5.6 Network Security Controls and Architecture

EC-Council Certified Ethical Hacker CEH

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map

2 Reconnaissance, Footprinting, Scanning & Enumeration

2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures

3 Vulnerability Analysis & System Hacking Phases

3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection

4 Malware Threats, Sniffing & Social Engineering

4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses

5 Network & Perimeter Hacking

5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders

6 Web Server & Web Application Hacking

6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts

7 Wireless Network Hacking

7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures

8 Mobile Platform, IoT & OT Hacking

8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security

9 Cloud Computing & Cryptography

9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices

5.6 Network Security Controls and Architecture

Key Takeaways Explain This Topic AI

Defense-in-depth layers controls (physical, network, host, application, data) so no single failure exposes the asset; segmentation and least privilege limit blast radius.

Network segmentation, DMZs, and VLANs separate trust zones; a Zero Trust model assumes breach and verifies every request rather than trusting the internal network.

NAC enforces device posture before granting access; 802.1X port-based authentication, RADIUS, and VPNs control who and what connects.

Logging, SIEM correlation, and continuous monitoring turn raw events into detection; honeypots, IDS/IPS, and NGFWs feed that pipeline.

The CIA triad (confidentiality, integrity, availability) plus AAA (authentication, authorization, accounting) are the framework CEH maps every control back to.

Last updated: June 2026

Defense-in-Depth and Trust Zones

No single control stops every attack, so secure networks apply defense-in-depth — overlapping layers so that a failure at one layer is caught by another. CEH frames the layers as physical, perimeter (network), host, application, and data , each with its own controls. The complementary principle is least privilege : every user, device, and service gets only the access it needs, shrinking the blast radius of any compromise.

Networks are divided into trust zones . A classic three-zone design has the untrusted Internet , a semi-trusted DMZ (screened subnet) hosting public-facing servers, and the trusted internal LAN . Firewalls enforce policy at each boundary; a bastion host is a hardened system deliberately exposed in the DMZ. VLANs logically separate segments on shared switches, and network segmentation/micro-segmentation confines lateral movement so that breaching one segment does not grant the whole network.

Architecture Element Purpose
DMZ / screened subnet Isolate public servers from the internal LAN
VLAN segmentation Separate departments/functions on shared hardware
Bastion host Hardened, exposed gateway system
Air gap Physically isolate the most sensitive systems

Access Control, NAC, and Zero Trust

Controlling who and what connects is foundational. Network Access Control (NAC) evaluates a device's posture (patch level, antivirus, configuration) before granting access, quarantining non-compliant endpoints. IEEE 802.1X provides port-based network access control: a supplicant authenticates to an authenticator (switch/AP) which checks credentials against a RADIUS server before opening the port. VPNs (IPsec, SSL/TLS) extend the trusted boundary securely across untrusted networks.

The modern direction is Zero Trust , which discards the old "hard shell, soft interior" assumption that the internal network is safe. Zero Trust principles: never trust, always verify ; assume breach ; authenticate and authorize every request based on identity, device health, and context; and enforce least-privilege micro-segmentation . Every control maps to the AAA framework — Authentication (who are you), Authorization (what may you do), and Accounting/Auditing (what did you do) — and to the CIA triad of Confidentiality, Integrity, and Availability that defines security goals.

When an exam item asks which property a control protects, trace it to CIA: encryption serves confidentiality, hashing/digital signatures serve integrity, and redundancy/anti-DDoS serves availability.

Detection, Monitoring, and Logging

Prevention is never perfect, so detection is mandatory. Network sensors ( NIDS/NIPS , NGFWs ), host agents ( HIDS/EDR ), and decoys ( honeypots/honeytokens ) generate events that flow into a Security Information and Event Management (SIEM) platform. The SIEM correlates logs across sources to surface multi-step attacks that any single device would miss, and supports alerting, dashboards, and forensic search.

Key monitoring controls and what they catch:

Control Detects
SIEM correlation Multi-stage attacks across systems
NetFlow / traffic analysis Volumetric anomalies, beaconing, exfiltration
Centralized logging Tampering, lateral movement, policy violations
File integrity monitoring Unauthorized changes to critical files
EDR Endpoint process/behavior anomalies

Logs must be centralized and tamper-resistant (attackers clear local logs to cover tracks — the fifth phase of the hacking methodology), time-synchronized via NTP , and retained per policy.

Hardening and Putting It Together

Beyond architecture, individual systems are hardened : disable unused services and ports, patch promptly, enforce strong authentication and MFA, remove default credentials, and apply secure baselines (CIS Benchmarks). At the network layer, defenders enforce egress filtering , disable IP source routing, secure switch ports against MAC flooding/ARP spoofing (port security, DHCP snooping, Dynamic ARP Inspection), and encrypt management traffic.

A layered perimeter for a typical enterprise combines, from outside in: an NGFW with integrated IPS at the edge, a DMZ for public services, NAC + 802.1X controlling internal access, segmentation/VLANs limiting lateral movement, honeypots as tripwires, and a SIEM correlating everything. Critically, these controls reinforce each other: the firewall blocks the obvious, the IDS/IPS catches what gets through, segmentation contains what is missed, the honeypot flags lateral movement, and logging/SIEM provides the evidence trail.

Layer-2 (switch) hardening deserves special attention because many attacks in this chapter begin there. MAC flooding overflows a switch's CAM table to force it to behave like a hub (flooding frames to all ports so the attacker can sniff) — port security limiting MACs per port stops it. ARP spoofing/poisoning underpins MITM and session hijacking; Dynamic ARP Inspection (DAI) validates ARP replies against a trusted DHCP snooping binding table. VLAN hopping (double-tagging or switch spoofing) is blocked by disabling Dynamic Trunking Protocol on access ports and never using the native VLAN for user traffic.

Rogue DHCP servers are blocked by trusting DHCP only on known uplink ports.

The exam-level synthesis: map every control to the CIA triad and AAA , prefer defense-in-depth with least privilege , segment aggressively, and assume breach ( Zero Trust ). No control is sufficient alone — security is the combination , tuned and monitored continuously, with detection and response assumed because prevention will eventually fail. CEH ties this back to the risk-management mindset : identify assets, apply controls proportionate to threat and value, and accept that residual risk is managed, never eliminated.

The perimeter is no longer a single wall but a series of reinforcing zones, each with prevention, detection, and a path to response.