Network Security
Firewalls, IDS/IPS, network segmentation, DNS security, SD-WAN, VPN, traffic analysis, wireless security.
What is Network Security?
Network security is the practice of protecting the integrity, confidentiality, and availability of data as it traverses or resides on computer networks. It encompasses the hardware, software, and policies designed to prevent unauthorized access, misuse, or denial of network resources — from perimeter firewalls and intrusion detection systems to modern SD-WAN architectures and encrypted tunnels.
The network remains the primary attack surface for most organizations. Adversaries exploit misconfigured firewalls, unmonitored DNS traffic, weak wireless security, and flat network architectures to gain initial access and move laterally. Effective network security requires defense in depth: segmenting networks to contain breaches, inspecting traffic at multiple layers, encrypting data in transit, and continuously monitoring for anomalous behavior.
Modern network security has evolved far beyond traditional perimeter defense. Software-defined networking, cloud-native network controls, encrypted DNS (DoH/DoT), and the dissolution of the corporate perimeter have forced a fundamental rethinking of how networks are secured. Network detection and response (NDR) platforms use behavioral analytics and machine learning to identify threats that signature-based tools miss.
Why it matters
The network is the connective tissue of every organization. If it is compromised, every system, application, and data store connected to it is at risk. Network security is the first and most fundamental layer of defense.
Network security provides the infrastructure-level controls that all other security domains depend on. Identity, application, and cloud security all ultimately rely on the network being trustworthy and resilient.
Build, Connect & Operate
Build and run the systems — apps, cloud, data, networks, OT, AI infra, supply chain, quantum engineering.
Other domains in this layer
Standards and frameworks
Curated resources
Authoritative sources we ground Network Security questions in — frameworks, research, guides, and tools.
CIS Controls v8
18 prioritized security controls organized into Implementation Groups (IG1, IG2, IG3). Practical and prescriptive — good for questions about prioritization and which controls matter most for different organization sizes.
Krebs, B. — KrebsOnSecurity
Investigative journalism on cybercrime, breaches, and network security incidents. Good for real-world scenario questions grounded in actual events.
Cisco Annual Internet Report
Network traffic trends, DDoS statistics, protocol adoption. Useful for questions about scale and real-world network security challenges, not Cisco product-specific.
NSA/CISA Top 10 Cybersecurity Misconfigurations
Based on real red/blue team assessments. Includes default configurations, improper privilege separation, lack of network segmentation. Excellent for practical scenario questions.
NIST SP 800-41 — Firewall and Firewall Policy Guidelines
Guidelines on firewalls and firewall policy. Covers types of firewall technologies, deployment architectures, and policy management.
Snort — Network Intrusion Detection
Open-source network intrusion detection and prevention system. Industry standard for real-time traffic analysis and packet logging.
Suricata — Network Threat Detection Engine
High-performance network IDS/IPS and security monitoring engine. Supports multi-threading, protocol identification, and file extraction.
Certifications that signal this domain
Credentials whose blueprint meaningfully covers this domain. Core means centrally covered; also touched means present in the blueprint but not the primary focus.
Core coverage
ISC2 Certified in Cybersecurity
The CC is ISC2's entry-level certification without experience requirements and explicitly targets career starters, career changers, and students. Notably, ISC2 periodically offers CC training and the exam for free (as part of the 'One Million Certified' initiative), which has significantly increased market penetration. Content covers five domains: Security Principles, Incident Response, Access Control, Network Security, and Security Operations – at a solid but intentionally broad entry level. As a stepping stone to SSCP or CISSP it is well-suited; as a standalone credential it carries less weight than Security+. From September 2026, a new Exam Outline applies.
Cisco Certified Internetwork Expert - Enterprise Infrastructure
Cisco Certified Internetwork Expert - Enterprise Infrastructure
Cisco Certified Implementation Expert - Security
Cisco Certified Implementation Expert - Security
Cisco Certified Network Associate
The CCNA is the most well-known entry-level certification in networking and provides a broad foundation: network fundamentals, routing & switching, IP services, security basics, as well as automation and cloud. Although primarily a networking certificate, it covers security fundamentals and is therefore also relevant for security beginners. The job market for CCNA holders is stable with consistently over 6,500 open positions per week (as of spring 2026). With version 1.1 (August 2024), AI/ML and cloud management topics were incorporated for the first time. Without hands-on experience in Cisco environments, completion remains rather theoretical.
Cisco Certified Network Professional - Enterprise
Cisco Certified Network Professional - Enterprise
Cisco Certified Network Professional - Security
Cisco Certified Network Professional - Security
Certified Ethical Hacker
Offensive-concepts breadth; light on hands-on rigor compared to OSCP.
Certified Information Systems Security Professional
Breadth across security engineering, architecture, operations, and governance at senior-IC / manager level. The default senior-generalist signal.
CISSP Information Systems Security Architecture Professional
Architecture concentration on top of CISSP — trust boundaries, identity / crypto / network composition, defense-in-depth design.
EC Council Certified Network Defender
EC Council Certified Network Defender
EC Council Certified Network Defense Architect
EC Council Certified Network Defense Architect
EC Council Certified Penetration Testing Professional
EC Council Certified Penetration Testing Professional
Zero Point Security Certified Red Team Operator
The CRTO from Zero-Point Security has established itself as one of the most practice-oriented red team certifications on the market. The associated course 'Red Team Ops' focuses on Cobalt Strike, Active Directory attacks, and realistic adversary simulation with OPSEC considerations. The exam format is purely practical and evaluates not only objective achievement but also operational behavior – points are deducted for triggered detections. Particularly attractive is the price-performance ratio compared to SANS certifications, as the course and exam are significantly more affordable. For experienced pentesters looking to develop towards red teaming and C2 deployment, the CRTO is a highly relevant qualification.
EC Council Certified Security Specialist
EC Council Certified Security Specialist
eLearnSecurity Junior Penetration Tester
Entry-level pentest — good first offensive signal.
F5 Big-IP Certified Administrator
F5 Big-IP Certified Administrator
F5 Big-IP Certified Solution Expert - Security
F5 Big-IP Certified Solution Expert - Security
Fortinet Certified Fundamentals Cybersecurity
Fortinet Certified Fundamentals Cybersecurity
Fortinet Certified Professional - Network Security
Fortinet Certified Professional - Network Security
Fortinet Certificed Solution Specialist - Network Security
Fortinet Certified Solution Specialist - Network Security
Fortinet Certified Solution Specialist - Public Cloud Security
Fortinet Certified Solution Specialist - Public Cloud Security
Fortinet Certified Solution Specialist - Zero Trust Access
Fortinet Certified Solution Specialist - Zero Trust Access
GIAC Assessing Wireless Networks
GIAC Assessing Wireless Networks
GIAC Certified Intrusion Analyst
Packet and log analysis, detection engineering fundamentals.
GIAC Certified Windows Security Administrator
GIAC Certified Windows Security Administrator
GIAC Foundational Cybersecurity Technologies
GIAC Foundational Cybersecurity Technologies
Global Industrial Cyber Security Professional
IT + engineering overlap for industrial control systems.
GIAC Penetration Tester
Penetration testing methodology + documentation.
GIAC Security Expert
The GIAC Security Expert (GSE) is the highest distinction in the GIAC certification system and was fundamentally reformed in 2023/2024: Instead of a single exam, it is now awarded as a portfolio certification. Those who demonstrate six Practitioner and four Applied Knowledge certifications (hands-on, proctored lab exams) automatically receive GSE status. The model enforces genuine breadth and depth – which increases credibility compared to earlier pure knowledge tests. However, the effort (cost, time, multiple exams) is considerable; the GSE is therefore clearly aimed at experienced experts pursuing SANS/GIAC as a career path. In Europe, awareness outside the SANS community is still limited.
GIAC Security Essentials
Broad defender fundamentals. Often paired with SANS SEC401.
Hack the Box Certified Penetration Testing Specialist
Hack the Box Certified Penetration Testing Specialist
Juniper Networks Certified Internet Associate, Security
Juniper Networks Certified Internet Associate, Security
Juniper Networks Certified Internet Expert, Security
Juniper Networks Certified Internet Expert, Security
Juniper Networks Certified Internet Professional, Security
Juniper Networks Certified Internet Professional, Security
Juniper Networks Certified Internet Specialist, Security
Juniper Networks Certified Internet Specialist, Security
Offensive Security Certified Professional
Hands-on penetration testing — exploitation, privilege escalation, AD attacks.
Offensive Security Experienced Penetration Tester
The OffSec Experienced Penetration Tester (OSEP) is based on the PEN-300 course and addresses advanced techniques around antivirus evasion, Active Directory attacks, and living-off-the-land methods. The fully practical 48-hour exam (47:45 hrs exam + 24 hrs report) in a simulated enterprise environment is the key difference from knowledge-based certifications—it tests real attack capabilities. OSEP is considered credible proof of high-level offensive competence in red team circles, but requires solid OSCP knowledge. Together with OSED and OSWE, OSEP forms the OSCE³ trio.
Offensive Security Wireless Professional
Offensive Security Wireless Professional
Palo Alto Networks Certified Cybersecurity Entry-level Technician
Palo Alto Networks Certified Cybersecurity Entry-level Technician
Palo Alto Networks Certified Network Security Administrator
Palo Alto Networks Certified Network Security Administrator
Palo Alto Networks Certified Network Security Engineer
Palo Alto Networks Certified Network Security Engineer
Practical Network Penetration Tester
Hands-on network + AD pentesting with OSINT + reporting.
Red Hat Certified System Administrator
Red Hat Certified System Administrator
CompTIA Security+
Broad entry-level knowledge across threats, ops, IAM, network, and crypto basics.
(ISC)2 Systems Security Certified Practitioner
The SSCP is ISC2's entry-level certification below the CISSP and targets technically active security professionals with initial work experience. Since October 2025, the exam uses Computerized Adaptive Testing (CAT), which customizes the exam experience individually and increases integrity. The SSCP covers seven technical domains, from access control through cryptography to network security, and positions itself as practical proof of operational security competence. It is less well-known than Security+ or GSEC, but benefits from ISC2's strong brand and serves well as an intermediate step toward the CISSP. The effort for annual certification maintenance (AMF + CPEs) is moderate.
VMware Certified Implementation Expert in Network Virtualization
VMware Certified Implementation Expert in Network Virtualization
VMware Certified Professional in Datacenter Virtualization
VMware Certified Professional in Datacenter Virtualization
VMware Certified Professional in Network Virtualization
VMware Certified Professional in Network Virtualization
Also touched
Microsoft Certified: Azure Security Engineer Associate
Azure-native security engineering: Entra ID, network controls, Defender, Sentinel.
Certified Red Team Expert
Multi-forest AD compromise — cross-trust abuse, advanced delegation, and persistence in hardened enterprise environments.
Certified Red Team Professional
Hands-on Active Directory attacker — Kerberos abuse, trust attacks, and lateral movement against a real multi-domain forest.
Certified Zero Trust (CCZT)
Vendor-neutral Zero Trust architecture and governance — NIST SP 800-207, ZTA pillars, and program implementation.
Browse all certifications → — pick a cert on the interactive map to highlight every domain it covers.
Education and certifications
More in Cybersecurity
Test what you know about Network Security
41 questions available. Beginner to expert questions, scored against the global leaderboard.