Week 4.0 Evaluate Network Security Capabilities, Active defense and Secure Communication

Overview

This module focuses on the core technologies, security tools, and mechanisms that organizations use to protect their networks, control access, and secure remote connections. It starts with the basics of traffic protection, beginning with Firewalls, which serve as the first line of defence by monitoring network traffic and implementing security regulations. packets, block malicious connections, and separate trusted zones from untrusted networks like the internet.

Building on this, the module introduces Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), which monitor network traffic for suspicious behavior. IDS alerts administrators when potential attacks are detected, while IPS goes a step further by automatically blocking harmful activity. Together, they provide critical visibility into threats and help shut down attacks before damage occurs.

Students are then guided into Security Information and Event Management (SIEM), a technology that centralizes logs, correlates events, and generates alerts to detect threats across the entire organization. SIEM platforms combine real-time monitoring with analytics, forming the backbone of modern security operations.

The course also covers how organizations maintain secure system baselines using Benchmarks and Secure Configuration Guides, such as CIS Benchmarks or vendor-specific hardening guides. These resources help ensure systems are configured safely and consistently, reducing the attack surface.

Next, learners study wireless protection mechanisms, starting with Wireless Encryption (WEP, WPA2, WPA3) and Wi-Fi Authentication Methods, including PSK, 802.1X, and Enterprise authentication using RADIUS. These topics explain how wireless networks prevent eavesdropping and ensure only approved users gain access.

The module also examines Network Access Control (NAC), which enforces security policies before a device is allowed on the network. NAC solutions verify device health, user identity, and compliance before granting access. Complementing this, Access Control Lists (ACLs) teach learners how routers, switches, and firewalls enforce rules that permit or deny specific traffic.

To further enhance network security and performance, students explore Web Filtering technologies that block malicious or inappropriate content; Load Balancers, which distribute traffic across multiple servers to improve reliability; and Deception Technologies, which use decoy systems like honeypots to trap attackers and gather intelligence.

A significant portion of the module covers secure remote connectivity. Remote Access Architecture explains the structure and tools needed to connect remote users securely. This includes Transport Layer Security (TLS) Tunneling, which protects data in transit, and IPsec Tunneling, which secures VPN communication at the network layer. Learners also explore Internet Key Exchange (IKE), the protocol used for negotiating keys in IPsec tunnels, ensuring encrypted communication is built on strong, trusted foundations.

Finally, the module covers Remote Desktop, a widely used method for accessing systems remotely for support, administration, or telework. Students learn the risks, security options, and best practices to protect remote desktop protocols from unauthorized access.

By the end of this module, learners will understand the essential technologies that defend networks, secure wireless and wired connections, manage access, and protect remote communication. This knowledge forms a critical part of modern cybersecurity operations, enabling students to design, deploy, and manage secure architectures.