CISA Domain 5, 'Protection of Information Assets', demands that you evaluate the controls securing an organisation's network and infrastructure. This is the digital equivalent of a bank's vault doors, alarm systems, and security guard patrols—if these defences fail, every piece of data inside is at risk. For the CISA exam, you must understand not just what a firewall or IDS is, but how to judge whether the controls are designed correctly and operating effectively.
Jump to a section
A simple way to picture Network and Infrastructure Security
An apartment building's entry system is the boundary between a private, controlled space and the chaotic public street. A visitor arrives and presses the button for Apartment 3A on the keypad—this is the equivalent of sending a request to a specific server on a network. The speaker crackles, and a voice asks, 'Who is it?' This is a basic authentication check: the system requests identification before granting any access. Behind the scenes, the building has a main secure door that only opens with a key fob or a code. This is a firewall, the primary gateway that decides what traffic is allowed to enter the building's internal hallway, which represents the internal network.
Inside the building, not every resident has access to every floor. The maintenance room, the rooftop garden, and the basement storage each require a distinct key. An IT professional calls this segmentation—breaking the network into smaller, isolated zones so that if someone breaks into one apartment (compromises one system), they cannot automatically walk into the penthouse (access a critical database). The security camera in the lobby, which records every person who enters and exits, acts as a network monitor or an intrusion detection system. It does not stop anyone, but it creates an audit log of all activity.
Finally, consider the emergency override: if a fire alarm sounds, the magnetic locks on all doors release, allowing everyone to escape. In network security, this mirrors a fail-open configuration, where in a critical failure, safety or business continuity is prioritised over absolute security. The entire system—the keypad, the fobs, the cameras, the zoning of keys—must be managed together. If the property manager forgets to deactivate a former tenant's key fob, that person can still enter the building. A forgotten administrative password on a network device creates the same dangerous vulnerability.
Network and infrastructure security is the practice of protecting the pathways and devices that connect computers and systems within an organisation. Think of it as ensuring the pipes, locks, and monitoring systems of a digital city are secure. Every time you check your email, transfer a file, or access a cloud application, data packets travel across a network. These packets pass through several layers of defence, and a CISA auditor must assess whether each layer is configured properly.
At the most basic level, a network is simply two or more computers connected to share resources. The infrastructure includes the physical hardware: routers, switches, firewalls, cables, and wireless access points. The security part involves the policies, procedures, and technical tools that prevent unauthorised access, misuse, or failure of this infrastructure.
Firewalls are the most fundamental control. A firewall is a device or software that examines incoming and outgoing network traffic and decides whether to allow or block it based on a set of rules. An analogy is a security guard at a building entrance who checks each person's ID against a list. Firewalls can be 'stateful', meaning they remember the state of active connections and make decisions based on the context of the traffic, not just individual packets.
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are like security cameras and automatic door locks respectively. An IDS monitors network traffic for suspicious activity and sends an alert to an administrator. An IPS sits inline with the traffic and can actively block the malicious traffic without human intervention.
Virtual Private Networks (VPNs) create a secure, encrypted tunnel between a user's device and the corporate network. This is essential for remote workers. Without a VPN, their internet traffic would be exposed to anyone on the same public Wi-Fi network.
Network Segmentation is the practice of dividing a network into smaller, isolated sections. This limits the spread of a security breach. For example, the payment card processing system should be on a separate segment from the guest Wi-Fi network. An attacker who breaches the guest network should not be able to reach the payment systems.
Demilitarised Zones (DMZs) are a specific type of segmentation. A DMZ is a physical or logical subnetwork that contains and exposes an organisation's external-facing services—such as a web server or email server—to a larger, untrusted network, usually the internet. The DMZ adds an extra layer of security: if an attacker compromises a server in the DMZ, they still have to break through another firewall to reach the internal network.
Access Control Lists (ACLs) are rule sets applied to routers or firewalls that specify which traffic is allowed or denied based on IP addresses, ports, or protocols. An ACL is like a bouncer's list at a club—only people on the list (with the right IP address and port number) get through.
Network Monitoring involves continuously watching the network for slow performance, outages, or suspicious activity. Tools like SNMP (Simple Network Management Protocol) and SIEM (Security Information and Event Management) systems collect logs from all devices and alert administrators.
Physical Security of network infrastructure is also critical. A server room must have locks, environmental controls, and access logs. If an attacker can physically unplug a network cable or install a rogue device, all software-based protections can be bypassed.
The reason these controls exist is the 'CIA Triad': Confidentiality (keeping data secret), Integrity (ensuring data is not tampered with), and Availability (ensuring systems are up when needed). Network security controls directly support all three pillars. They replace the old model of 'trusted internal network, untrusted external network' with a 'zero trust' approach, where no device or user is trusted by default, regardless of whether they are inside or outside the network perimeter.
For the CISA exam, you need to know not only what these tools do, but also their limitations. For example, a firewall cannot protect against an attack that uses a legitimate port (like port 80 for web traffic) if the traffic looks normal. An IDS generates false positives. VPNs can be slow. Understanding these weaknesses is key to evaluating their effectiveness as a control.
Assess Current Network Architecture
The first step in securing a network is to understand how it is physically and logically laid out. An IT professional maps all devices, network segments, and data flows. This is critical because you cannot protect what you do not know exists. For CISA, you must recognise that an outdated or inaccurate network diagram is a control weakness.
Define Security Zones and Implement Segmentation
Based on the architecture, create distinct zones: internal trusted network, DMZ for public servers, guest network, and management network. Use VLANs and firewalls to enforce separation. This step is vital because it prevents an attacker who breaches the guest Wi-Fi from accessing the payment card database.
Configure Firewall Rules Based on Least Privilege
Write and apply Access Control Lists (ACLs) that permit only the necessary traffic between zones. Start with a default deny rule and then add exceptions for specific services. Each rule must be justified and documented. This step directly reduces the attack surface by closing unused ports and blocking unnecessary communication paths.
Deploy Intrusion Detection and Prevention Systems
Place IDS/IPS sensors at key chokepoints in the network, such as between the DMZ and internal network. Configure signatures to detect common attacks and tune them to reduce false positives. This step provides real-time visibility into malicious activity and, in the case of IPS, automated blocking capability.
Implement Remote Access Controls
Set up a VPN gateway for remote employees. Enforce multi-factor authentication (MFA) for all VPN connections. Define split-tunneling policies (whether remote traffic goes through the VPN or directly to the internet) based on security requirements. This step secures the organisation's data when accessed from untrusted networks like home Wi-Fi or coffee shops.
Establish Continuous Monitoring and Log Review
Configure all network devices and security tools to send logs to a central SIEM system. Define alerts for critical events (e.g., multiple failed logins, traffic to known malicious IPs). Establish a schedule for log review—daily for critical systems, weekly for less critical ones. This step ensures that security incidents are detected and can be responded to in a timely manner.
Conduct Regular Penetration Testing and Audits
Periodically engage an external team to simulate attacks on the network infrastructure. Also perform internal vulnerability scans. Document findings and track remediation. This step validates that the controls are working as intended and identifies weaknesses that could be exploited by real attackers.
An IT security professional—let us call her Priya—works for a mid-sized retail company with 500 employees and an online store. Her job is to make sure the company's network and infrastructure are secure. She does not just install a firewall and walk away; she operates in a continuous cycle of assessment, implementation, monitoring, and improvement.
Step 1: Priya starts with a network architecture review. She examines the network diagram to see how different systems connect. She identifies three key zones: the internal corporate network (for employees), the DMZ (for the company's public-facing website and email server), and the guest Wi-Fi network (for visitors). She checks that the guest Wi-Fi is completely isolated from the internal network using VLANs (Virtual Local Area Networks). She verifies that there is a firewall between every zone.
Step 2: She configures and tests the firewall rules. Priya knows that she must follow the principle of least privilege: only allow the minimum traffic necessary. For example, the email server in the DMZ must be allowed to send outbound email traffic (port 25) and receive inbound email from the internet (also port 25). But it should not be able to initiate a connection to the internal HR database server. She writes Access Control Lists (ACLs) to enforce this. She then runs a vulnerability scanner to see if any unintended ports are open.
Step 3: She sets up network monitoring. Priya deploys an IDS sensor on the network segment between the DMZ and the internal network. She configures the SIEM (Security Information and Event Management) system to collect logs from all firewalls, servers, and the IDS. She sets up alerts for specific events, like five failed login attempts from a single IP address to the VPN concentrator.
Step 4: She manages remote access. The company has 100 sales employees who work remotely. Priya deploys a VPN solution. She enforces multi-factor authentication (MFA) for VPN access: employees must enter a password and a code from their phone. She also configures the VPN to only allow access to specific internal systems (like the CRM), not the entire internal network.
Step 5: She performs an incident response drill. Priya simulates a small breach: a phishing email was opened, and a laptop is now trying to communicate with a known malicious IP address. Her team runs through the steps: isolate the laptop from the network (by disconnecting its network port in the switch), review firewall logs to see what data was sent, and then patch the laptop. Afterwards, Priya audits the process: was the isolation fast enough? Were logs available? What would she change in the firewall rules to prevent a similar attack in the future?
Step 6: She prepares for an audit. An external auditor will arrive next quarter. Priya gathers documentation: network diagrams, firewall rule change requests, incident response reports, and VPN configuration files. She knows the auditor will ask for evidence that changes to the firewall are approved by management and that logging is enabled and reviewed regularly. She prepares a sample report showing thirty days of SIEM log reviews.
This real-world process shows that network security is not a 'set and forget' activity. It requires constant vigilance, documentation, and alignment with business needs. An auditor like a CISA evaluates whether Priya's controls are designed appropriately and operating effectively to protect the company's assets.
The CISA exam tests your ability to evaluate, not just define, network and infrastructure security controls. Expect scenario-based questions where you must choose the best control to mitigate a specific risk or identify the most critical weakness in a given configuration. The exam does not ask you to code or configure a firewall; it asks you to judge whether the control is adequate.
Concepts the exam loves: - Firewall placement and rules: The exam will describe a network and ask where a firewall should be placed (e.g., between the DMZ and internal network) or what rule is missing. Traps: the exam might suggest a firewall can stop all attacks; it cannot. It might suggest placing a firewall inside the internal network for DMZ traffic—that is wrong; the DMZ should be separated by its own firewall. - Segmentation and DMZ: You will be given a diagram and asked which zone a server belongs in (public web server goes in the DMZ, internal database goes in the internal network). The trap is putting a critical internal server in the DMZ. - VPN technology and remote access: Questions about VPNs (site-to-site vs remote access), encryption protocols (IPSec vs SSL), and multi-factor authentication. Trap: assuming a VPN alone provides full security—it does not; configuration and endpoint security matter. - IDS vs IPS: Know the difference: IDS detects and alerts; IPS detects and blocks. The exam will ask what to use when real-time blocking is required (answer: IPS). - Monitoring and SIEM: Questions about log review frequency, what to look for, and the importance of baselining normal traffic. Trap: thinking more logs always equals better security—they are useless if not reviewed. - Physical security controls: The exam reminds you that network infrastructure (routers, switches) needs physical locks and environmental controls. Trap: forgetting physical security in a 'network security' question. - Zero Trust Architecture: A newer concept the exam is increasingly testing. Understand that zero trust means 'never trust, always verify'—users and devices are authenticated and authorised for every access request, regardless of location.
Common question patterns: - 'Which of the following is the BEST control to prevent an attacker from moving laterally within the network?' Answer: Network segmentation. - 'An organisation wants to host a public web server. Where should it be placed?' Answer: In a demilitarised zone (DMZ). - 'An employee is working remotely from a coffee shop. Which control ensures the confidentiality of traffic?' Answer: A VPN with strong encryption.
Traps to avoid: - Do not overstate the capability of a single control. A firewall is not a 'silver bullet'. The exam will offer options where one control is necessary but not sufficient alone. - Do not confuse 'authentication' with 'authorisation'. A VPN authenticates the user, but additional rules determine what they can access. - Do not forget 'default deny' rule. The best firewall rule set starts with a deny-all rule and only allows specific, approved traffic.
Key definitions to memorise: - Stateful inspection: A firewall that tracks the state of active connections. - Deep packet inspection (DPI): A firewall that examines the actual data content of packets, not just headers. - DMZ: A subnetwork that exposes external-facing services to the internet while protecting the internal network. - Endpoint: A device (laptop, phone, server) that connects to the network.
A firewall is a network security device that filters incoming and outgoing traffic based on predetermined rules, but it alone cannot stop all attacks.
Network segmentation limits the blast radius of a breach by isolating critical systems from general user traffic.
A Demilitarised Zone (DMZ) provides an isolated network segment for public-facing servers, adding a layer of protection between the internet and the internal network.
An Intrusion Detection System (IDS) monitors and alerts on suspicious activity, whereas an Intrusion Prevention System (IPS) actively blocks that activity in real time.
Remote access via a Virtual Private Network (VPN) encrypts data in transit, but it must be combined with multi-factor authentication and endpoint security to be effective.
The principle of least privilege applies to network access: grant only the minimum necessary permissions to users, devices, and services.
Physical security of network infrastructure—server room locks, environmental controls, and cable management—is a non-negotiable part of overall network security.
Logs from firewalls, IDS/IPS, and routers are useless unless they are actively monitored using a Security Information and Event Management (SIEM) system and reviewed regularly.
These come up on the exam all the time. Here's how to tell them apart.
Intrusion Detection System (IDS)
Monitors traffic and sends alerts when suspicious activity is detected
This is a passive device that does not block traffic
Has no risk of blocking legitimate traffic (no false positive blocking risk)
Intrusion Prevention System (IPS)
Monitors traffic and actively blocks malicious activity in real time
This is an inline device that stops traffic based on rules
Carries a risk of incorrectly blocking legitimate traffic (false positives) and impacting business operations
Stateful Firewall
Remembers the state of active connections (e.g., recognises a return packet as part of an existing session)
More secure because it understands context (e.g., allows return traffic but blocks unsolicited inbound packets)
Uses more memory and processing power because it tracks connection tables
Stateless (Packet Filter) Firewall
Examines each packet in isolation without reference to previous packets
Can be vulnerable to spoofed packets because it does not check connection state
Faster and simpler, but less secure; suitable for simple environments
VPN (Remote Access)
Connects an individual remote user to the corporate network
Typically uses client software installed on the user's device
Encrypts traffic between the user's device and the VPN gateway
VPN (Site-to-Site)
Connects two entire networks (e.g., a branch office to the headquarters)
Typically configured directly on the routers or firewalls at each site
Encrypts all traffic passing between the two network gateways
Network Segmentation (VLAN-based)
Uses Virtual LANs to separate traffic at Layer 2 (data link layer)
Does not inspect traffic; it only controls broadcast domains
Offers less security because intra-VLAN traffic is not filtered
Network Segmentation (Firewall-based)
Uses firewalls to enforce access control policies between segments
Inspects all traffic passing between segments against security rules
Offers stronger security because traffic is actively filtered and logged
Mistake
A firewall alone is sufficient to protect a network from all external attacks.
Correct
A firewall is a critical first line of defence, but it is not sufficient by itself. It must be combined with intrusion detection, endpoint protection, regular patching, and user training. Many attacks, such as phishing, bypass the firewall entirely.
This myth persists because sales materials often overemphasise the firewall's capabilities. Beginners think of it as a magical barrier that stops all bad things.
Mistake
If a system is inside the corporate network (behind the firewall), it is automatically safe and can be trusted.
Correct
The modern approach is 'zero trust', which assumes that no network, internal or external, is inherently safe. An internal system can be compromised by a malicious insider or through a lateral movement attack from a compromised device.
This misconception comes from the older 'castle and moat' security model, where the inside of the network was considered a safe haven. Attackers proved this false repeatedly.
Mistake
Network segmentation and VLANs are identical concepts.
Correct
Network segmentation is the broader strategy of dividing a network into smaller parts to limit the spread of threats. VLANs are one technology to implement segmentation, but they are not the only way and do not provide security by themselves—they primarily separate broadcast domains. True segmentation for security requires additional controls like firewalls between segments.
The terms sound similar, and many introductory courses teach VLANs as 'virtual segmentation'. Beginners conflate the tool with the principle.
Mistake
An IDS is better than an IPS because it does not block any traffic, so it is safer for business operations.
Correct
An IDS only detects and alerts, while an IPS actively blocks malicious traffic. An IPS is superior for preventing known attacks, but it carries a risk of blocking legitimate traffic (false positives). The choice depends on the organisation's risk tolerance; both have their place.
Beginners fear 'breaking things' and assume a passive tool is always safer. They do not understand that an IPS can be tuned to minimise false positives.
Mistake
Using a VPN guarantees complete anonymity and security for the user.
Correct
A VPN encrypts traffic between the user's device and the corporate network, but it does not anonymise the user. The company can still see all traffic. Furthermore, the endpoint device itself may be infected with malware, and the VPN cannot protect against that. The VPN is only one piece of a secure remote access strategy.
Consumer VPN marketing heavily promotes anonymity. Beginners transfer this misconception to the enterprise context, where the purpose of a VPN is different: secure connection, not anonymity.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A router connects different networks and forwards data packets between them based on IP addresses. A firewall also forwards packets, but it makes decisions based on security rules (like blocking traffic on a specific port). Many modern routers include basic firewall functionality, but a dedicated firewall offers much more granular control and inspection.
No, they protect against completely different things. A VPN encrypts your internet traffic so others cannot see it; it protects data in transit. Antivirus software detects and removes malicious software (malware) on your device; it protects data at rest and running processes. You need both for general security.
DMZ stands for Demilitarised Zone. It is a separate network segment that sits between the internet and the internal corporate network. Organisations place public-facing servers (like web and email servers) in the DMZ so that if an attacker compromises one of those servers, they are still isolated from the internal network and cannot easily access sensitive data.
Best practice is to review critical logs daily and all logs at least weekly. However, for organisations with a Security Operations Centre (SOC), logs are monitored in real time. For a CISA exam context, the answer depends on the scenario, but a monthly review is generally considered insufficient for high-security environments.
It means giving a user, device, or application only the minimum permissions needed to perform its function. For example, a marketing employee should not have network access to the finance server. Applied to firewalls, it means only allowing the specific ports and IP addresses required for a service to operate, and blocking everything else.
A traditional perimeter firewall cannot protect against a malicious insider who is already inside the network. However, internal firewalls (used for segmentation) and rules that restrict inter-departmental traffic can limit what an insider can access. The best defence against internal threats is a combination of network segmentation, strong access controls, and monitoring.
You've finished Network and Infrastructure Security. Continue through the CISA study guide to build a complete picture of the exam.
Done with this chapter?