[Security Architecture] Network Security

About this article

As the fifth installment of the “Security Architecture” category in the series “Architecture Crash Course for the Generative-AI Era,” this article explains network security.

A design that detects and blocks unauthorized external access, suspicious traffic, and internal info leaks at the network layer. This article covers the main elements - FW/VPC/WAF/IDS/IPS/DDoS defense - the migration from perimeter defense to zero trust, and the importance of Egress control in the AI era - presenting guidelines to escape the myth that “safety with just a perimeter”.

What is network security in the first place

In a nutshell, network security is “the set of defenses that detect and block unauthorized access and data leaks on the communication path.”

Picture airport security. Immigration (firewall) screens out suspicious travelers, baggage inspection (IDS/IPS) catches dangerous items, and the boarding gate (security groups) runs a final check. Even if one layer is breached, the next layer stops the threat — this multi-layer structure is the foundation of network security.

Why network security matters

However robust you make the application, an unnecessary open port will be found. Building “invisible and unreachable” at the network layer is the most certain approach, and it is also the foundation of defence in depth against an application vulnerability or a leaked key. Audits against PCI DSS, ISO 27001 and the like all require network-layer control as a matter of course.

The premise has also changed. The old perimeter view, “the corporate network is safe, the outside is dangerous,” collapsed in the era of cloud and remote work, and the shift is to zero trust: trust nothing and verify continuously.

The main components of defence in depth

The firewall is the most basic of these: a filter that allows or denies traffic. It has evolved from simple port control to next-generation firewalls (NGFW) that look at the application layer.

In cloud, Security Groups (AWS), NSGs (Azure), and firewall rules (GCP) are standard, with fine-grained control per instance.

VPC and subnet separation — the database always goes Private

A VPC (Virtual Private Cloud) creates a logically isolated network space. You can build your own dedicated network in cloud, with multi-layering via subnet separation (Public/Private/Intranet).

The rule is to always place DBs in Private subnets so they can’t be reached directly from the internet. Accidents of breaking this basic and putting DBs in Public still happen today.

WAF and DDoS protection — a CDN in front is the minimum line

A dedicated firewall preventing web-app-specific attacks. SQL injection, XSS, CSRF, bot attacks - detected and blocked by signature- and behavior-based rules. Cloud WAFs are easy to set up, deployable in hours.

Cloudflare offers basic WAF features even on the free plan, easily deployable on small sites.

On the DDoS side, the practical floor is serving through a CDN.

Attacks that stop services with massive traffic (DDoS) - botnet-driven attacks of hundreds of Gbps are now standard. Single servers can’t absorb them, so CDN/DDoS-countermeasure services distribute and absorb.

Cloudflare provides basic DDoS countermeasures free, deployable even at small scale. Larger scales need Cloudflare Enterprise or AWS Shield Advanced.

The 2016 Dyn DNS incident (1.2 Tbps DDoS via Mirai botnet stopping Twitter/GitHub/Netflix for hours) drove home to the world that single-server absorption is impossible (details in appendix “Critical Incident Cases”).

IDS / IPS, VPN / ZTNA and microsegmentation

Mechanisms to detect and prevent intrusions. IDS (Intrusion Detection System) detects only, IPS (Intrusion Prevention System) auto-blocks. Recently, AI/ML enables detecting not just known patterns but also anomalous behavior.

Representative OSS are Snort, Suricata, Zeek, with major commercial players being CrowdStrike, Palo Alto, SentinelOne.

For remote access, the VPN is being replaced.

Mechanisms to safely connect from outside to inside. Importance grew with remote-work spread, but in an era where the VPN itself becomes an attack target (the 2021 Pulse Secure / Ivanti vulnerability incidents), migration to zero trust is progressing.

WireGuard is 10x faster than legacy VPNs, the top candidate for new builds. In zero-trust environments, ZTNA (Cloudflare Access, Tailscale, Twingate, etc.) is replacing VPN.

A CDN does double duty here.

A mechanism for delivering static content from edge servers worldwide, providing both performance gains and security features simultaneously. DDoS absorption, WAF integration, and bot countermeasures are standard - required infrastructure for modern web services.

The crucial security effect of CDN is being able to hide the origin IP, so attackers can no longer target the server directly.

Finally, segmentation.

A design that splits a large network into small segments and narrows inter-segment communication to the minimum necessary. The aim is to prevent lateral movement on breach, so even one server falling doesn’t spread damage company-wide.

In zero-trust thinking, the goal is encrypting and authenticating all inter-service communication. Service meshes like Istio and Linkerd realize this.

How to choose — a table by scale and threat level

Industry baseline values as of April 2026.

Network defence is realistically not “one of everything” but phased adoption matched to scale and threat level.

“The practical floor for DDoS protection is serving through a CDN.” Cloudflare’s free tier alone brings DDoS absorption, a WAF and bot protection, so even a personal site can put commercial-grade defence in place. A public IP is scanned by bots around the clock, which makes a CDN in front the minimum line of defence.

Three scenarios

If you are building solo or at a startup

The Cloudflare free tier, cloud security groups and a private subnet. Cloudflare gives you DNS, CDN, WAF and DDoS protection for nothing, and security groups let you open only the ports you actually need. Put the database in a private subnet and never give it a public IP.

Personal / Startup: Ship in One Month Is Correcten.senkohome.com/arch-intro-case-startup/

If you are a small or mid-size SaaS

CloudFront or Cloudflare with a WAF, Shield and rate limiting. Bot attacks and credential stuffing arrive daily, so pair WAF rules with bot protection — CAPTCHA and challenges. Separate public and private subnets so the database is fully isolated, and for remote access prefer ZTNA (Cloudflare Access, Tailscale) over a legacy VPN, aggregating access logs into a SIEM.

Small-Mid SaaS - Lean on Managed and Run with Few Peopleen.senkohome.com/arch-intro-case-saas/

If you are a large enterprise or in finance

Dedicated lines (Direct Connect, ExpressRoute) with IPS, a 24/7 SOC and microsegmentation. To suppress lateral movement completely, put all traffic on mTLS through a service mesh such as Istio, and keep full packet logs for audit. This is the level at which the cost runs into the tens of millions and the programme takes a year or more.

Large-Enterprise Core: Design That Holds Up for Yearsen.senkohome.com/arch-intro-case-enterprise/

AI decision axes — Egress control is the new pillar of the AI era

Why Egress control grows more important in the AI era

In configurations where AI agents call external APIs, there’s a risk of agents sending data to unintended destinations. The possibility of prompt-injection attacks causing AI to exfiltrate internal data to an attacker’s server is realistic.

Setting Egress control (allow-listing outbound communications) at the network layer ensures AI can’t communicate with anything beyond permitted API endpoints regardless of what instructions it receives. Concrete implementation means: VPC security groups, routing through NAT Gateways, and destination filtering at proxy servers.

Codifying WAF rules and using AI

If AWS WAF or Cloudflare WAF rules are managed in Terraform, rule additions for new attack patterns can be delegated to AI. For instructions like “add a WAF rule blocking SQL injection patterns,” AI can generate code while checking consistency with existing rule sets.

However, since WAF rule false positives (blocking legitimate requests) have large business impact, rules generated by AI must go through staging-environment testing before production deployment.

Pitfalls and forbidden moves

Here are the six most dangerous patterns, all of which maximise the blast radius of a breach.

Installing a WAF and then skipping SQL-injection defences in the application is out of the question. A WAF is only the first cut.

Author’s note - cases of being sunk by complacency that “large-scale attacks won’t reach us”

Cases where social-infrastructure-class systems went down due to DDoS or VPN vulnerabilities have become a perennial industry talking point.

The 2016 Dyn DNS incident (1.2 Tbps DDoS via IoT-stepped Mirai, stopping Twitter/GitHub/Netflix for hours) became the trigger that made delegation to CDN/DDoS-countermeasure services the standard rule (details in appendix “Critical Incident Cases”).

Another, the April 2021 Pulse Secure VPN vulnerability (CVE-2021-22893), where the VPN itself became the entry and US government agencies and major defense industries were breached. A case told as the event that broke the “safe with VPN” premise and rapidly accelerated migration to ZTNA.

I myself once left a test EC2’s Security Group at 0.0.0.0/0 for a few hours, and the next morning found auth logs lined with thousands of SSH brute-force entries and Bitcoin-miner-injection attempts. Both are cases where the premise of “safe with just a perimeter” was the lethal blow, and ones that decided the migration to multi-layer defense and zero trust.

Brace yourself thinking public IPs get attacked the moment they open. Test environments at production-grade.

What to decide - what is your project’s answer?

For each of the following, try to articulate your project’s answer in 1-2 sentences. Starting work with these vague always invites later questions like “why did we decide this again?”

• Network separation (VPC, subnet design)
• Firewall rules (Security Group, NSG)
• WAF adoption (Cloudflare, AWS WAF, etc.)
• DDoS countermeasures (CDN, Shield, etc.)
• Remote-connection method (VPN / ZTNA)
• IDS/IPS / SIEM adoption (depends on scale)
• Egress control (allow-list for outbound communication)

Related Articles

Summary

This article covered network security, including main elements like firewalls, VPC, WAF, DDoS countermeasures, IDS/IPS, VPN/ZTNA, and CDN, the scale-x-threat matrix, and AI-era Egress control.

Zero trust as starting point, reduce attack surface with CDN+WAF+DDoS countermeasures, isolate DBs in Private, narrow AI’s destinations with Egress control. That is the practical answer for network security in 2026.

Next time we’ll cover zero trust (BeyondCorp, ZTNA, continuous verification).

Back to series TOC -> ‘Architecture Crash Course for the Generative-AI Era’: How to Read This Book

I hope you’ll read the next article as well.