Practice stage summary

Security controls are not interchangeable, and their differences are mostly about where they sit. At layer 2, port security and 802.1X decide whether a device is allowed onto the network at all, which is the only place that question can be answered. At layers 3 and 4, access control lists, routing controls and stateful firewalls decide reachability from addresses, ports and connection state. At layer 7, a web application firewall or an intrusion detection or prevention system reads the payload and can act on what the request is trying to do.

The failure mode is placement, not product. A control below the attack cannot see the payload that carries it: a stateful firewall watching a permitted flow on port 443 has no opinion about the injection inside it. A control placed too high may not be on the path at all, which is how an expensive inspection appliance ends up blind to traffic that never crosses it. Before asking whether a control is good, ask what it can observe from where it stands and which traffic reaches it.

Defence in depth is often described as stacking controls, which invites buying more of the same. It works better as distribution: each control answers a threat the others structurally cannot see, so a gap in one is covered by a different vantage rather than a duplicate one. This stage's remaining modules keep testing that idea, starting with the module that abandons network location as the basis for trust altogether.

NIST SP 800-207 defines zero trust as an architecture with no implicit trust granted on the basis of network location, with continuous evaluation and authorisation decided per request. Read carefully, that is a description of what a traditional VPN does wrong. A VPN authenticates the user once and then hands over reachability to a subnet, and reachability is exactly the implicit trust the definition removes. Lateral movement is not a VPN failure; it is the VPN working as designed, with an attacker holding the credential.

ZTNA replaces reachability with authorisation. An identity-aware proxy stands in front of each application and decides every request against identity, device state and policy, so a compromised session yields one application rather than a network. More than 70 percent of new remote-access deployments now choose ZTNA over a VPN default. The naming around it is where learners get lost: SASE is the networking half, meaning SD-WAN, plus the security service edge; SSE is that security half bought on its own. Over 80 percent of ZTNA is sold inside one of those bundles, which is a purchasing fact about the market rather than an architectural claim about your network.

The honest adoption path is staged. CISA's Zero Trust Maturity Model sets out pillars and maturity stages precisely because nobody replaces implicit trust in one project, and it gives you language for saying which decisions have moved and which have not. Zero trust is a property of how access decisions are made. It is not a product, and a tunnel with a new label on it still hands over the subnet.

Segmentation is the only control that changes what an incident costs after the attacker is already inside. The same compromised host has network-wide reach in a flat design and constrained reach in a zoned one, and that difference was fixed by design decisions taken months earlier. VLANs and subnets are the classic tools, firewall zones and the demilitarised zone separate traffic crossing the perimeter from traffic moving between internal systems, and cloud security groups and microsegmentation push the boundary all the way down to the individual workload.

East-west traffic is where blast radius actually lives, and it is the traffic a perimeter design never inspects. A design that filters everything entering the estate and nothing moving within it has bought a strong front door for a building with no internal walls. Naming the direction of a flow before choosing a control is what stops that mistake.

The quiet failure is drift. Allow rules accumulate one exception at a time, each justified on the day, and a boundary nobody re-derives converges back towards flat without anyone deciding that it should. Treat the diagram as the design and the live rule base as the state, and re-derive reachability from the rules before claiming any blast radius. PCI DSS v4.0.1 makes the same point commercially: segmentation that is documented, enforced and verified can keep unrelated systems out of assessment scope, so a boundary that has drifted has silently widened what you must evidence. The next two modules are this idea wearing different clothes, first as cloud tenancy and later, in stage 4, as industrial zones.

A virtual private cloud is segmentation you rent, and a security group is a stateful firewall attached to a workload rather than to a wire. Conceptually nothing new happened when networks moved to the cloud; the knobs moved and the boundaries became API objects. That is good news for the learner, because every reachability question you could answer on a LAN transfers, provided you translate the vocabulary honestly rather than treating cloud networking as a separate discipline.

Overlays are where encapsulation from stage 1 returns with money attached. VXLAN and Geneve wrap a tenant frame inside a UDP envelope so a tenant segment can travel across a shared underlay that knows nothing about it. The cost is real: an extra header eats into the usable payload, and anything reading the underlay sees the envelope rather than the conversation. Capture points and firewall rules that assume they can read the inner header are the usual casualty.

Kubernetes puts the same ideas under new names. Every pod gets an IP address through a CNI plugin, Services provide stable names in front of moving pods, and the datapath decides how traffic actually gets there. It is no longer true that iptables routes service traffic: eBPF datapaths, with Cilium as the canonical example, have displaced kube-proxy and iptables in most new production clusters, with datapath throughput gains commonly cited in the 30 to 40 percent range. The deeper change is the match key. Network policy that matches on workload identity rather than on IP addresses survives pods being rescheduled, which is what makes segmentation meaningful in an environment where addresses are temporary.

Logs, metrics and traces are the three pillars, and networks add their own: SNMP counters, NetFlow and sFlow records, synthetic checks and user reports. None of them is general-purpose truth. A counter tells you that something changed and nothing about who was involved. A flow record tells you which endpoints talked, how much and for how long, and nothing about what happened inside the request. A trace tells you where the time went across services and nothing about the packets underneath. Choosing by the question, rather than by what is already installed, is the whole discipline.

The tooling caught up in ways worth knowing. OpenTelemetry is the de facto correlation standard, one collection framework that lets a network signal be joined to an application trace instead of being read in a separate window by a separate team. eBPF flow visibility, Hubble being the widely deployed example, adds identity-aware flow records without deploying agents into every workload, which is what makes flow data usable in clusters where addresses change constantly.

Alert fatigue is a signal-selection failure rather than a volume problem. Alerts fired from a signal that cannot distinguish the failure you care about will always be noisy, whatever the threshold. The progression the module teaches survives every tooling generation: counters say something changed, flows say who was talking, traces say where the time went, and captures say what was actually on the wire, each at a higher cost and a narrower scope than the last.

Packet capture is the highest-fidelity evidence available and the highest-risk, because it carries whatever users were doing at the time. The discipline is therefore procedural, not technical. Write down the question before you start; scope with a BPF capture filter, which decides what is written and permanently discards the rest; bound the volume with a ring buffer; and delete when the question is answered. A display filter is a different tool for a different moment, narrowing what you look at within a capture you have already taken, which is why it can never undo an over-broad capture.

What a capture can prove has shrunk. A QUIC capture exposes almost nothing above the UDP header beyond connection identifiers and lengths, because the transport metadata that used to be readable in TCP now sits inside the encrypted envelope. Where Encrypted Client Hello is in use, the server name goes too. Taking a capture on the wire and expecting to see the handshake is a habit formed on an older network and applied to a 2026 one.

So the capture point moves rather than the tool. The host still sees plaintext before it is encrypted, a proxy sees what it terminates, the resolver sees the names it answered, and the edge sees what it served. Ask what this specific point can still prove before taking a single packet, and pick the point that answers your question with the least user data collected.

HTTP/2 stream cancellation was built for clients: a browser that no longer needs a response should be able to say so. Rapid Reset, CVE-2023-44487, disclosed in October 2023, turned that courtesy into a weapon. The attacker opens a stream, cancels it immediately and repeats, so the server begins work on request after request while the client pays almost nothing per request and never waits for a response. Threat modelling that only looks for bugs would never have found it, because nothing was broken. The feature did exactly what it promised.

Scale followed. Google mitigated 398 million requests per second, Cloudflare 201 million and AWS 155 million during the same disclosure. The edge absorbed most of it, because anycast capacity and protocol-aware mitigation are concentrated there, but origin operators still had to patch their own servers: mitigation somewhere on the path is not mitigation everywhere on it, and an origin reachable directly is an origin still exposed.

Reading the numbers is part of the skill. Requests per second, bits per second and packets per second describe different attacks that exhaust different resources, and a headline in one unit is not comparable with a headline in another. The same measurement literacy the course has been building applies here, along with the layered evidence drill: given the alert, ask what layer 3, layer 4 and layer 7 can each prove, and accept that most layers narrow the possibilities rather than concluding the case.

Distance is latency, and no protocol improvement beats moving the content closer. Anycast makes that practical: the same address is announced from many locations and routing itself decides which point of presence answers, so users reach a nearby edge without knowing one exists. TLS terminates there, a cache hit is served there and never travels further, and only a miss continues through an origin shield to the origin. Much of the behaviour users attribute to your server is behaviour of an edge you may not operate.

Steering happens before the connection exists. HTTPS and SVCB records, defined in RFC 9460, let DNS carry protocol hints, address hints and connection parameters, which is the same mechanism stage 1 met at the start of the request path, now doing commercial work at the edge. Understanding it is what turns a CDN from a black box into a component whose decisions you can predict.

Two developments complicate the picture usefully. Edge compute platforms run application logic at the point of presence, so some responses are generated rather than cached, and origin logs will never show them. MASQUE standardises proxying inside the protocol itself, with CONNECT-UDP in RFC 9298 and CONNECT-IP in RFC 9484, deployed at population scale by services such as iCloud Private Relay. The troubleshooting consequence is concrete: the client IP address you see may belong to a relay, and the question of where a request terminated now has several plausible answers that you must distinguish with evidence.

Green dashboards with unhappy users is the normal case rather than the exception. An average taken across every user hides the segment that is suffering, and a threshold set for the estate will not fire for a region, a tenant, a network path or a single access technology. The capstone starts from that reconciliation problem because it is the shape most real incidents arrive in, and because it forces the evidence discipline the whole course has been teaching.

The method is layered elimination from the symptom downwards, narrowing by routing, segmentation and connection state, and asking at each step which signal would separate the remaining possibilities most cheaply. This stage adds two branches the earlier method did not have. First, authorisation: is the user actually being permitted at the identity-aware proxy, or is a policy decision being read as a network failure? Second, the edge: did the failure happen at a point of presence or at the origin, and does the evidence you hold distinguish them at all?

The same evidence frequently supports two branches, and pretending otherwise is how incidents get misattributed with confidence. The professional move is to name the cheapest next test that separates them, run it, and then write a diagnosis note that records what the evidence showed, which branch it eliminated and what remains uncertain. That note is the deliverable. It is also the artefact that makes the next incident faster.