TechKnowSurge
CompTIA Security+ 2.2 ISC2 CISSP 4.1 Cisco CCST Cybersecurity 2.3 NIST CSF PR.IR-01 CompTIA Security+ 4.5 ISC2 CISSP 4.2 NIST 800-53 SC-7
TechKnowSurge Catalog Videos Network Access
VideoSecurityFree

Network Access

Network access control covers the methods and policies used to determine who and what can connect to a network, whether through physical connections, wireless, or remote access channels like VPNs and RDP. Understanding these concepts is foundational to implementing a defense-in-depth security strategy.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network access control is the practice of governing which users and devices are permitted to connect to a network, operating as a foundational layer in a defense-in-depth security model. While tools like access control lists manage traffic flow between segments based on IP addresses and port numbers, and file-system permissions restrict what authenticated users can do with data, neither measure prevents an unauthorized device from physically joining the network and probing its resources for vulnerabilities. Controlling access at the network level—whether at the LAN, subnet, or wireless boundary—closes that gap before an attacker can establish a foothold. Network connections fall into two broad categories: direct access, through a wired port or a wireless signal, and remote access, through mechanisms such as TLS or IPsec VPN tunnels, SSH sessions, or RDP connections. Wireless environments introduce additional risk because transmitted data is broadcast openly and can be intercepted by anyone within range, making access control especially critical in those contexts. The core challenge is designing a system that grants legitimate users seamless connectivity through any of these pathways while reliably blocking unauthorized parties who may have physical proximity to the network or the technical means to attempt a remote connection.

What you'll learn

What's covered

Network Access Control

Aligned to

CompTIA Security+
2.2 Explain common threat vectors and attack surfaces.
4.5 Given a scenario, modify enterprise capabilities to enhance security.
ISC2 CISSP
4.1 Apply secure design principles in network architectures
4.2 Secure network components
Cisco CCST Cybersecurity
2.3 Describe network infrastructure and technologies
NIST CSF
PR.IR-01 Networks and environments are protected from unauthorized logical access and usage.
NIST 800-53
SC-7 Boundary Protection

Key terms

Network Access Control
NAC
Network Access Control enforces security policy on devices attempting to connect to a network, verifying compliance with posture requirements such as patch level, antivirus status, and certificate validity before granting access.
Network Segmentation
The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Virtual Private Network
VPN
A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.
IPsec
A suite of protocols that authenticates and encrypts IP packets to provide secure communication over a network.
Secure Shell
SSH
A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
Wireless Access Point
WAP
A device that allows wireless devices to connect to a wired network using Wi-Fi.
Remote Desktop Protocol
RDP
Remote Desktop Protocol is a Microsoft protocol that enables remote graphical access to Windows systems; it is a frequent attack target commonly exploited via credential brute-forcing, session hijacking, and unpatched vulnerabilities such as BlueKeep.
Defense-in-Depth
Defense-in-Depth is a security architecture strategy that layers multiple independent controls across technical, physical, and administrative domains so that the failure of any single control does not result in a complete security breach.
Authentication
The process of verifying the identity of a user, device, or system.

Topics

Network Access Control Defense In Depth Wireless Security Vpn Remote Desktop Protocol Network Security

Transcript

Somehow we need to control access into our network. So what does that look like?

Controlling access at the network level

When it comes to segmentation, breaking apart our networks helps us control the traffic flow between these networks. What we use is network access control lists to control the flow of data that goes between these different networks. Now, that only works to a certain point. We can base things off of IP addresses and port numbers, and there's a few other ways to control this, but essentially we have some very basic ways of controlling and basic ways of protecting these networks from that standpoint. It doesn't stop somebody from coming in and plugging a machine into this network and then starting to gain access to different resources on this network.

So we need some access control at this level, at a segment level. At a subnet level, at a network level, at a LAN level — however we want to describe this, we need some control on who accesses our local area networks.

Let's give a little scenario here. Let's say we've got a server right here that's a file server. So this has files on it and we've got controls on those files. We've got some sort of permissions, maybe Active Directory or Linux permissions or something set up on this, so you don't have direct access into those files. Not anybody can just gain access to those files. Well, now we're safe, right? Well, no. Because what happens if somebody can come in and just plug into your network? They have access now to the machines and start figuring out how they can start hacking into this machine, and they might find some vulnerabilities on this machine in order to gain access to those files.

And so we want to practice defense in depth, and one of the ways we do that is by controlling who can even get onto that network. And so that is network access.

It's especially important for wireless, because wireless is inherently insecure. All those bits that are being transmitted are just being transmitted out there. Anybody can intercept that and see what those bits are. So we already have an element of security that we know wireless needs to have, but we also need to have that on our local area network as well, to make sure that somebody doesn't come and just plug a device into our network and start hacking it.

Direct and remote access

So what are the different ways that they can access this network? Well, they can access it directly, by plugging into the system. If they plug into the system, now they have access to the system obviously, or through wireless like I mentioned. So those are direct access to the network itself.

But there are times when we want people to have indirect access or remote access. So what do remote connections look like? Well, they could be VPNing into this. So maybe it's a TLS or IPsec tunnel that they've created in order to be on this network. Or perhaps there is some sort of machine hopping, so that they actually remote into a machine which then gets them access to this network. Maybe it's SSH, or maybe they're using RDP, or there are other protocols out there as well. So anyways, they gain access into the system.

So those are some different ways that we can provide network access for our users. There's two things that we need to think about: how do we let legitimate users gain access to this network, but then also stop illegitimate users from connecting to the network if they do have some sort of physical access or remote access? How do we control the access to this network?

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →