Systems and network security: hardening, segmentation and Zero Trust
Lesson 4 of 4
4Systems and network security: hardening, segmentation and Zero Trust
The big pictureOld castles had a wall and a moat, and whoever passed the gate roamed freely. Company networks were built the same way for decades, which is why breaking into one machine was enough to reach everything. Modern security assumes the attacker may already be inside.
What the picture shows: Left: once inside the castle you reach every server. Right: every server checks every request, so an attacker who got in cannot take a step without being asked.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
A safe home is not the one with the most locks, but the one where: the broken windows are fixed (patching), the doors you never use are closed (hardening), rooms have their own locks so a burglar in the lounge cannot reach the safe (segmentation), anyone entering a room is asked even inside the house (Zero Trust), and your photos are kept at a relative's in another city (backups).
Vulnerability management: regular scans, then prioritising by real exploitation (CISA KEV, EPSS) rather than CVSS alone, then patching within an SLA. Shrinking the attack surface and hardening per the CIS Benchmarks. Segmentation with VLANs, internal firewalls and micro-segmentation to stop lateral movement. Zero Trust (NIST SP 800-207): no implicit trust by location, a decision for every request from identity, device and context. EDR watches process behaviour. Backups 3-2-1-1-0 (one immutable copy, zero restore errors). Cloud: the shared responsibility model, where the commonest mistakes are IAM settings and public storage buckets.
Before You Start
🛰️Network security (networking path)
This part assumes you know ACLs, firewalls, VLANs and VPNs.
🎯How attackers think
Lateral movement and attacker tactics.
The Core Idea
1Patching and vulnerability management
Since exploiting flaws became the top way in, patching is the most important boring job in security. Nobody patches everything at once, so the question is: which first? The modern answer: whatever is actually being exploited now, which is what CISA's Known Exploited Vulnerabilities (KEV) list gathers, not just the highest theoretical score.
2Hardening and segmentation
Hardening reduces what can be attacked: remove unused services and software, change default passwords, and apply reference settings such as the CIS Benchmarks. Segmentation splits the network into zones with walls between them, so a hacked camera on the guest network cannot reach the accounting servers.
3Zero Trust and EDR
Zero Trust does not mean "trust nobody" as in suspecting staff, but: no automatic trust because of location. Being on the office network is not enough; every request is judged by identity, device, its health and context. EDR is software on each machine that watches behaviour rather than only known signatures: Word launching PowerShell? That is odd, so it alerts and isolates.
4Backups and the cloud
In the cloud responsibility does not all move to the provider. It protects the building, hardware and network; you protect your settings, identities and data. The best-known cloud incidents are not clever hacks but a storage bucket left public or an access key published to GitHub by mistake.
Worked example
The task: a scan found 400 vulnerabilities and the team can fix 30 this week. How do you order them?
The answer: (1) start with flaws on the CISA KEV list on internet-facing systems: VPN, mail gateways, websites. (2) Then KEV flaws on sensitive internal systems. (3) Then critical flaws with a public exploit even if not on KEV. (4) The rest by CVSS score and asset importance. And if an old system cannot be patched, isolate it in its own network segment and watch it.
Myth vs Reality
| Myth | Reality |
|---|---|
| The internal company network is safe by nature. | An attacker who gets in through a phishing email is inside. That is why Zero Trust exists. |
| The cloud is safe because the provider is a big company. | The provider protects the infrastructure; your settings, access and data are your job. |
Where you meet it at work
🏠At home
A separate guest network for visitors and smart devices, automatic updates, and a copy on an unplugged drive.
🖥️Sysadmin
Runs patching by KEV and applies the CIS Benchmarks to servers.
☁️Cloud engineer
Reviews IAM permissions and blocks public storage by default.
Test your understanding
The 3-2-1 backup rule means:
The separate copy is what saves you from ransomware, because attackers try to delete connected copies.
What is the Zero Trust principle?
Each request is decided by identity, device and context, not by being inside the network.
Which flaws do you patch first?
Real exploitation and internet exposure make the likelihood far higher.
What is the core rule of Zero Trust?
Every request is checked by identity, device and context wherever it comes from.
Which flaws do you patch first?
Real risk = actual exploitation + exposure.
Quick review cards
Check Your Understanding
Why does segmentation reduce ransomware damage?
Because it spreads over the network; walls between segments keep the infection in one place.
What can EDR not do on its own?
It cannot stop a sign-in with stolen credentials to a cloud service it does not see, and it does not replace patching or MFA.
Why does segmentation limit ransomware damage?
Because an infected machine only reaches its own segment, so lateral movement stops at its border.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.