Network Security

---
name: network-security
description: "Routing agent for network security technologies including IDS/IPS, NAC, and micro-segmentation. Cross-platform expertise in detection methodology, network visibility, east-west vs north-south traffic, and network forensics. WHEN: \"IDS\", \"IPS\", \"NAC\", \"network access control\", \"micro-segmentation\", \"network detection\", \"east-west traffic\", \"lateral movement detection\", \"network visibility\", \"Suricata\", \"Snort\", \"Zeek\", \"Cisco ISE\", \"ClearPass\", \"FortiNAC\", \"Illumio\", \"Guardicore\". Do NOT use for platform-specific questions -- use the `suricata`, `snort`, `zeek`, `cisco-ise`, `clearpass`, `fortinac`, `illumio`, or `guardicore` skill."
license: MIT
---

# Network Security

This skill covers all network security technologies spanning intrusion detection and prevention (IDS/IPS), network access control (NAC), and micro-segmentation. It provides cross-platform expertise in detection methodology, network visibility strategy, traffic analysis, and network forensics. Read the relevant sibling skill for deep implementation details.

## When to Use This Skill vs. a Sibling Skill

**Use this skill when the question is cross-platform or conceptual:**
- "Which IDS/IPS should we deploy for our environment?"
- "How do we get visibility into east-west traffic?"
- "Explain the difference between signature-based and behavioral detection"
- "Design a network segmentation strategy"
- "How does NAC fit into our zero trust architecture?"
- "Compare Suricata vs. Snort vs. Zeek"
- "What network forensics capabilities do we need?"
- "How do we detect lateral movement at the network layer?"
- "IDS deployment topology -- inline vs. TAP/SPAN"

**Read a sibling skill when the question is platform-specific:**
- "Write a Suricata rule for TLS fingerprinting" --> `suricata`
- "Suricata EVE JSON log analysis" --> `suricata`
- "Snort 3 inspector configuration" --> `snort`
- "Zeek scripting for custom protocol analysis" --> `zeek`
- "Cisco ISE 802.1X policy configuration" --> `cisco-ise`
- "ClearPass device profiling" --> `clearpass`
- "FortiNAC network access policy" --> `fortinac`
- "Illumio workload segmentation policy" --> `illumio`
- "Guardicore micro-segmentation rules" --> `guardicore`

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Architecture / Strategy** -- Load `references/concepts.md` for foundational network security concepts
   - **Technology selection** -- Compare options across IDS/IPS, NAC, and micro-segmentation categories
   - **Detection engineering** -- Rule writing methodology, tuning, MITRE ATT&CK mapping to network indicators
   - **Deployment topology** -- Inline vs. passive, TAP/SPAN vs. network tap, cluster design
   - **Visibility gaps** -- Identify blind spots (encrypted traffic, east-west, cloud workloads)
   - **Platform-specific** -- Read the appropriate sibling skill

2. **Gather context** -- Network architecture, traffic volumes, existing tooling, compliance requirements, team operational maturity, cloud vs. on-prem vs. hybrid

3. **Analyze** -- Apply network security reasoning. Consider detection coverage, performance impact, operational overhead, and integration with SIEM.

4. **Recommend** -- Provide prioritized guidance with trade-offs. A well-tuned Suricata deployment often outperforms a poorly tuned commercial IDS.

5. **Qualify** -- Note detection gaps, false positive rates, and conditions that affect the recommendation.

## Network Security Categories

### IDS/IPS (Intrusion Detection and Prevention Systems)

Passive (IDS) or inline (IPS) analysis of network traffic for malicious patterns.

| Technology | Mode | Primary Strength | Best For |
|---|---|---|---|
| **Suricata** | IDS/IPS/NSM | Performance, EVE JSON, protocol parsers | High-throughput, structured logging, SIEM integration |
| **Snort 3** | IDS/IPS | Talos rules, OpenAppID, hyperscan | Cisco ecosystem, Talos threat intel subscribers |
| **Zeek** | Passive NSM | Protocol analysis, scripting, structured logs | Network forensics, threat hunting, behavioral analytics |

**Key decision factors:**
- **Throughput requirements** -- Suricata multi-threaded scales better than Snort on multi-core hardware
- **Detection approach** -- Rules-based (Suricata/Snort) vs. behavioral/scripting (Zeek). Deploy both for full coverage.
- **Logging needs** -- Zeek produces richer metadata logs; Suricata EVE JSON covers alerts + metadata
- **Operational maturity** -- Snort has the largest community and simplest rules; Zeek requires scripting skills
- **Existing SIEM** -- All three integrate with Splunk/Elastic/Sentinel; verify connector quality

### Network Access Control (NAC)

Controls which devices can connect to the network, based on identity, device posture, and policy.

| Technology | Vendor | Primary Strength | Best For |
|---|---|---|---|
| **Cisco ISE** | Cisco | Comprehensive 802.1X, TrustSec SGT, pxGrid | Cisco network environments, large enterprise |
| **Aruba ClearPass** | HPE/Aruba | Multi-vendor support, OnGuard posture, API | Mixed-vendor networks, Aruba wireless |
| **FortiNAC** | Fortinet | Agentless profiling, FortiGate integration | Fortinet-heavy environments, OT/IoT |

**Key decision factors:**
- **Network vendor** -- ISE is best in Cisco shops; ClearPass excels in mixed-vendor environments
- **OT/IoT presence** -- All three support IoT profiling; FortiNAC has strong agentless options
- **Posture assessment** -- ISE (AnyConnect), ClearPass (OnGuard), FortiNAC (persistent/dissolvable agents)
- **Cloud NAC** -- ISE has cloud-delivered options (Cisco ISE on AWS/Azure); all support RADIUS cloud proxies

### Micro-Segmentation

Granular east-west segmentation enforced at the workload level, independent of network topology.

| Technology | Vendor | Approach | Best For |
|---|---|---|---|
| **Illumio** | Illumio | VEN agent + PCE, label-based policy, OS firewall enforcement | Enterprise data centers, zero trust segmentation |
| **Guardicore (Akamai)** | Akamai | Agent + agentless, process-level, deception | Mixed environments, incident response visibility |

**Key decision factors:**
- **Environment** -- Both work in hybrid; Illumio CloudSecure and Guardicore both support cloud workloads
- **Deception capability** -- Guardicore Centra includes honeypot/deception; Illumio does not natively
- **Policy model** -- Illumio's label-based model (role/app/env/loc) is more structured; Guardicore is more flexible
- **Agent vs. agentless** -- Guardicore supports agentless (network-based visibility); Illumio requires VEN agent

## Detection Methodology

### Signature-Based vs. Behavioral Detection

**Signature-based (Suricata, Snort):**
- Matches known patterns (byte sequences, protocol anomalies, known malware indicators)
- Low false positive rate for known threats
- Misses zero-days and novel techniques
- Requires regular rule updates (suricata-update, Talos subscriptions)

**Behavioral/Anomaly (Zeek, ML-based):**
- Builds baselines and alerts on deviations
- Can detect unknown threats
- Higher false positive rate during baselining
- Requires longer tuning period

**Best practice:** Deploy both. Use Suricata/Snort for known threat detection; use Zeek for behavioral analysis, threat hunting, and forensics. Feed both into a SIEM.

### MITRE ATT&CK Network Coverage

Map network detection capabilities to ATT&CK tactics:

| ATT&CK Tactic | Network Indicators | Detection Tools |
|---|---|---|
| Initial Access | Exploit traffic, phishing payloads, drive-by compromise | Suricata/Snort rules (ET rules) |
| Execution | C2 beacon patterns, staged payloads over HTTP/HTTPS | Suricata JA3/JA4, DNS anomalies |
| Persistence | DNS-based C2, beacon regularity | Zeek DNS log analysis, beacon detection |
| Lateral Movement | SMB/RPC lateral, pass-the-hash, WMI | Suricata SMB rules, Zeek smb.log/ntlm.log |
| Command & Control | C2 protocols, domain fronting, DNS tunneling | Suricata C2 rules, Zeek DNS analysis |
| Exfiltration | Large outbound transfers, DNS exfil, HTTPS exfil | Zeek conn.log volume anomalies, DNS TXT |
| Credential Access | Kerberoasting, NTLM capture, credential spray | Zeek kerberos.log/ntlm.log, failed auth |
| Discovery | Network scanning, ARP, ICMP sweeps | Suricata scan detection, Zeek scan scripts |

### Detection Coverage Model

For comprehensive coverage, layer these detection tiers:

```
Tier 1: Known threats     --> Suricata/Snort rules (ET Open/Pro, Talos)
Tier 2: Protocol analysis --> Zeek logs (all protocol metadata)
Tier 3: Behavioral        --> SIEM correlation across Zeek + IDS alerts
Tier 4: Threat hunting    --> Zeek + PCAP for analyst-driven investigation
```

## Network Visibility Architecture

### Traffic Capture Methods

| Method | Pros | Cons | Use When |
|---|---|---|---|
| **TAP (Test Access Point)** | Lossless, passive, no impact | Hardware cost | Production, high-value segments |
| **SPAN/Mirror Port** | No hardware needed | Switch CPU impact, can drop | Dev/test, lower bandwidth |
| **Inline (bump-in-wire)** | IPS capability, can block | Single point of failure, latency | Internet edge, critical chokepoints |
| **AF_PACKET (bypass NIC)** | High throughput, bypass on failure | Linux only | High-throughput Suricata |
| **Cloud VPC Traffic Mirroring** | AWS/Azure/GCP support | Cost at scale, sampling | Cloud workload visibility |

### Deployment Topology Recommendations

**Perimeter (north-south):**
- Inline IPS for active blocking (Suricata NFQ or AF_PACKET inline)
- Full protocol visibility into internet traffic
- TLS inspection with certificate management (where legally/technically feasible)

**Internal (east-west):**
- Passive TAP on core switch uplinks
- Zeek for metadata-rich logging of all internal traffic
- Suricata for signature detection on lateral movement indicators
- Micro-segmentation (Illumio/Guardicore) for enforcement

**Data center / cloud:**
- VPC flow logs as minimum baseline
- Selective mirroring to Zeek/Suricata for high-value segments
- Agent-based micro-segmentation for workload-to-workload visibility

### Encrypted Traffic Challenge

Modern networks are 80-95% TLS encrypted. Strategies:

1. **TLS inspection proxy** -- Decrypt at perimeter; legal and privacy considerations apply
2. **JA3/JA4 fingerprinting** -- Client TLS fingerprint for C2 detection without decryption (Suricata support)
3. **Certificate analysis** -- Self-signed, expired, suspicious issuers (Zeek ssl.log)
4. **Flow metadata** -- Volume, timing, duration patterns in encrypted sessions
5. **DNS analysis** -- Pre-connection indicator; DNS-over-HTTPS creates blind spots

## Network Forensics

### Log Sources for Investigation

| Log Source | Tool | Key Fields |
|---|---|---|
| Full packet capture (PCAP) | Zeek, Suricata, tcpdump | Everything -- gold standard |
| Connection metadata | Zeek conn.log | src/dst IP, port, bytes, duration, service |
| DNS queries | Zeek dns.log | Query, response, TTL, A/CNAME records |
| HTTP transactions | Zeek http.log | Host, URI, method, user-agent, response |
| TLS/SSL sessions | Zeek ssl.log | Server name, certificate, JA3, version |
| Alert events | Suricata EVE alerts | Rule SID, signature, flow details |
| File transfers | Zeek files.log / Suricata file-store | MIME type, hash, size, source |

### Forensic Investigation Workflow

1. **Scope the incident** -- Start with Zeek conn.log or Suricata EVE to identify affected IPs and time window
2. **Establish timeline** -- Correlate across log sources to build attacker timeline
3. **Trace lateral movement** -- Follow connections from compromised host; look for new connections post-compromise
4. **Extract IOCs** -- File hashes from files.log, domain names from dns.log, certificate hashes from ssl.log
5. **PCAP reconstruction** -- If PCAP available, extract and reassemble sessions for file recovery

## Technology Routing Table

| Request Pattern | Route To |
|---|---|
| Suricata rules, EVE JSON, suricata-update, performance tuning | `suricata` |
| Snort 3 configuration, inspectors, OpenAppID, Talos rules | `snort` |
| Zeek scripting, log analysis, Intelligence Framework, cluster | `zeek` |
| Cisco ISE, 802.1X, RADIUS, TACACS+, pxGrid, TrustSec | `cisco-ise` |
| Aruba ClearPass, CPPM, OnGuard, captive portal | `clearpass` |
| FortiNAC, network access policy, OT/IoT onboarding | `fortinac` |
| Illumio PCE, VEN, label-based policy, workload segmentation | `illumio` |
| Guardicore Centra, deception, process-level segmentation | `guardicore` |

## Anti-Patterns

1. **IDS-only with no tuning** -- A default-rules IDS generating thousands of noisy alerts creates alert fatigue. Tune to your environment or the alerts become invisible.
2. **Relying solely on north-south detection** -- Modern attacks live in east-west traffic post-breach. Lateral movement detection requires internal visibility.
3. **Ignoring encrypted traffic** -- Without JA3, certificate analysis, and DNS monitoring, 80%+ of your traffic is a blind spot.
4. **NAC without operational process** -- NAC that blocks legitimate devices creates outage risk. Start with monitor-only mode, build device inventory, then enforce.
5. **Micro-segmentation as a first step** -- Visibility must come before enforcement. Map application dependencies before writing deny rules.
6. **Zeek-only for IPS** -- Zeek is a passive analysis framework; it cannot block. Pair with Suricata or firewall enforcement for prevention.

## Reference Files

Load these for deep foundational knowledge:

- `references/concepts.md` -- Network security fundamentals: IDS vs. IPS, detection taxonomy, network visibility architecture, east-west vs. north-south, network forensics methodology. Read for conceptual and architectural questions.