Network-Security

Overview A firewall and a web application firewall (WAF) both filter traffic, but they operate at different layers of the stack. A firewall makes allow/deny decisions based on IP and port, while a WAF inspects the actual HTTP payload of requests to catch application-layer attacks like SQL injection and XSS. Most production environments deploy both, since neither can see what the other is built to catch. Comparison Diagram FirewallWAFRaw network trafficTCP SYN, dst port 22FirewallL3/L4: IP, port, protocolAllow 443Block 22Cannot see inside theHTTP request bodyHTTP requestGET /login?id=1' OR '1'='1WAFL7: URL, headers, bodyAllow normalBlock SQLiDecrypts TLS to inspectthe request payloadLayered defense: firewall blocks unauthorized access, WAF blocks malicious payloads Comparison Table Aspect Firewall WAF OSI layer inspected Network/transport (L3/L4) Application (L7) Traffic filtered All IP traffic, any protocol or port HTTP/HTTPS requests only Inspection criteria Source/destination IP, port, protocol, connection state URL, headers, cookies, and request body content Rule basis Static allow/deny rules and ACLs Signature and behavioral rules for known attack patterns Typical deployment point Network perimeter or between internal subnets In front of or alongside web servers/load balancers Attacks stopped Port scans, unauthorized network access, network-layer floods SQL injection, XSS, CSRF, other OWASP Top 10 exploits Encrypted traffic handling Sees only packet headers, not TLS-encrypted payload Typically terminates TLS to inspect decrypted HTTP content Maintenance cadence Relatively static rule sets, infrequent changes Frequent signature updates as new exploits are discovered Key Differences A firewall filters at the network layer using IP and port, while a WAF filters at the application layer using HTTP content. Firewalls control which connections are permitted; WAFs inspect the payload within connections already allowed through. A WAF typically must decrypt TLS to read requests, whereas a firewall generally cannot see inside encrypted traffic. The two are complementary controls, not substitutes — each blocks a different class of attack the other misses. When to Use Each Firewall ...

Overview Perimeter Security protects a network by treating everything inside a defined boundary as trusted, while Zero Trust assumes no user or device is trusted and requires continuous verification for every request. The distinction matters because cloud adoption, remote work, and lateral-movement attacks have made a hardened network edge insufficient as the sole line of defense. Comparison Diagram Perimeter SecurityTrust based on network locationUserTrusted zone (flat network)FirewallApp ServerDatabaseFile ShareZero TrustVerify every request, every timeUserVerify IdentityApp ServerDatabaseFile ShareMicro-segmented (no lateral trust) Comparison Table Aspect Perimeter Security Zero Trust Core trust model Trust is granted based on network location; inside the boundary is assumed safe No implicit trust; identity and context are verified for every request Entry authentication Checked once at the network edge via firewall or VPN gateway Checked continuously, regardless of where the request originates Internal network structure Largely flat trusted zone once past the boundary Micro-segmented, with access scoped to individual resources Lateral movement after compromise High risk — a foothold on one host can reach many internal systems Low risk — each hop requires separate re-authorization Remote and cloud access Extends the perimeter to remote users via VPN tunnels Grants access by identity, independent of network location Breach containment A single perimeter breach can expose the entire internal network Blast radius limited to the specific resource and session compromised Policy enforcement point Centralized at the network edge (firewall, VPN gateway) Distributed per resource via a policy engine on each request Operational complexity Lower upfront complexity with coarse-grained rules Higher upfront complexity requiring fine-grained, continuously managed policies Key Differences Perimeter Security grants broad access once a device is inside the network boundary; Zero Trust re-authenticates every request. Zero Trust relies on micro-segmentation to isolate resources, whereas Perimeter Security typically has one flat trusted zone. Remote workers under Perimeter Security must tunnel in via VPN; Zero Trust grants access based on identity regardless of location. A breach inside a perimeter can move laterally with little friction; Zero Trust limits blast radius through continuous policy enforcement. Perimeter Security is simpler to deploy initially; Zero Trust requires ongoing identity and context evaluation infrastructure. When to Use Each Perimeter Security ...

Overview An IDS and an IPS both inspect network traffic for malicious patterns, but they sit in different places and react differently once a threat is found. An IDS works out-of-band, watching a copy of traffic and raising alerts, while an IPS works inline, sitting directly in the traffic path so it can block the packets itself. The distinction matters because it determines whether a false positive causes a noisy log entry or an actual outage. ...

Overview SSL and TLS are cryptographic protocols that secure data in transit between clients and servers, but SSL is the deprecated predecessor while TLS is its actively maintained successor. Every SSL version is now broken or prohibited, yet the term “SSL” persists in everyday usage even though modern connections actually negotiate TLS. Comparison Diagram SSLTLSSSL 2.0 (1995)broken by DROWNSSL 3.0 (1996)broken by POODLEall versions prohibitedTLS 1.0 (1999)TLS 1.1 (2006)TLS 1.2 (2008)widely deployedTLS 1.3 (2018)current standardtime →deprecated / prohibitedactively maintained Comparison Table Aspect SSL TLS Origin Developed by Netscape starting in 1995 Standardized by the IETF in 1999 as SSL’s successor Versions released SSL 2.0, SSL 3.0 (SSL 1.0 never shipped) TLS 1.0, 1.1, 1.2, 1.3 Handshake process Full handshake only, with weaker key exchange options Streamlined handshake; TLS 1.3 cuts a round trip and defaults to forward secrecy Cipher suite support Permits weak ciphers like RC4, DES, and export-grade crypto Mandates modern AEAD ciphers (AES-GCM, ChaCha20-Poly1305); weak ciphers dropped entirely in 1.3 Known vulnerabilities POODLE broke SSL 3.0; DROWN broke SSL 2.0 BEAST and CRIME hit early TLS 1.0 but were patched in later versions Current status All versions formally deprecated and prohibited (RFC 7568) TLS 1.2 and 1.3 are the current standards; 1.0/1.1 also deprecated Everyday terminology “SSL certificate” and “SSL/TLS” persist as colloquial shorthand The protocol actually negotiated by nearly every modern HTTPS connection Key Differences SSL is the obsolete predecessor; TLS is the actively maintained successor protocol TLS 1.3’s handshake trims a round trip compared to SSL’s full handshake SSL still permits weak ciphers like RC4; TLS mandates modern AEAD ciphers The label “SSL certificate” survives in marketing even though browsers negotiate TLS SSL 3.0 was broken by POODLE, forcing its complete deprecation When to Use Each SSL ...