Lesson 7 — Intermediate

Network Security (Firewall, IDS/IPS, VPN)

Cryptography se data safe hua, par traffic ka raasta bhi safe hona chahiye. Is lesson mein hum firewall ke type, IDS/IPS ka farak, VPN ka kaam aur defense-in-depth ka concept samjhenge — SOC analyst ki roz ki vocabulary yahi hai.

⏱ 15 min• Intermediate• Cryptography

Network security kya hai

WHAT

Network security = network aur uske traffic ko unauthorized access, attacks aur data leaks se bachana. Firewalls, IDS/IPS, VPN, segmentation — sab iske tools hain.

WHEN

Office network banate waqt, remote employees ko connect karte waqt, ya jab suspicious traffic dikhe — network security har layer pe chahiye.

WHERE

Internet edge (perimeter), internal LAN, Wi-Fi, cloud VPC — har boundary pe ek security layer hoti hai.

Core idea: trust boundaries banana. Kab, kis direction mein, kaunsa traffic ja sakta hai — ye rules define karna hi network security hai. Default rule hamesha yahi honi chahiye: deny unless explicitly allowed.

Perimeter: firewall, IPS aur DDoS protection — internet se aane wala traffic.
Internal: segmentation (VLAN), switch port security — andar ke logs bhi alag.
Remote access: VPN + MFA, ya zero trust network access (NAC).
Monitoring: SIEM + logs + alerting — attack dikhe toh turant pata chale.

Firewall — traffic ka darwaza

Firewall = traffic ko RULES se allow/block karne wala gate

Packet filtering  : sirf header (IP, port) dekh ke decide — fast,
                    andar ka payload nahi dekhta
Stateful firewall : connection ka state yaad rakhta hai
                    (request aayi thi? wahi flow allowed)
Proxy firewall     : traffic khud relay karta hai, deep inspection
NGFW (Next-Gen)    : application bhi pehchanta hai + IPS built-in

Sample rules (concept, default deny):
  allow outbound 443/tcp  -> internet HTTPS chale
  block inbound 23/tcp    -> purana Telnet band
  block any -> db port    -> database bahar se closed

Yaad rakho: Firewall network layer ka guard hai — wo malware scan nahi karta (antivirus ka kaam) aur SQL injection nahi rokta (app layer, WAF ka kaam). Layer pucha jaaye toh sahi jawab do.

IDS vs IPS

IDS (Intrusion DETECTION System) : suspicious traffic DETECT + ALERT
IPS (Intrusion PREVENTION System) : wahi traffic INLINE aake BLOCK

Detection methods:
  Signature based : known attack ke pattern se match
                   (precise, par naya attack nahi pakdega)
  Anomaly based   : normal traffic ka baseline -> usse hatna = alert
                   (naya bhi pakdega, false positive zyada)

Placement:
  IDS : network tap/mirror port pe (side se sunta hai)
  IPS : beech mein inline baitta hai (rokt hai)

Alert ka matlab nahi ki attack ruka — alert = investigate karo

Simple yaad: IDS = alarm (sirene bajati hai), IPS = alarm ke saath darwaza bhi band kar deti hai. Signature + anomaly dono mila ke aaj ke systems (NGIPS) use karte hain.

VPN aur defense in depth

VPN = encrypted TUNNEL public network (internet) over
  Faida : remote/WFH access, traffic encrypted, IP chhupa
  Sahi use : office network tak safe access
  Myth     : VPN = anonymous? NAHI — provider tera traffic dekh sakta hai

DEFENSE IN DEPTH (layers, ek nahi — sab):
  Internet edge : Firewall + IPS + DDoS protection
  Internal      : segmentation (departments alag VLAN)
  Access        : least privilege + MFA
  Data          : encryption (TLS + at rest)
  Monitor       : logs + SIEM + alerting
  Trust model   : ZERO TRUST — "verify, never trust"

Interview question: Q: "Ek firewall se kaafi hai?" A: Nahi — defense in depth. Har layer alag attack type rokti hai; ek layer fail ho jaaye toh doosri bacha le. Zero trust ka matlab hai andar ka user bhi har baar verify hota hai.

Exercise

Question: Firewall ka main kaam kya hai? (traffic filter karna / malware scan karna)

Question: IDS aur IPS mein se kaunsa traffic ko BLOCK karta hai? (ids/ips)

Question: VPN ka full form kya hai? (teen words, space se)

Common mistakes

Firewall aur antivirus ko same samajhna: Firewall traffic filter karta hai (network pe), antivirus malware scan karta hai (files pe). Dono alag layer hain.
IDS aur IPS ulta bolna: IDS detect + alert karta hai, IPS detect karke block bhi karta hai. P = Prevention = Rokna.
VPN laga toh sab safe: VPN sirf tunnel deta hai — endpoint (tumhara laptop) infected ho toh fayda nahi. Zero trust mein endpoint bhi check hota hai.

Desi example: WFH office VPN

Office ka HR portal sirf andar se chalta hai. Ghar baithe tum VPN connect karte ho — tunnel ban ti hai, aur tum "andar" aa jaate ho. Company ke liye ye safe remote access hai:

Ghar (laptop) -> encrypted tunnel -> office network
Rule  : MFA + VPN = tabhi access
Office rule: HR sirf HR app, dev sirf code repo
            (least privilege — sab kuch sabko nahi)

Exam mapping (TCS / CompTIA / Interview)

TCS NQT: firewall vs antivirus, IDS vs IPS — 2Q ka set.
Security+: defense in depth + zero trust core objectives.
Interview: "IDS aur IPS mein farak?" — roz poochha jaata hai.
Trap: "IDS blocks traffic" — galat, IDS sirf alert karta hai.

Lesson complete?

Network ki layer secure. Agla lesson — Web Security — mein dekhenge OWASP Top 10, SQL injection aur XSS ka mechanism aur unka defense.