Chapter 1

Foundations of network security

Last updated November 20264 sectionsabout 9 min read

Key takeaways

Security protects systems, networks and data from unauthorised access, damage or disruption, through technical controls, policy and trained behaviour together.
A vulnerability is a weakness a threat could exploit; it becomes an attack only when someone deliberately tries to exploit it.
A well-defended network layers several controls, such as access control, antivirus, firewalls, behavioural analytics, data loss prevention, web security and network segmentation, rather than relying on any single one.
Malware attacks a system through malicious software, while social engineering manipulates people, which is why no firewall or antivirus stops a user who hands over their own password.
A breach can expose sensitive data, disrupt operations and damage reputation, and in Kenya the Data Protection Act, 2019 and the Computer Misuse and Cybercrimes Act, 2018 turn weak security into a legal exposure as well.

Every control and framework in the rest of this paper exists to answer one question: how does an organisation stop the vulnerabilities in its network from becoming a successful attack? This chapter sets out the foundational vocabulary, the categories of control available, the categories of vulnerability they defend against, and why the whole discipline matters enough to be a dedicated paper in this diploma.

Key terms

Security

Protecting systems, networks and data from unauthorised access, damage or disruption, through a combination of technical controls, policy and trained behaviour.

Vulnerability

A weakness in a system, in its software, configuration, or the people operating it, that a threat could exploit if left unaddressed.

Attack

A deliberate attempt to exploit a vulnerability and compromise a system, distinguishing a genuine incident from a vulnerability that exists but has not (yet) been exploited.

Types of network security controls

Network security controls span software, configuration and human behaviour, and a well-defended network layers several of them rather than relying on any single one.

Access control

Restricting who and what can connect to or use network resources, the first gate any user or device must pass.

Antivirus

Software detecting and removing malicious code before, or after, it runs on a system.

Application security

Hardening the applications running on the network against exploitation: secure coding practice, patching, and configuration that closes off unnecessary features an attacker could abuse.

Behavioural analytics

Detecting anomalies by learning what normal network activity looks like for a given user or system, and flagging deviations that a signature-based tool would miss entirely, since the deviation itself, not a known malicious pattern, is what is detected.

Data loss prevention (DLP)

Controls that detect and block sensitive data from leaving the network improperly, such as a large customer database being copied to an external drive or emailed outside the organisation.

Firewall

Monitors and controls traffic entering and leaving the network based on defined rules, the network's first line of defence at its boundary.

Web security

Controls protecting users and systems from web-based threats: malicious sites, drive-by downloads, and content filtering against known-bad destinations.

Network segmentation

Dividing a network into smaller isolated zones, so a breach in one segment does not automatically expose the whole network, developed fully in the chapter on deploying security solutions.

Types of network vulnerabilities

Malware

Malicious software, viruses, worms, ransomware and spyware, designed to damage, disrupt or steal from a system, and the target antivirus and behavioural analytics exist to catch.

Social engineering attacks

Manipulating people, rather than exploiting a technical flaw, into revealing credentials or granting access: phishing, pretexting and impersonation, developed fully in the chapter on testing network vulnerability. No firewall or antivirus stops a user who is convinced to hand over their own password voluntarily.

Why network security matters

Network security matters because a breach can expose sensitive data, disrupt operations, damage an organisation's reputation, and carry real legal and financial consequences, the reason this diploma treats it as a dedicated paper rather than a side note. In Kenya, the Data Protection Act, 2019 and the Computer Misuse and Cybercrimes Act, 2018 add legal weight to what is otherwise already good practice: a breach of personal data can trigger a reporting duty to the Office of the Data Protection Commissioner, and unauthorised access or interference is a criminal offence, so weak network security is not merely a technical shortcoming but a compliance and legal exposure for the organisation.

Tracing a single weak control to its full consequence
A small clinic's Wi-Fi uses a password unchanged since installation, known to several former staff and shared casually with patients. There is no network segmentation between the guest Wi-Fi and the clinic's own patient-records server.
An outsider with the old password connects to the Wi-Fi, and because there is no segmentation, that connection reaches the same network segment the patient-records server sits on.
The vulnerability (a weak, widely known password and no segmentation) becomes an attack when the outsider actually uses that access to probe the records server for weaknesses.
The consequence chain runs through every reason network security matters at once: exposed patient data (a sensitive-data breach), disrupted operations if the server is taken down or ransomed, reputational damage once patients learn of it, and a legal reporting duty to the Data Protection Commissioner, all traceable back to two missing controls, access control (a weak, unrotated password) and network segmentation.
This is the pattern worth remembering for a scenario question: name the specific missing control, then trace it forward to the specific consequence, rather than describing the breach and the harm as two unrelated facts.

Self-check

(a) Define security, vulnerability and attack, and explain how the three relate. (3 marks)

(b) State four types of network security control and the specific threat each addresses. (4 marks)

(c) Distinguish malware from a social engineering attack, and explain why a firewall alone does not stop the second. (3 marks)

(d) State three consequences of a network security breach for an organisation. (3 marks)

(e) Name two Kenyan laws relevant to network security and state what each governs. (2 marks)

(f) A clinic's Wi-Fi password is old and widely known, and there is no segmentation between the guest network and the patient-records server. Trace the specific missing controls to the specific consequence a breach through this path would cause. (4 marks)

Show worked answer

(a) Security is protecting systems, networks and data from unauthorised access, damage or disruption. A vulnerability is a weakness that could be exploited. An attack is a deliberate attempt to actually exploit a vulnerability. A vulnerability that is never exploited never becomes an attack; security exists to close vulnerabilities before that happens.

(b) Access control: restricts who and what can connect, addressing unauthorised connection. Antivirus: detects and removes malicious code, addressing malware. Firewall: monitors and controls boundary traffic, addressing unwanted inbound or outbound connections. Data loss prevention: blocks sensitive data leaving improperly, addressing data exfiltration. Any four.

(c) Malware is malicious software designed to damage, disrupt or steal from a system through a technical mechanism. A social engineering attack manipulates a person, rather than exploiting a technical flaw, into revealing credentials or granting access. A firewall controls network traffic and cannot stop a user who is convinced to hand over their own password voluntarily, since no unauthorised traffic pattern is involved.

(d) Exposure of sensitive data; disruption of operations; damage to reputation (also legal and financial consequences). Any three.

(e) The Data Protection Act, 2019 governs the collection, use and protection of personal data and requires breach reporting to the Office of the Data Protection Commissioner. The Computer Misuse and Cybercrimes Act, 2018 makes unauthorised access, interference and interception of computer systems criminal offences.

(f) The weak, widely known Wi-Fi password is a failure of access control, letting an unauthorised outsider connect. The missing segmentation means that connection reaches the same segment as the patient-records server. Together they let an outsider probe and potentially compromise patient data, leading to a data breach, operational disruption if the server is affected, reputational damage, and a legal duty to report the breach to the Data Protection Commissioner.

Exam tip

Network segmentation is one of the most consistently recommended controls across scenarios; its value is limiting the blast radius of a breach, so a single compromised segment should not automatically expose everything else on the network. When a scenario asks for consequences, trace the specific missing control forward to the specific harm rather than listing generic breach outcomes.