Design secure network architectures, components, protocols, segmentation, wireless, remote access, third-party connectivity, and communication channels.
Assess and implement segmentation, zero-trust concepts, software-defined networking, convergence, fault tolerance, and secure topology.
Understand operation and risk of transmission media, network access control, endpoints, devices, wireless, cellular, and content-distribution components.
Design voice, multimedia, remote-access, collaboration, data, API, virtualized, and third-party channels with appropriate protection.
Networks transport requests between trust zones; they do not decide whether the business action is authorized. Begin with users, workloads, data flows, protocols, trust boundaries, administrative paths, third parties, and availability requirements. Then design segmentation, routing, access, encryption, inspection, resilience, and evidence.
Use layered controls and assume internal networks can be hostile. A private address, VPN connection, or corporate device is context—not proof of trust.
| Objective | Required judgment | Proof |
|---|---|---|
| 4.1 Secure network architecture | Design topology, segmentation, zero-trust concepts, software-defined control, convergence, and fault tolerance | Allowed flows are explicit, denied flows fail, and a component failure stays within the intended blast radius |
| 4.2 Secure network components | Assess media, devices, endpoints, network access control, wireless, cellular, and content-distribution components | Components are hardened, managed, monitored, resilient, and supported |
| 4.3 Secure communication channels | Protect voice, multimedia, remote, collaboration, data, API, virtualized, and third-party paths | Peer identity, confidentiality, integrity, availability, and logging meet the channel's requirement |
Use the OSI and TCP/IP models to locate responsibilities and troubleshoot, not as isolated trivia. Physical and data-link controls address media, switching, addressing, and local access. Network-layer controls address routing and IP paths. Transport controls address sessions, reliability, ports, and some encryption protocols. Application protocols and identity carry business semantics. Encapsulation means a protected outer tunnel can still carry unsafe application traffic.
Segment by trust, data, function, ownership, environment, and failure impact. VLANs provide logical separation at Layer 2 but require correct switching, routing, and access controls. Firewalls enforce defined flows at their inspection layer. Proxies terminate and mediate supported protocols. Network access control can evaluate identities and devices before or during access. Microsegmentation can limit east-west movement but depends on reliable identity, policy, and observability.
Zero trust architecture emphasizes explicit resource access decisions, least privilege, continuous context, and reduced implicit network trust. It still requires resilient identity, policy, telemetry, endpoint, and recovery systems. Software-defined networking centralizes or abstracts control and enables automation; protect controller authority and data-plane behavior. Network function virtualization adds virtualized lifecycle and isolation concerns.
Eliminate hidden single points across links, devices, power, carriers, sites, DNS, authentication, encryption, and management. Redundant components sharing one conduit, provider, configuration error, or control plane may have common fate. Use diverse paths and tested failover based on business need. Dynamic routing improves adaptability but requires authentication, filtering, convergence, and route-control design.
Common topologies—star, mesh, hub-and-spoke, leaf-spine, and hybrid—trade cost, scale, failure isolation, and complexity. A full mesh increases path diversity and management burden. Hub-and-spoke centralizes control and creates hub dependency. Leaf-spine supports predictable data-center paths but does not itself enforce tenant security.
Separate management, control, and data planes where risk warrants it. Restrict administrative protocols and sources, use strong authentication, encrypt management, log changes, protect configuration backups, and plan break-glass access. Out-of-band management can aid recovery but creates another privileged network.
Routers choose paths; switches forward frames; firewalls enforce traffic policy; IDS detects; IPS can block; proxies mediate; load balancers distribute; gateways translate; VPN concentrators terminate tunnels; DNS and DHCP provide foundational services. Modern devices combine roles, so assess actual control and failure behavior.
Harden configuration, remove defaults, disable unused services, patch, protect credentials and keys, use secure management protocols, synchronize time, back up configuration, monitor health, and review rules. Rule bases need ownership, purpose, expiry, testing, and cleanup.
Wireless requires appropriate authentication and encryption, protected management, rogue detection, coverage design, client isolation where appropriate, and resistance to evil-twin and deauthentication scenarios. Cellular adds provider, SIM/eSIM, signaling, roaming, device, and interception concerns. Fiber, copper, radio, and physical media have different distance, interference, tapping, availability, and installation risks.
TLS protects supported application sessions when certificate validation, protocol, cipher, key, and endpoint security are correct. IPsec can protect IP traffic in transport or tunnel designs. SSH protects administration and related transfers. Secure voice and collaboration require identity, signaling, media protection, device security, recording policy, and availability. Do not invent one protocol as the answer for every layer.
Remote access combines identity proofing, strong authentication, managed endpoint posture, least privilege, encrypted channel, segmentation, session controls, logging, and incident response. Split tunneling changes routing and monitoring tradeoffs. Third-party access should be dedicated, constrained, time-bounded, monitored, and removable. APIs need transport protection plus client identity, authorization, schema, rate, replay, and application controls.
For data transfer, select secure managed protocols and verify both endpoints. Email encryption can protect transport, message, or attachments with different key and usability models. Metadata may remain visible. File integrity and sender authenticity may require signatures or authenticated transfer in addition to encryption.
| Requirement | Strong pattern | Frequent error |
|---|---|---|
| Limit lateral movement | Segmentation plus identity, endpoint, and monitoring | Trust everything inside a VLAN |
| Resilient internet access | Diverse carriers, paths, edge devices, DNS, and tested failover | Two circuits in one conduit |
| Third-party administration | Dedicated path, named identity, least privilege, time bound, recorded use | Shared VPN account with broad network reach |
| Protect web API | TLS plus client identity, authorization, validation, rate, and logs | Calling HTTPS complete API security |
| Remote workforce | Managed endpoint, strong auth, encrypted channel, app-level access | Full network access because MFA succeeded |
| Detect suspicious traffic | Flow, DNS, endpoint, proxy, application, and identity evidence | Packet inspection as the only context |
A manufacturer connects corporate IT, factory networks, remote engineers, cloud services, and a maintenance supplier. Production safety and uptime are critical.
