Learning Objectives:

  • Understand the principles of network security.

  • Implement perimeter security controls, including firewalls, IDS/IPS, and proxy servers.

  • Apply secure network segmentation and isolation techniques.

  • Recognise the importance of network monitoring and threat detection.

4.1 Network Security Principles

Network security is the protection of the network infrastructure from unauthorised access, misuse, malfunction, modification, destruction, or improper disclosure. The IT Security Controls book covers a wide range of technical controls related to network security, including:

Perimeter Security Controls: Firewalls, Intrusion Detection and Prevention Systems (IDS/IPS), Proxy and Content (URL) Filtering, Data Loss Prevention (DLP), Honeypot, Web Application Firewall (WAF), SSL VPN, DNS, Message Security, Sandbox, File Integrity, and Encrypted Email.

On-Premises Support Controls: Access Control, Secure VLAN Segmentation, Security Baselines, Redundancy, Load Balancing, Encryption, Multi-tier and Multi-layer, TLS Decryption, Perimeter Static Routing, Heartbeat Interfaces, Disaster Recovery, Time Synchronization, Log Concentrator, Routing and Management Networks, Sinkhole, Public Key Infrastructure (PKI), and Physical Network Segmentation.

4.2 Perimeter Security Controls

Perimeter security controls are the first line of defence against external threats:

Firewalls: Firewalls filter traffic between networks based on security rules. The Regulation on Information Systems and Cyber Risk Management requires financial institutions to have adequate protection measures in place to safeguard ICT systems at the network level .

Intrusion Detection and Prevention Systems (IDS/IPS): IDS/IPS monitor network traffic for suspicious activity and can block or alert on potential threats. The IT Security Controls book includes IDS/IPS as a key perimeter security control.

Web Application Firewalls (WAF): WAF protects web applications from attacks such as SQL injection and cross-site scripting.

Proxy and Content Filtering: Proxy servers and content filtering controls restrict access to inappropriate or malicious websites.

4.3 Secure Network Segmentation

Network segmentation is the practice of dividing a network into smaller subnetworks to improve security and performance. Secure network segmentation limits the lateral movement of attackers within the network, containing the impact of a breach. The Regulation on Information Systems and Cyber Risk Management requires financial institutions to have adequate protection measures in place to safeguard ICT systems at the network level .

Key Segmentation Techniques:

VLAN Segmentation: Virtual Local Area Networks separate traffic into logical groups.

Multi-tier Architecture: Separating presentation, application, and data tiers.

Physical Network Segmentation: Physically separating networks for different security zones.

4.4 Network Monitoring and Threat Detection

The ECB’s SREP methodology requires that financial institutions have procedures in place for collecting, logging and analysing security-relevant events in order to trigger actionable security alerts or initiate the security incident process . The Regulation on Information Systems and Cyber Risk Management requires that financial institutions have adequate protection measures in place to safeguard ICT systems at the network and end-point levels .

Key Network Monitoring Activities:

Security Information and Event Management (SIEM): SIEM systems collect and analyse security events from across the network.

Log Analysis: Analysing logs to identify security incidents.

Network Anomaly Detection: Detecting unusual network behaviour that may indicate a security incident.

Threat Intelligence: Integrating threat intelligence feeds to improve detection capabilities.

PreviousNext