Skip to main content

​
Why network architecture matters

Every organization - from a small donut shop to a multinational corporation - relies on a network to function. Email, websites, payment processing, file sharing, and security cameras all run over a network. If you don’t understand how the network is structured, you can’t defend it. Network architecture is the blueprint of how devices, servers, and security systems are connected. As a defender, your job is to know where traffic flows, where sensitive data lives, and where an attacker could break in.
Think of network architecture like the floor plan of a building. A security guard who doesn’t know the layout can’t protect it. The same applies to cybersecurity - you need to know the map before you can defend the territory.

​
Traditional network architecture

Most organizations use what’s called a monolithic or traditional network architecture. It looks something like this:
Each layer serves a purpose, and traffic has to pass through security checkpoints to move deeper into the network.

​
The DMZ (demilitarized zone)

The DMZ is a buffer network that sits between the public internet and your internal network. It’s like the lobby of a secure office building - visitors can enter the lobby, but they can’t walk straight into the executive offices. The DMZ hosts services that need to be accessible from the internet (like your website) without exposing your internal systems.
The name “DMZ” comes from military terminology - a demilitarized zone is a buffer area between two opposing forces. In networking, it’s the buffer between the untrusted internet and your trusted internal network.
What goes in the DMZ:
  • Public-facing web servers
  • Email gateways
  • DNS servers
  • VPN endpoints
What stays on the internal network:
  • Employee workstations
  • Database servers with sensitive data
  • HR and payroll systems
  • Internal file shares

​
Front end vs back end

You’ll hear “front end” and “back end” throughout cybersecurity and software development: In network architecture, front-end servers sit closer to the internet (often in the DMZ), while back-end servers sit deeper in the internal network where they’re harder for attackers to reach.
Inside a real data center showing rows of server racks with network cabling

Inside a data center - rows of servers that power the internet

​
Common server types

Organizations run different servers for different functions. Each one is a potential target for attackers, so you need to know what they do and why they matter.
What it does: Hosts websites and web applications. When you visit a website, you’re connecting to a web server.Why attackers target it: Web servers are internet-facing, making them the most exposed target. Attackers exploit vulnerabilities like SQL injection, cross-site scripting, or outdated software to break in.Examples: Apache, Nginx, Microsoft IIS
What it does: Stores and shares files within the organization. Employees access shared drives, documents, and resources through the file server.Why attackers target it: File servers often contain sensitive business documents, intellectual property, contracts, and employee data. Ransomware frequently targets file servers to encrypt everything at once.Examples: Windows File Server (SMB), Samba, NFS
What it does: Stores structured data - customer records, transaction histories, inventory, user accounts, and passwords.Why attackers target it: Databases are the crown jewels. A breach here means stolen customer data, leaked passwords, and regulatory fines. This is where SQL injection attacks are aimed.Examples: MySQL, PostgreSQL, Microsoft SQL Server, Oracle
What it does: Handles sending and receiving email for the organization.Why attackers target it: Email is the #1 attack vector for phishing. Compromising an email server lets attackers read confidential communications, send phishing emails from legitimate accounts, and intercept password reset links.Examples: Microsoft Exchange, Postfix, Google Workspace (cloud-based)
What it does: Handles Authentication (who are you?), Authorization (what can you access?), and Accounting (what did you do?).Why attackers target it: If an attacker compromises the AAA server, they control who can access the entire network. They can create admin accounts, disable logging, and move freely through all systems.Examples: RADIUS, TACACS+, Microsoft Active Directory

​
IP addressing

Every device on a network needs an address so other devices can find it and communicate with it. That address is called an IP address (Internet Protocol address).

​
What is an IP address?

An IP address is your device’s unique identifier on a network. It works like a mailing address - without it, data doesn’t know where to go. An IPv4 address looks like this: 192.168.1.25 It’s made up of four numbers (called octets), each ranging from 0 to 255, separated by dots.

​
Public vs private IP addresses

Not all IP addresses are the same. There are two types:
Visible from the internet. Your public IP is the address the outside world sees when your network communicates with the internet.
  • Assigned by your Internet Service Provider (ISP)
  • Unique across the entire internet
  • Used for websites, email servers, and anything accessible from outside
You can check your public IP right now by searching “what is my IP” on Google.

​
The house analogy

Think about your teammate Blair’s house:
  • The street address (e.g., 123 Main Street) is the public IP - it’s how the postal service (the internet) finds the house from the outside.
  • The rooms inside (kitchen, bedroom, living room) are the private IPs - they exist within the house, and people inside know how to find them, but someone standing on the street can’t see them.
  • The front door is the router - it’s the single entry point that connects the inside to the outside.
Everyone in the neighborhood can see the street address, but only people inside the house know which room is which.
This is why you can’t directly access someone’s laptop just by knowing their home’s public IP address. The router acts as a gatekeeper between the public internet and the private devices inside.

​
DHCP - automatic IP assignment

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices when they connect to a network. Without DHCP, you would have to manually configure an IP address on every device - every phone, laptop, smart speaker, and tablet. How it works:
  1. Your device connects to the Wi-Fi network
  2. Your device broadcasts: “I need an IP address!”
  3. The DHCP server (usually your router) responds: “Here, use 192.168.1.25”
  4. Your device uses that address until the lease expires, then requests a new one

​
Common private IP ranges

The Internet Engineering Task Force (IETF) reserved three blocks of IP addresses for private use. These are the ranges you will see on internal networks:
If you open your terminal or command prompt and type ipconfig (Windows) or ifconfig (Mac/Linux), you will see your device’s private IP address. It will almost certainly start with 192.168, 10., or 172.16-31.

​
Defense in depth

Defense in depth is the strategy of layering multiple security controls so that if one fails, the next one catches the attacker. No single defense is perfect, so you stack them.

​
The home analogy

Think about protecting your own home:
1

Front door with a deadbolt

The first barrier. It stops casual intruders, but a determined attacker can pick a lock or kick the door in.
2

Alarm system

If someone gets past the door, the alarm triggers. Now you know there’s a problem, and the clock starts ticking for the intruder.
3

Security cameras

Even if the alarm doesn’t stop them, cameras capture evidence. You know who it was and what they did.
4

Locked interior rooms

Not every room needs to be accessible. Your most valuable belongings are behind another lock.
5

A safe

Your most critical items - passports, cash, irreplaceable documents - are in a safe that requires a separate code or key.
Each layer adds time and visibility for defenders. An attacker who breaks through one layer still has to deal with the next. The more layers they face, the more likely they are to get caught or give up. In network security, defense in depth looks like this:

​
How a network attack flows

Understanding the path an attack takes helps you know where to place your defenses. Here’s a typical flow:
At each step, the attacker needs to bypass a security control. Your job as a defender is to make every step as difficult as possible and ensure that if one layer is breached, the next one holds.
Attackers don’t always start from the internet. A phishing email can give them a foothold inside the network, bypassing the firewall and DMZ entirely. This is why defense in depth includes controls at every layer - not just the perimeter.

​
Exercise: Map your home network

Take five minutes and think about (or sketch) the network architecture of your own home:
1

Identify your gateway

What is your router? Is it provided by your ISP, or did you buy your own? This is the front door of your network.
2

List your devices

How many devices are connected? Laptops, phones, smart TVs, game consoles, smart speakers, security cameras, smart thermostats - list them all.
3

Identify public vs private

Does your network have a public IP? (Yes - your ISP assigned one.) What private IP range does your router use? Check by looking at your device’s network settings.
4

Find the security controls

Does your router have a built-in firewall? Is your Wi-Fi password-protected? Do you have a guest network? These are all security controls you already use.
5

Spot the gaps

Are there devices with default passwords? Is your router firmware up to date? Could a neighbor connect to your Wi-Fi? These are the vulnerabilities in your home network.
If you find a security gap in your home network during this exercise, fix it. Change that default password, update that firmware, or set up a guest network for visitors. Cybersecurity starts at home.

​
Key takeaways

  • Network architecture is the blueprint of how devices and servers are connected - you can’t defend what you don’t understand.
  • The DMZ is a buffer zone between the internet and your internal network, hosting public-facing services.
  • IP addresses are how devices find each other - public IPs are visible from the internet, private IPs are only visible inside your network.
  • DHCP automatically assigns IP addresses so you don’t have to configure each device manually.
  • Defense in depth layers multiple controls so that no single failure compromises the entire network.
  • Every layer an attacker has to bypass gives defenders more time to detect and respond.