14.1 Manage Network Security

Why managing network security is an operations exam topic

Domain 6 of the ISC2 Systems Security Certified Practitioner (SSCP) exam — Network and Communications Security — is weighted at 16% under the outline effective 1 October 2025. Knowledge Area 6.4 is Manage network security. The outline names three piles: logical and physical placement of network devices (inline, passive, virtual), segmentation (physical/logical, data/control plane, virtual local area network (VLAN), access control list (ACL), firewall zones, micro-segmentation), and secure device management.

This is not a shopping list for a vendor bill of materials. The Computerized Adaptive Testing (CAT) items will look like a Tuesday change window: an intrusion prevention system (IPS) hung off a mirror port that never dropped a packet, a camera VLAN that can still route to payroll, a core switch administered with Telnet on the production switch virtual interface (SVI). Knowledge Area 6.1 already taught you topologies and ports. 6.2 taught attacks and countermeasures. 6.3 taught IEEE 802.1X, Remote Authentication Dial-In User Service (RADIUS), and Terminal Access Controller Access-Control System Plus (TACACS+) as access protocols. 6.4 asks whether the boxes you already own are in the right place, whether traffic is actually isolated, and whether the administrator path is harder to steal than a workstation.

Logical and physical placement: inline, passive, and virtual

Placement is where the device sits relative to the packets it is supposed to see or stop. Get this wrong and you buy a prevention product that can only write a log.

Inline is how you stop something. A next-generation firewall at the Internet edge, an IPS between the demilitarized zone (DMZ) and the internal virtual local area network (VLAN), a reverse proxy in front of a patient portal — those boxes only prevent if packets cannot go around them. Hairpinning a copy to a sensor while production uses a bypass switch is not inline. If the stem says "the IPS must block the exploit," the sensor belongs in the forwarding path, with an explicit fail-open or fail-closed decision that matches availability requirements. A hospital pharmacy network often fails open (medication cabinets must keep working). A payment Payment Card Industry (PCI) segment often fails closed (uninspected cardholder traffic is worse than a brief outage).

Passive is how you see something without becoming the outage. A TAP is a hardware splitter that copies frames and usually cannot inject. A SPAN session is a switch feature that mirrors frames to a destination port; it shares the switch fabric, can oversubscribe, and will silently drop the copy under load while the live conversation continues. Passive is the right answer when the requirement is detection, forensics, or a change window that cannot risk a new choke point. It is the wrong answer when the requirement is "stop the session now." A NIDS that pages the security operations center (SOC) after command-and-control (C2) has already uploaded the database is working as designed for detection and failing the prevention objective someone wrote into the ticket.

Virtual does not pick a side. A virtual firewall inserted in an SDN service chain is inline. A virtual sensor attached to a promiscuous port group is passive. Cloud security groups and network access control lists are logical inline filters at the hypervisor or virtual private cloud (VPC) boundary. The exam trick is the word "virtual" in a stem that never says whether prevent actions are enabled. Ask: does the packet have to go through this function, or is the function watching a copy?

Scenario — IPS on a SPAN port. You are the network security administrator for a regional clinic. Leadership bought an IPS license. The integrator, afraid of latency, attached the appliance to a core-switch SPAN of the Internet edge. Two weeks later the SOC has fifty "meterpreter" alerts and zero blocked sessions. The EHR is still reachable from the infected workstation because the live path never traversed the appliance. The SSCP diagnosis is passive placement of a prevention product. Move the function inline (or enable prevent on a firewall that already sits inline) if the objective is block. Keep the TAP/SPAN copy for a NIDS if the objective is alert. Do not rename the SPAN port "inline" in the runbook.

Physical placement still matters even when the function is virtual. Put the inline firewall where the trust boundary actually is: between Internet and DMZ, between DMZ and internal, between guest wireless and corporate, between operational technology (OT) / Internet of Things (IoT) and clinical. A virtual firewall in the wrong VPC, or a physical IPS on the wrong side of the NAT boundary, inspects the wrong traffic. Draw the flows first: who talks to whom, which interface is untrusted, which interface is trusted, what happens if the box dies.

Segmentation: more than a VLAN ID

Segmentation is how you limit blast radius. The outline's examples are physical/logical, data/control plane, VLAN, ACL, firewall zones, and micro-segmentation. Treat them as a stack, not as synonyms.

Physical versus logical. Physical segmentation is separate hardware and often separate people. A backup network that shares the production core is not physically segmented. Logical segmentation is cheaper and is how most enterprises isolate guest, voice, PCI, and IoT. The exam will offer "buy a second switch" when an ACL plus a firewall zone would meet the requirement — and it will offer "we have VLANs" when the routing table still has a default between them.

Data plane and control plane. The data plane is the forwarding path: switching ASICs, routing lookups, NAT. The control plane is how the device learns and is administered: Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), Spanning Tree, Secure Shell (SSH) to the CPU. A distributed denial of service that never matches a firewall rule can still punt packets to the CPU and take down BGP. CoPP rate-limits what the CPU will process. A management VRF or dedicated out-of-band (OOB) network keeps SSH and TACACS+ off the same path as YouTube. Software-defined networking (SDN) makes this explicit: the controller is control plane; the vSwitch is data plane. Compromise of the controller is compromise of every virtual firewall policy. Protect the controller like a domain controller, not like a lab hypervisor.

VLANs carve one physical LAN into multiple broadcast domains. That is necessary and not sufficient. Hosts in VLAN 20 (cameras) and VLAN 30 (electronic health record (EHR) workstations) still talk the moment a Layer 3 SVI exists with a default route and no ACL. Attackers also abuse VLAN hopping (double tagging against a native VLAN, or a rogue trunk). Operations hygiene: do not use VLAN 1; change the native VLAN on trunks; prune unused VLANs; disable Dynamic Trunking Protocol where you do not need it; put unused ports in a black-hole VLAN and shut them.

ACLs are the first enforcement layer many SSCPs actually type. Standard ACLs match source IP; extended ACLs match source, destination, protocol, and ports. Apply them inbound on the interface closest to the source when you can, so denied packets die before they consume core bandwidth. Remember implicit deny. Remember that an ACL on a router is not a stateful firewall unless the platform is tracking connections — a later 6.5 topic. An ACL that permits tcp any any eq 443 to the EHR is not "HTTPS security"; it is a port allow.

Firewall zones wrap ACLs in a default-deny trust model. You assign interfaces to zones (Untrust, DMZ, Internal, Guest, IoT, PCI) and write the allowed conversations: Guest → Proxy:TCP/443; IoT → Video management:TCP/554; PCI → Payment processor:TCP/443. Everything else is dropped and logged. Zones scale better than a 400-line interface ACL that nobody dares to edit. They also match how CAT stems are written: "the guest zone should not reach the EHR zone."

Micro-segmentation is policy at the workload, not at the subnet. Two application servers in the same VLAN should not be able to Remote Desktop Protocol (RDP) to each other just because they share a prefix. Hypervisor firewalls, host agents, and cloud security groups implement this. Ransomware that lands on a kiosk should not have Layer 3 adjacency to the imaging archive. Micro-segmentation does not replace the Internet firewall. It is how you survive the host that is already inside.

Scenario — VLANs without enforcement. Finance is VLAN 40. Clinical workstations are VLAN 30. The core has SVIs for both and a default permit. A phishing implant on a finance PC scans 10.30.0.0/16 and finds the EHR. The diagram in the audit binder said "segmented." The SSCP answer is: add ACLs or, better, firewall zones that allow only the flows the business named (for example finance print servers and a jump host), and use micro-segmentation if east-west inside VLAN 30 is still too open. Do not claim VLAN IDs as a control in the risk register.

Secure device management

The outline's third bullet is secure device management. Firewalls, switches, wireless controllers, and virtual appliances are privileged endpoints. If an attacker owns the core switch, segmentation is a story you tell yourself.

Out-of-band means the packets that administer the device do not ride the same path as the packets the device forwards. A console server on a separate switch, a management VRF that only jump hosts can route to, a lights-out card — those survive a data-plane incident. In-band management is convenient and is how many branch routers are reached, but when that WAN circuit is the incident, you have no lever. The SSCP preference in a stem that offers both is OOB for core and security appliances, with a documented break-glass console.

Disable unused services is hardening, not decoration. Telnet on TCP/23, HTTP on TCP/80, Cisco Discovery Protocol on user ports, Universal Plug and Play on a firewall, default SNMP communities public/private, and unused Layer 3 protocols are all remote-control or reconnaissance gifts. Shut unused switch ports and put them in an unused VLAN. Change default credentials on day zero — Knowledge Area 6.7 will say the same for cameras; 6.4 says it for the switch the cameras plug into.

AAA for devices is usually TACACS+ because it can authorize commands (no configure terminal for the help-desk role) and because accounting is granular. RADIUS is common for 802.1X network access (6.3). Do not mix them up on the exam: RADIUS to let a laptop on a VLAN is not the same as TACACS+ to let a named engineer change an ACL. Local accounts are the break-glass when the AAA server is down; they are unique, vaulted, and monitored, not admin/admin.

Configuration backups are part of change and recovery, not a nightly courtesy. Store them off the device, encrypted, with version history that maps to change tickets. Test a restore on a spare or a lab image. After a ransomware event that hits the network team's file share, the person who can still bring up a replacement firewall is the person whose backups were not only on that share.

Scenario — in-band Telnet. The core pair is managed by Telnet to the production SVI. SNMP v2c community public is used for graphing. The only copy of the configuration is running-config. An implant on a user VLAN brute-forces Telnet, dumps the config (including the SNMP community and the TACACS key if it was stored), and erases the startup file. Segmentation, IPS placement, and VLAN design are now whoever the attacker wants them to be. The SSCP fix is OOB or a locked-down management VRF, SSH/HTTPS only, AAA with named accounts, unused services off, SNMPv3, and encrypted off-box backups that a compromised data-plane host cannot delete.

Exam traps for 6.4

• Calling a SPAN/TAP sensor "inline" because the purchase order said IPS.
• Treating VLAN IDs as a control when inter-VLAN routing is unrestricted.
• Forgetting that the control plane can die while the data plane still forwards stale entries — or the reverse.
• Managing security appliances in-band with Telnet so the incident takes the lever with it.
• Micro-segmentation as a reason to remove the Internet firewall.

When you sit the item, ask three questions: Does this box sit in the path or on a copy? What actually drops a packet between these two subnets? How would I still administer this device if the production VLAN were hostile?