access; it does not replace MFA, logging, or segmentation.
• Pitfall: treating a vendor link as trusted. Third-party connections expand your attack surface; give least privilege and monitor.
• Exam tip: fiber gives better resistance to EMI and eavesdropping than copper; PDS is for highly classified cabling.
• Exam tip: IPS inline failing open preserves availability; failing closed preserves security. Choose by the scenario's priority.
• Pitfall: enabling TLS inspection without a policy for privacy-sensitive categories.
• Exam tip: "zero trust access to an application, not the network" is ZTNA.

Key terms

• 802.1X: port-based authentication framework (supplicant, authenticator, RADIUS server).
• NAC: policy-based admission and posture checking of devices.
• Port security / DAI / DHCP snooping: switch features that limit MACs, validate ARP, and block rogue DHCP.
• NGFW / WAF: firewall with application and user awareness / web request firewall.
• IDS / IPS: detect and alert / detect and block inline.
• ZTNA: per-application access brokered by identity, device, and context.
• Split tunneling: only some traffic goes through the VPN.
• ESP / AH / IKE: IPsec payload protection, integrity-only protection, and security-association/key negotiation; ESP encryption depends on its selected transform.
• SRTP / SIP over TLS: protection for voice media and signaling.
• Jump host: hardened intermediary for administrative sessions.

Summary checklist

• I can explain how switches, routers, firewalls, proxies, and IDS/IPS operate and how to harden them.
• I can choose the right firewall type for a requirement.
• I can select transmission media based on distance, interference, and security.
• I can describe 802.1X, EAP-TLS, and NAC outcomes.
• I can secure endpoints with EDR, host firewalls, hardening, and MDM.
• I can secure VoIP, conferencing, and email channels.
• I can compare IPsec, TLS VPN, ZTNA, jump hosts, and VDI for remote access.
• I can design secure, monitored third-party connectivity with redundancy and support terms.

Compare the primitives behind VPN and media protection in cryptography and key management. Pair remote admission with identification and authentication controls rather than relying on network reachability alone.

Official sources

• ISC2 CISSP exam outline: https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline (opens in a new tab)

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final (opens in a new tab)

• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs: https://csrc.nist.gov/pubs/sp/800/77/r1/final (opens in a new tab)

• NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations: https://csrc.nist.gov/pubs/sp/800/52/r2/final (opens in a new tab)

• NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security: https://csrc.nist.gov/pubs/sp/800/46/r2/final (opens in a new tab)

• NIST SP 800-207, Zero Trust Architecture: https://csrc.nist.gov/pubs/sp/800/207/final (opens in a new tab)

• Cisco, MAC table capacity and unknown-unicast flooding: https://www.cisco.com/c/en/us/td/docs/switches/lan/c9000/lyr2-fwd/cdp-lldp-mac-udld/cdp-lldp-mac-udld-configuration-guide/c-configure-mac.html (opens in a new tab)

• IETF RFC 9989, DMARC and identifier alignment: https://www.rfc-editor.org/info/rfc9989/ (opens in a new tab)

• Microsoft, EAP server validation: https://learn.microsoft.com/en-us/windows-server/networking/technologies/extensible-authentication-protocol/network-access (opens in a new tab)