Four Strategic Principles of Network Security Design

We recently reviewed the CIS Controls v8.1—a list of 18 key controls you should implement to maintain comprehensive cybersecurity. A recurring theme across these controls is the importance of protecting your network.

This post addresses the strategic principles involved in network security design relative to the list of CIS controls, in response to the following question: "How do you set up a network security system?"

How do you set up a network security design strategy?

4 Principles to Integrate into Network Security Design

Compartmentalization – Control 12

Compartmentalization within a secure network involves two essential aspects.

The first is that within the organization, the network must be segmented. If an organization has a flat, open network, once that network is infiltrated, an attacker can establish a foothold to move laterally through the network, potentially stealing data and infecting key assets. Case studies examining real-world vulnerabilities in network defense consistently show how lateral movement through unsegmented environments accelerates attacker dwell time and damage.

Through network segmentation, the entire network is divided into smaller subnets. A related concept, segregation, involves applying a set of rules for communication between hosts and services.

A key step in segmentation is establishing "demilitarized zones" (DMZs) between subnets. These are small networks located between the organization's internal network and the public internet, which can be used to prevent malicious actors from reaching the organization's "inner sanctum." Segregation can be implemented through firewall protocols that prohibit traffic between the public network and the internal private network, as well as between the DMZ and the internal network. For organizations looking to operationalize these controls without building in-house expertise, managed firewall solutions for network security offer a practical path to enforcing these boundaries consistently.

In addition to DMZs, organizations should consider smaller subnets or microsegmentation when different security requirements apply across the organization (for example, ensuring payment card processing complies with the Payment Card Industry Data Security Standard (PCI DSS)). Alongside network firewalls, this segmentation can be achieved using routers, switches, or by setting up Virtual Local Area Networks (VLANs).

The second aspect of compartmentalization involves carefully considering user privileges. For example, users who do not need access to customers' personal data should have restricted access to networks containing that data.

This is where the "Principle of Least Privilege" or "PoLP" comes in: individuals within the organization should only have the system privileges/access necessary to perform their job. Evaluating user privileges is also linked to network segmentation and segregation: if a particular subnet does not need to communicate with another subnet, it should not be able to do so.

Key Takeaway: Stop intruders by using microsegmentation and ensuring that all employees and contractors have appropriate user privileges.

The Weak Link – Control 14

In every organization, there are weak points in the network—the weakest link in the chain, so to speak. And unfortunately, for most organizations, that link is their people. For example, no matter how strong your IT defense systems are, security can collapse if an employee falls for a phishing scam. Risk areas include:

• The use of personal devices to access workplace assets. If the employee or contractor does not have sufficient protection on their personal device, it can serve as a gateway into the organization's network for intruders.
• Bypassing password security. Preventing unauthorized users from accessing employee accounts requires protocols to ensure employees use strong passwords that are regularly updated.

Organizations must ensure they have adequate training in place to verify that employees and contractors understand what they need to do to guarantee network security.

Key Takeaway: Often, the people within your organization represent the greatest risk to manage when improving network security.

Vulnerability Assessment – Control 7

Once all the different aspects of your network security system are in place, you need to ensure they effectively protect your organization's assets. This is where vulnerability testing is essential: it involves regularly testing your established defenses to see where the "gaps" are. Translating this into a repeatable program, however, presents its own challenges—understanding vulnerability management as a network security design pillar helps organizations move from one-off assessments to a structured, continuous practice.

Organizations are recommended to use a mixed approach—both automated and manual. An automated vulnerability scanning tool will identify all systems (e.g., servers, desktops, laptops) connected to the network. It will then cross-reference a checklist of known vulnerabilities to see if any are present.

This method differs from penetration testing (Control 18), which aims to detect specific network weaknesses that could be exploited by an individual simulating a real-world attacker. Understanding how and when to apply penetration testing to validate network security design is essential for getting the most value from this control.

Key Takeaway: Your network security must be regularly assessed to detect potential gaps.

The Importance of Layering – Controls 1, 3, 9, 12

Protecting a medieval castle required establishing multiple levels of security. First, the castle was located where natural geography offered protection against invasions: often beside cliffs, on top of hills, or near large bodies of water. Then, a series of man-made obstacles—moats, heavy gates, and traps—were set up to stop intruders from reaching the king's keep.

Similarly, layering is an essential aspect of designing a secure network. The idea, of course, is that if an intrusion or attack slips through one layer of defense, another layer will catch it. Layering brings together all the previous network security design elements we've discussed. The main layers of network security include:

• Perimeter and network controls: Firewalls must be implemented. These serve as the primary barrier between your network and the public internet. Likewise, the organization must use segmentation to ensure any attack can be contained locally within the organization.
• Email protection: This includes establishing email filtering and encryption protocols.
• Web filtering
• Encryption of important financial and personal data
• Device management: Ensuring all devices connected to the network meet the organization's security requirements.

Key Takeaway: If one defense fails, other protections should serve as a backup to prevent an attack or intrusion from causing further damage. For a firsthand look at what happens when these layers are tested, our network security crisis recovery case study illustrates why redundant defenses are not optional.

Figure – Traditional Layered Defense-in-Depth Model

Conclusion

Network security design is important because it forms the foundation of your cybersecurity strategy. Implementing individual cybersecurity components—such as encryption and firewalls—on an ad hoc basis will not be enough. These elements must be connected in a cohesive manner. We recommend that your network security design be based on the strategic principles of compartmentalization, addressing the weakest link, vulnerability testing, and layering. For a real-world example of these principles in action, Syngenta's resilient network transformation demonstrates how a large enterprise applied structured network design to achieve measurable security outcomes.