Secure Network Architecture and Design

Network architecture is the blueprint of how devices in a computer network are arranged and connected. Design is the set of rules you follow to place those devices safely. The whole goal is to stop a single breach from becoming a company-wide disaster. This is called the principle of least privilege: anyone (or anything) gets only the access it needs to do its job, and nothing more.

Let’s start with DMZ, which stands for demilitarised zone. The name comes from the buffer strip between two warring armies — nobody stands there, but everyone watches it. In networking, a DMZ is a subnetwork that sits between the public internet and your private internal network. It holds services that outside users need to reach, such as a company’s public website, an email gateway, or a file-sharing portal. The key rule: a user on the internet can talk to the server in the DMZ, but the DMZ server cannot initiate a connection into the private internal network. If an attacker compromises the web server, they are trapped in the DMZ. They cannot jump to the database server that holds customer records. An IT professional creates a DMZ by using a firewall (a device that filters traffic) with three network interfaces: one for the internet, one for the DMZ, and one for the internal network. Traffic rules on the firewall allow web traffic only to the DMZ server and block any direct traffic from the DMZ to the internal network.

A VLAN (Virtual Local Area Network) is a way to split a single physical network into several separate virtual networks. Imagine a large office where the sales team, the HR team, and the engineering team all share the same physical wires and switches. Without VLANs, a broadcast message from a sales laptop would reach every device in the building, and any employee could potentially see traffic meant for another team. A VLAN logically separates the teams. Even though they share the same switch, sales devices can only talk to other sales devices, and HR devices can only talk to other HR devices. An IT professional configures this by assigning a VLAN ID number to each port on a network switch. A device plugged into a port with VLAN 10 belongs to the Sales network; a device on VLAN 20 belongs to the HR network. Traffic between VLANs must go through a router or a layer-3 switch, where the IT team can apply firewall rules to control what passes. For example, HR might need to print to a shared printer, but Sales should not see the HR database. VLANs make the network both more secure (you reduce the attack surface) and more performant (you reduce unnecessary broadcast traffic).

Defence in depth (also called layered security) is the strategy of using multiple, overlapping security controls so that if one layer fails, another layer still protects the asset. It is not a single product — it is a philosophy. Consider a bank vault: the bank has a security guard at the door (physical security), a keypad lock (access control), a camera system (surveillance), a reinforced concrete wall (structural defence), and an alarm that calls the police (detection and response). In network terms, defence in depth looks like this:

The effectiveness of defence in depth is measured by how much work an attacker must do after each successful breach. A misbehaving script should not automatically grant access to the CEO’s email archive. Instead, the attacker would need to steal credentials (first layer), bypass MFA (second layer), and then decrypt the mail database (third layer). Most attackers give up at the first barrier they cannot break.

All three concepts — DMZ, VLAN, and defence in depth — work together. You might place a public web server inside a DMZ. You might segment the internal network into VLANs for finance, HR, and engineering. And you would layer firewalls, IDS, and encryption across the entire architecture. For the CC exam, understand the purpose of each: DMZ isolates externally accessible servers, VLANs separate internal traffic without buying new hardware, and defence in depth ensures no single failure is catastrophic.

Imagine you are the sole IT person for a small e-commerce company called "ShopFast" that sells custom T-shirts online. The company has 30 employees, a public website, a customer database, and an internal inventory system. The owner says, "Make sure hackers cannot steal our customer list."

Here is what you actually do, step by step.

First, you sketch the network architecture on a whiteboard. You identify three zones:

You buy a firewall appliance that has three network ports: one connected to the internet modem, one connected to a switch in the DMZ, and one connected to the internal office switch. On the firewall web interface, you create rules:

Next, you configure VLANs on the internal office switch. You create three VLANs:

You assign each employee’s desk port to the correct VLAN based on their role. You then configure the firewall to allow specific inter-VLAN traffic: the inventory system (VLAN 30) can talk to the web server (DMZ) to update stock levels, but finance (VLAN 10) cannot talk to sales (VLAN 20) unless it is for a specific approved accounting report.

After physical installation, you apply defence in depth:

Finally, you test. You plug a laptop into a DMZ port and try to ping the internal network. The ping fails — the DMZ rule works. You walk to a sales desk and try to access the finance server’s shared folder. It times out — the VLAN rule works. You ask a friend to try to guess your admin password from the internet. Three failed attempts trigger an alert email. The defence in depth works.

An IT professional does this exact kind of zoning and rule-writing every day. The tools you would use include firewall configuration interfaces (Cisco ASA, pfSense, Palo Alto), switch management consoles (Cisco IOS, Aruba Central), and monitoring solutions (Splunk, Wireshark for packet inspection, or simple Syslog servers). The goal is always the same: reduce the blast radius of any single breach.