In enterprise IT conversations, perhaps no term is used more liberally than network security–often as a stand-in for the entire cybersecurity function. That casual use conceals something crucial: network security is a well-known discipline with defined parameters, distinct from adjacent practices like endpoint or application security. Knowing exactly what is in scope and what is out of scope helps organizations create a more holistic security program rather than assuming one area covers everything.
Setting the Limits of Network Security
Network Security concerns the underlying infrastructure that connects systems and how data travels across it. These include the underlying network components routers, switches, firewalls, and the cable or wireless signals transporting data between them. This encompasses not just the physical infrastructure, but all of the logical structures built on top of it: segments and switch configuration as well as virtual private networks and rules for what traffic can traverse one portion of the network versus another.
What network security does not cover, at least not as its primary focus, is the security of individual devices once data reaches them, or the security of the application code running on those devices. Endpoint security addresses the former; application security addresses the latter. These disciplines overlap and depend on one another in practice, but each has a distinct center of gravity. Anyone researching what is network security and scope quickly discovers that the most useful definitions draw this boundary clearly, because conflating network security with the broader cybersecurity umbrella tends to produce gaps in coverage rather than comprehensive protection.
See also: Stretch Marks Don’t Have to Be a Lifetime Companion
What Network Security Actually Includes
Network security realistically encompasses several types of controls:
- Perimeter & Boundary Defense describes the technologies that control what traffic is allowed to go into or out of the network, primarily firewalls and intrusion prevention systems sitting at the boundaries where the organization’s network meets external networks, including with an internet.
- Internal traffic control brings these same principles inside the network itself, controlling how each segment is allowed to communicate with others. This includes network segmentation, which thoroughly splits a network into logical zones so that traffic between zones can be inspected, restricted or completely blocked by policy to limit how far an attacker can traverse if he gains access to any one particular sector.
- Authorization determines which users, devices and systems get to connect to the network in the first place, and what they are allowed once connected. This includes everything from authentication mechanisms through to network access control systems that restrict connectivity until devices have been determined healthy and the policies in terms of levels of network access, roles or device types received.
- Traffic inspection and monitoring refers to the tools that are constantly examining what is traversing the network for well-known attack signatures, as well as behavioral anomalies indicating a potential compromise in progress. That includes IDS, network traffic analysis platforms, and the logging infrastructure that feeds them.
- Data-in-transit encryption ensures that traffic traversing the network, especially over untrusted channels such as the public internet, remains unreadable when intercepted. Similarly, Virtual private networks extend this protection to remote connections by establishing an encrypted tunnel between a device and the organization.
Network Security and its Integration with the Larger Security Picture
Network security is not an isolated thing. This is only one discipline among many in a far broader system of controls that organizations employ to holistically address risk. Understanding where it fits within that structure provides even more context for its scope.
Authoritative frameworks that catalog security controls across an entire organization typically treat network security as one of several interconnected control families, alongside access control, incident response, configuration management, and other domains. A comprehensive security controls catalog published by federal standards bodies illustrates this structure clearly, organizing controls into distinct families that map closely to the practical divisions practitioners use when building a security program, with system and communications protection, access control, and audit and accountability representing the families most directly relevant to network security specifically.
Why this helps is because it reinforces the premise that network security controls are designed to relate with other family controls. Network segmentation policy exists only in tandem with the access control policy that determines who can request changes to that segmentation (and what kind), and with the audit and accountability controls that ensure the change is logged and will be reviewed. Treating network security as an independent checklist instead of a point in space creates coverage gaps along the seam between these adjacent control families.
Preventive Versus Detective Scope of Network Security
To better understand how network security works, you can think of it in the form of a timeline: what is done before an incident, what detects an incident during it and what assists after detection. While all three phases fall under the umbrella of network security, not all receive equal attention.
Preventive measures, including secure network design, proper segmentation, and hardened device configurations, are often underinvested relative to detection and response tooling, despite representing some of the most cost-effective ways to reduce risk. The case for prevention-focused network security strategy rests on a straightforward observation: network engineers, through the decisions they make about network design and configuration, have substantial influence over the organization’s security posture, even though security is not always framed as their primary responsibility. Bringing network engineering teams into security planning from the outset, rather than treating security as something applied after a network is already built, extends the practical scope of network security to include architectural decisions that are made well before any firewall rule is configured.
Detection measures encompass the continuous examination required to identify threats and anomalies after a network has been deployed, while response measures concern the capacity of an organization to contain and remediate once an incident is detected. Focusing the budget heavily in detection and response without proper preventive architecture design will result in a fledgling security program that is great at responding to incidents (many of it would be avoided thru better NETD) but not as effective at preventing them.
Network Security Context in Niche, Distributed Environments
Until a few years ago, network security was fairly well understood as the centralized model of most systems and users connecting to a limited number of clearly defined network boundaries. As of October 2023, that assumption does not apply to most enterprises. Even if the principles are still grounded, cloud services, remote work and optical articulation of mobile devices have widened what is practical in the field of network security.
Traffic between an enterprise’s on-premises network and its cloud-hosted resources is safely in the hands of network security professionals, even if that traffic never goes near a classic network perimeter device. Likewise, connections remote workers make from home wifi networks with user-owned devices are in the scope of required controls like mandatory VPN or zero-trust access verification that ten years ago was rarely part of network security programs.
This broadening does not alter the underlying definition of network security, which is still centered on the infrastructure interconnecting systems and the traffic traversing it. What is different now is the physical and logical form of that infrastructure, but this has led to a need for network security programs to have effective coverage across environments that are extremely dissimilar from the on-premises corporate network.
Frequently Asked Questions
Are laptops and servers included in network security?
Not directly. Endpoint security is a separate but closely related discipline focused primarily on securing endpoint devices. While network security is responsible for the infrastructure connecting devices and the traffic between them, network security works hand in hand with endpoint security because a breach through a compromised endpoint often becomes a way attacker enters the system trying to pivot across users and endpoints over the network.
Network Security: Is cloud connectivity part of the realm of network security?
Yes. With the growing adoption of cloud services, so does the traffic traversing between on-premises and cloud environments and between different clouds, thereby coming under the purview of network security. This can include encrypting that traffic, what systems are allowed to make cloud connections, and inspect cloud-bound traffic for abnormal behavior—all things a traditional on-premises network would do as well (although in this case the underlying infrastructure is different).
Why is network segmentation viewed as a network security control but not general networking?
Segmentation is a very clear networking function, splitting up a network into zones that are easier to operate based on performance and organizational principles, but it also has an inherent security functionality: limiting how far an attacker can traverse if they breach any defined segment. As a result of this dual role, segmentation decisions are generally co-made by network engineering and security teams and effective segmentation design has become a recognized networking core competency as opposed to an architectural one.
By
