Simple explanation
The foundational security vocabulary a networking professional needs — much of it overlapping with Security+, but viewed specifically through a networking lens.
Technical explanation
- CIA triad — confidentiality, integrity, availability, applied to network design decisions (encrypting traffic, validating data integrity, building for uptime).
- AAA — authentication, authorization, accounting, implemented at the network level via protocols like RADIUS and TACACS+ (both centralize authentication for network device/service access, TACACS+ separates authentication/authorization/accounting more granularly and is more common for device administration specifically).
- Zero trust — applied to network architecture: not granting broad trust just because traffic originates from inside the perimeter.
- Defense in depth — layering multiple security controls so no single failure exposes the whole network.
- Network segmentation — the network-specific implementation of least privilege at the architecture level, limiting how far a compromise can spread.
- DMZ (Demilitarized Zone) — a network segment for internet-facing services, isolated from the fully trusted internal network, so a compromise of a public-facing service doesn't directly expose internal systems.
- Honeypot — a decoy system, deployed to attract and study attacker behavior.
Synonyms / related terms
| Term | Means | |---|---| | RADIUS | Remote Authentication Dial-In User Service | | TACACS+ | Terminal Access Controller Access-Control System Plus | | DMZ | Demilitarized Zone |
Concept Check
"A network administrator wants to centralize authentication for administrative access to all network switches and routers, with fine-grained control over exactly which commands each admin can run on each device." TACACS+ is the better fit here over RADIUS — TACACS+'s separation of authorization from authentication allows this kind of granular, per-command control, while RADIUS combines authentication and authorization more tightly and is more commonly used for network access (like Wi-Fi/VPN) rather than device administration.
Interview-style Q&A
Q: Why place a public-facing web server in a DMZ rather than directly on the internal network? A: "If that web server is compromised — and internet-facing services are the most exposed attack surface any organization has — a DMZ placement means the attacker still has to cross another security boundary (typically another firewall) to reach the truly sensitive internal network. Placing it directly internal would give a single compromise immediate access to everything else."
Memory trick
"RADIUS bundles, TACACS+ splits" — RADIUS combines AAA more tightly; TACACS+ separates authorization out for finer control — the one distinction most worth remembering between the two.