Introduces the fundamental concepts, purpose and applications of computer networks.
Explores different network classifications based on geographical coverage, purpose and architecture.
Introduces different physical and logical network structures and how network devices are organised.
Provides practical knowledge of the hardware used to build and connect computer networks.
Introduces the physical and wireless technologies used to transmit data across networks
Explains how network communication is structured using standard models and protocols.
Introduces Ethernet technology and the role of MAC addresses in local network communication
Develops practical understanding of IPv4 addressing and network identification
Teaches learners how to divide networks into smaller subnets and introduces IPv6 addressing.
Introduces network switching and provides practical skills for configuring and managing switches.
Teaches learners how to logically separate networks and carry traffic between network segments.
Introduces routing and explains how routers forward traffic between different networks.
Explores essential network services that support addressing, name resolution and internet connectivity.
Provides practical knowledge of wireless networks and access point configuration.
Introduces fundamental techniques for protecting networks, devices and network traffic.
Develops practical skills for managing, monitoring and troubleshooting computer networks.
Introduces modern networking technologies and the role of networking in cloud and virtualised environments.
Enables learners to apply their networking knowledge by designing, configuring, testing and documenting a complete network solution
Course: Computer Networking
Level: Beginner
Recommended Duration: 2–3 Hours
Font Size: 13 pt
Line Spacing: 1.5
Delivery Mode: Physical and Online Learning
Computer networks allow users and devices to communicate and share information. However, connecting computers to a network also creates security risks. Attackers may attempt to access systems without permission, steal information, modify data, install malware, or make network services unavailable.
Network security is therefore an important part of computer networking. It combines security policies, technologies, configurations, and user practices to protect network devices, systems, applications, and data from unauthorized access, misuse, disruption, and attacks. Modern network security normally uses multiple layers of protection rather than relying on a single security mechanism.
In this lesson, learners will be introduced to the major concepts used to secure computer networks.
By the end of this lesson, the learner should be able to:
Define network security.
Explain why network security is important.
Identify common network security threats.
Explain confidentiality, integrity, and availability.
Differentiate authentication and authorization.
Explain access control.
Describe encryption and its purpose.
Explain the role of firewalls.
Differentiate IDS and IPS.
Explain network segmentation.
Describe VPNs and their security purpose.
Explain secure wireless networking.
Identify common network security practices.
Apply basic security principles to a small network.
Identify common network security problems and suggest appropriate controls.
Network security refers to the policies, procedures, technologies, and practices used to protect a computer network and its resources from unauthorized access, attacks, misuse, damage, and disruption.
Network security protects:
Computers
Servers
Routers
Switches
Wireless access points
Network applications
Databases
Files
User accounts
Internet connections
Cloud resources
Network traffic
For example, a training institution may use passwords, firewall rules, secure Wi-Fi, antivirus software, VLANs, user permissions, and regular backups to protect its network.
A network may contain valuable information such as:
Student records
Employee information
Financial information
Passwords
Business documents
Customer information
Examination records
Research data
Email communication
If attackers gain unauthorized access, the organization may experience financial losses, data breaches, service interruption, reputational damage, or loss of important information.
Network security helps organizations:
Prevent unauthorized access.
Protect confidential information.
Detect suspicious activity.
Reduce the impact of attacks.
Maintain network availability.
Protect users and devices.
Support business continuity.
Meet security and compliance requirements.
One of the fundamental concepts of information and network security is the CIA triad.
CIA stands for:
Confidentiality
Integrity
Availability
Confidentiality means ensuring that information is accessible only to authorized people or systems.
Example:
A student's academic record should only be accessible to authorized staff and the student where appropriate.
Security controls that support confidentiality include:
Passwords
Access permissions
Encryption
Multi-factor authentication
Network segmentation
Integrity means protecting information from unauthorized or accidental modification.
Example:
If a student's examination mark is 70%, an unauthorized person should not be able to change it to 90%.
Integrity can be supported by:
Access controls
Hashing
Digital signatures
File permissions
Audit logs
Change management
Availability means ensuring that authorized users can access systems and information when needed.
Example:
An online learning platform should remain available to students and instructors during training.
Availability can be improved through:
Backups
Redundant network equipment
Reliable power
Network monitoring
Disaster recovery
Protection against denial-of-service attacks
Authentication is the process of verifying the identity of a user, device, or service.
A common example is entering:
Username + Password
Other authentication methods include:
PINs
Security tokens
One-time passwords
Smart cards
Fingerprints
Facial recognition
Mobile authentication applications
Multi-factor authentication
Modern authentication guidance from NIST describes authentication as establishing that a person attempting to access a digital service controls the authenticator associated with the claimed identity.
Authorization determines what an authenticated user is allowed to access or do.
For example:
A user may successfully log into a school management system but may only be authorized to view student information.
An administrator may be authorized to:
Create accounts
Delete accounts
Change permissions
Configure the system
View reports
Therefore:
Authentication = Who are you?
Authorization = What are you allowed to do?
Access control is the process of regulating who or what can access network resources.
Examples include:
User accounts
Password policies
File permissions
Firewall rules
VLAN restrictions
Access Control Lists (ACLs)
Role-based permissions
Device authentication
NIST identifies access control as a fundamental aspect of computer security and explains that it involves both authentication and the structure of authorizations.
The principle of least privilege means giving a user, application, or device only the permissions necessary to perform its required tasks.
For example:
A receptionist may need access to appointment information but does not necessarily need administrator access to the entire server.
This reduces the damage that can occur if an account is compromised.
Passwords are one of the most common methods of authentication.
A good password policy should encourage users to:
Use sufficiently long passwords.
Avoid easily guessed information.
Avoid sharing passwords.
Use unique passwords for important accounts.
Use a password manager where appropriate.
Enable multi-factor authentication where available.
Weak passwords such as:
123456
password
admin
uganda123
can be easily guessed or attacked.
Multi-factor authentication, or MFA, requires more than one form of verification.
The factors commonly include:
Something you know — password or PIN.
Something you have — phone, security key, or token.
Something you are — fingerprint or facial recognition.
Example:
A staff member enters a password and then confirms a login using an authentication application on a mobile phone.
Even if the password is stolen, the attacker may still be unable to access the account without the second factor.
Encryption converts readable information, known as plaintext, into protected information called ciphertext.
The encrypted information can only be properly understood after the appropriate decryption process.
Example:
A learner logs into an online learning platform over HTTPS. Encryption helps protect information transmitted between the learner's device and the website.
Encryption can protect:
Passwords in transit
Financial transactions
Emails
VPN communications
Stored files
Database information
Wireless communications
Encryption is an important security mechanism because intercepted information may otherwise be readable.
A firewall is a security control that monitors and controls network traffic according to defined security rules.
A firewall can decide whether particular traffic should be:
Allowed
Blocked
Logged
Inspected
For example:
A company may configure its firewall to allow web traffic while blocking unauthorized incoming connections to internal servers.
Firewalls may be implemented as:
Hardware appliances
Software firewalls
Cloud-based firewalls
Next-generation firewalls
Modern network security commonly combines firewalls with other controls such as IDS/IPS, segmentation, VPNs, and monitoring.
An Intrusion Detection System monitors network or system activity and looks for suspicious behavior.
An IDS can generate an alert when it identifies potentially malicious activity.
Example:
An IDS detects repeated suspicious connection attempts against a server and alerts the network administrator.
IDS primarily focuses on detection and alerting.
An Intrusion Prevention System can detect suspicious activity and take action to prevent or block it.
For example:
An IPS may identify malicious traffic and block the connection.
Simple distinction:
IDS → Detects and alerts.
IPS → Detects and can prevent/block.
Network security is not limited to routers and firewalls.
Computers and other devices connected to a network must also be protected.
Endpoint security can include:
Antivirus software
Anti-malware protection
Host firewalls
Security updates
Device encryption
Application controls
Device management
A compromised laptop can become a pathway for attackers to enter other systems.
Network segmentation divides a network into separate logical or physical sections.
For example, an organization could create separate network segments for:
Administration
Students
Staff
Guests
Servers
CCTV
Voice communication
VLANs are commonly used to implement logical network segmentation.
Segmentation can limit how far an attacker can move after compromising one part of a network.
Wireless networks require appropriate security controls because users connect through radio communication.
Important wireless security practices include:
Use modern Wi-Fi security.
Change default administrator credentials.
Use strong Wi-Fi passwords.
Disable unnecessary services.
Create a separate guest network.
Update access point firmware.
Monitor connected devices.
Avoid using obsolete security protocols.
Example:
A training institution can provide:
Staff Wi-Fi → Internal resources
Student Wi-Fi → Learning resources
Guest Wi-Fi → Internet only
This reduces unnecessary access between different groups.
A Virtual Private Network creates a protected communication path over another network, commonly the Internet.
VPNs can be used for:
Remote workers
Site-to-site connections
Secure access to organizational systems
Connecting branches
Protecting traffic over untrusted networks
Example:
An employee working from home may use a company VPN to securely access internal resources.
Software and network devices may contain vulnerabilities.
Manufacturers regularly release updates to correct security weaknesses.
Devices that may require updates include:
Routers
Switches
Firewalls
Access points
Servers
Operating systems
Applications
Network management systems
Ignoring security updates can leave known vulnerabilities exposed.
Network monitoring involves observing network devices, traffic, performance, and security events.
Administrators may monitor:
Login attempts
Failed authentication
Bandwidth usage
Device availability
Unusual traffic
Firewall events
Configuration changes
Server activity
Monitoring helps administrators identify problems before they become serious incidents.
Network devices and applications can generate logs containing information about activities.
Examples:
Successful logins
Failed logins
Firewall blocks
Configuration changes
System errors
Connection attempts
Logs can help administrators investigate security incidents.
Some common threats include:
Malicious software designed to damage systems, steal information, or perform unauthorized activities.
Examples:
Viruses
Worms
Trojans
Ransomware
Spyware
Phishing attempts to trick users into revealing information or performing an unsafe action.
Example:
A user receives a fake email asking them to enter their account password on a fraudulent website.
Attackers may attempt to obtain passwords through:
Guessing
Credential theft
Password spraying
Brute-force attacks
Social engineering
A denial-of-service attack attempts to make a service unavailable by overwhelming or disrupting it.
An attacker attempts to intercept or interfere with communication between two parties.
An unauthorized device may be connected to the network and create a security risk.
A legitimate user may intentionally or accidentally cause security problems.
Organizations should establish clear security policies.
A network security policy may address:
Password requirements
Acceptable Internet use
Device usage
Remote access
Wi-Fi usage
Software installation
Data protection
Account management
Incident reporting
Backup procedures
Technical controls are more effective when supported by appropriate policies and user awareness.
Physical security is also part of network security.
Examples include:
Locking network equipment rooms
Restricting access to server rooms
Securing network racks
Protecting network cables
Using CCTV
Controlling visitor access
Protecting backup devices
Providing reliable power protection
An attacker does not always need to attack a network remotely. Physical access to network equipment can create serious risks.
Defense in depth means using multiple layers of security.
For example:
Internet
↓
Firewall
↓
Router
↓
VLAN/Segmentation
↓
Authentication
↓
Endpoint Security
↓
Application Security
↓
Data Protection
If one security control fails, other controls may still provide protection.
This layered approach is a major principle of modern network security.
Consider a training institution with:
30 student computers
10 staff computers
2 servers
Wi-Fi access points
Network printer
Internet connection
A basic security design could include:
Firewall at the Internet gateway.
Separate student and staff VLANs.
Strong administrator passwords.
Secure Wi-Fi.
Guest network for visitors.
User authentication.
Regular software updates.
Antivirus/endpoint protection.
Server backups.
Network monitoring.
Access permissions.
Security awareness training.
This demonstrates that network security is not one device or one software package. It is a combination of controls.
| Technology/Concept | Main Purpose |
|---|---|
| Authentication | Verifies identity |
| Authorization | Determines allowed actions |
| Firewall | Controls network traffic |
| IDS | Detects suspicious activity |
| IPS | Detects and can block threats |
| Encryption | Protects information from unauthorized reading |
| VPN | Provides protected remote/network communication |
| VLAN | Segments a network |
| Antivirus | Protects endpoints from malware |
| ACL | Controls access according to rules |
| MFA | Strengthens authentication |
| Monitoring | Observes network activity |
| Backup | Supports recovery |
| Patch management | Fixes known vulnerabilities |
Possible solution:
Establish password requirements.
Use MFA.
Disable compromised accounts.
Possible solution:
Use network access controls.
Monitor connected devices.
Separate guest networks.
Possible solution:
Isolate the affected device.
Run security scans.
Update software.
Investigate the source of infection.
Possible solution:
Review firewall rules.
Check user permissions.
Examine logs.
Strengthen authentication.
Possible solution:
Enable appropriate wireless security.
Change default credentials.
Use a strong Wi-Fi password.
Separate guest access.
Learners should identify the security controls used in a computer lab.
Identify whether each item provides network security:
Firewall
Password
Antivirus
Network switch
VLAN
Backup
UPS
MFA
CCTV
VPN
For each item, explain the security problem it helps address.
Design a network containing:
One router
One switch
One server
Five computers
One wireless access point
Add at least five security controls.
Learners should explain why each control is necessary.
Create three user roles:
Administrator
Instructor
Student
Decide which resources each role should access.
Example:
| Resource | Administrator | Instructor | Student |
|---|---|---|---|
| Network configuration | Yes | No | No |
| Course materials | Yes | Yes | Yes |
| Student marks | Yes | Yes | Limited |
| User management | Yes | No | No |
| Internet | Yes | Yes | Yes |
Discuss why users should not all have administrator privileges.
Create a simple hypothetical firewall policy.
Example:
| Traffic | Action |
|---|---|
| Authorized web traffic | Allow |
| Unauthorized incoming connection | Block |
| Known malicious traffic | Block |
| Approved administration connection | Allow |
| Suspicious traffic | Inspect/Alert |
Learners should explain the reason for every rule.
Scenario:
A staff member receives an email containing a suspicious link. The staff member clicks it and notices unusual computer behavior.
Answer:
What could have happened?
What should the staff member do immediately?
Should the computer remain connected to the network?
Who should be notified?
What evidence should be preserved?
Which security controls could have helped prevent the incident?
What is network security?
Why is network security important?
Explain confidentiality.
Explain integrity.
Explain availability.
What is authentication?
What is authorization?
Differentiate authentication and authorization.
What is a firewall?
What is an IDS?
What is an IPS?
Differentiate IDS and IPS.
What is encryption?
What is a VPN?
Explain network segmentation.
What is the principle of least privilege?
Give four examples of network security threats.
Why are software updates important?
Explain the importance of secure Wi-Fi.
What is defense in depth?
Design a network security plan for a small computer training centre.
Your design should include:
Internet connection
Router
Firewall
Switch
Wireless access point
Student computers
Staff computers
Server
Guest users
Explain:
How users will authenticate.
How different users will be separated.
How wireless access will be secured.
How Internet traffic will be controlled.
How malware will be addressed.
How data will be backed up.
How security events will be monitored.
What should happen when a security incident occurs.
Network security
Threat
Vulnerability
Risk
Confidentiality
Integrity
Availability
Authentication
Authorization
Access control
Firewall
IDS
IPS
Encryption
VPN
VLAN
Malware
Phishing
Endpoint security
Network monitoring
Least privilege
Multi-factor authentication
Defense in depth
Network security protects computer networks, devices, users, applications, and data against unauthorized access, attacks, misuse, and disruption.
The major concepts covered in this lesson include:
CIA triad
Authentication
Authorization
Access control
Least privilege
Password security
MFA
Encryption
Firewalls
IDS and IPS
Endpoint security
Network segmentation
VPNs
Wireless security
Patch management
Monitoring
Logging
Security policies
Physical security
Defense in depth
A secure network should not depend on one security mechanism. Multiple controls should work together to reduce risk and protect the organization.