Lesson Objective
Understand How Vulnerabilities Are Identified and Managed
Vulnerability assessment is the process of identifying, analysing and prioritising weaknesses within systems, networks, applications and digital infrastructure. Vulnerabilities can arise from software flaws, missing security updates, insecure configurations, weak authentication controls, exposed services and human error. If these weaknesses remain unresolved, attackers may exploit them to gain unauthorised access, steal sensitive information, disrupt operations or compromise critical business systems.
In this lesson, you will learn how security professionals define assessment scope, discover assets, perform vulnerability scans, validate findings, rank risks according to severity and recommend remediation actions. You will also explore the importance of reporting, retesting and continuous monitoring to ensure vulnerabilities are properly managed. By the end of the lesson, you should understand how vulnerability assessments help organisations proactively reduce risk and strengthen their overall cybersecurity posture before weaknesses can be exploited.
Audio Lesson
Listen to This Lesson
The audio version explains network defence in a practical way. It covers firewalls, segmentation, access control, endpoint protection, monitoring, intrusion detection, logging and incident response.
Concept Overview
Network Defence Uses Layers of Protection
Network defence works best when security is applied in layers. If one control fails, another control should still reduce the damage. This is known as defence in depth. It helps protect systems against attackers, malware, misconfiguration, weak passwords, exposed services and internal misuse.
Learning Algorithm
Network Defence Workflow
| Step | Process | Technical Meaning |
|---|---|---|
| Step 1 | Identify protected assets | List the systems, data, users and services that need defence. |
| Step 2 | Reduce the attack surface | Remove unnecessary services, ports, accounts and exposure. |
| Step 3 | Filter traffic with firewalls | Allow or block traffic based on security rules. |
| Step 4 | Segment the network | Separate users, servers, guests and sensitive systems. |
| Step 5 | Control access | Use identity, permissions, MFA and least privilege. |
| Step 6 | Protect endpoints | Secure laptops, servers, mobiles and user devices. |
| Step 7 | Monitor and detect threats | Use logs, alerts and intrusion detection to find suspicious activity. |
| Step 8 | Respond and improve | Investigate incidents, recover systems and strengthen defences. |
Step 1
Identify protected assets
Network defence begins by identifying what needs protection. This may include servers, routers, switches, databases, user accounts, cloud services, websites, customer records and business-critical systems. Clear asset awareness helps defenders decide where protection matters most.
Technical Point
Network defence starts by knowing which assets, systems and data must be protected.
Step 2
Reduce the attack surface
The attack surface is the total number of ways a system can be attacked. Open ports, unused services, exposed admin panels, weak passwords, outdated software and unnecessary accounts all increase exposure. Reducing the attack surface makes the network harder to compromise.
Technical Point
Reducing the attack surface limits the number of opportunities available to attackers.
Step 3
Filter traffic with firewalls
Firewalls control network traffic using rules. They can allow, block or inspect communication based on source address, destination address, port, protocol or application behaviour. A firewall helps prevent unwanted traffic from reaching sensitive systems.
Technical Point
Firewalls reduce unwanted traffic by enforcing network security rules.
Step 4
Segment the network
Segmentation separates a network into smaller zones. For example, a business may separate staff devices, guest Wi-Fi, servers, security cameras and management systems. This limits movement if one area is compromised and makes monitoring easier.
Technical Point
Segmentation limits lateral movement and separates sensitive systems from general traffic.
Step 5
Control access
Access control decides who can use network services and what they can do. Strong access control includes unique accounts, strong passwords, multi-factor authentication, role-based permissions and least privilege. Users should not have more access than they need.
Technical Point
Access control reduces the chance of unauthorised use or privilege misuse.
Step 6
Protect endpoints
Endpoints are devices such as laptops, desktops, mobile phones and servers. They are common targets because users interact with them every day. Endpoint protection may include anti-malware, device encryption, patching, application control, secure configuration and behaviour monitoring.
Technical Point
Endpoint protection is essential because user devices are common entry points for attacks.
Step 7
Monitor and detect threats
Monitoring helps defenders identify suspicious behaviour. Logs, network traffic, failed logins, unusual access patterns, malware alerts and intrusion detection systems can reveal early signs of compromise. Detection gives defenders time to investigate and respond.
Technical Point
Monitoring and detection help defenders find attacks, mistakes and failures early.
Step 8
Respond and improve
Network defence must include response planning. When suspicious activity is found, defenders investigate, contain the issue, remove the cause, restore affected systems and improve future protection. Good defence is continuous and improves after every incident, test and lesson learned.
Technical Point
Incident response strengthens network defence by turning events into improvements.
Key Takeaways
What You Should Remember
1. Assets Must Be Known
Defenders need to know which systems, data and services need protection.
2. Exposure Should Be Reduced
Removing unused services, ports and accounts lowers the attack surface.
3. Firewalls Filter Traffic
Firewall rules help control which traffic can enter or leave.
4. Segmentation Limits Movement
Separate network zones can reduce the damage caused by compromise.
5. Access Must Be Controlled
Authentication, MFA and least privilege reduce unauthorised activity.
6. Endpoints Need Protection
User devices and servers require patching, monitoring and anti-malware.
7. Monitoring Enables Detection
Logs, alerts and intrusion detection help identify suspicious activity.
8. Defence Is Continuous
Every incident, audit and test should improve the security posture.
Knowledge Check
Quick Network Defence Quiz
Test your understanding. The questions can change when you refresh them.
Lesson Summary
Network Defence Summary
Network defence protects systems by combining layered controls. A strong defence identifies assets, reduces exposure, filters traffic, segments networks, controls access, protects endpoints, monitors activity and responds to incidents. This layered approach helps reduce risk and strengthens the overall security posture.