• Understanding Network Hardening & Monitoring

I learned how network hardening works by adding multiple layers of security, a strategy known as defense in depth. Each tool or device strengthens the network and reduces the chances of successful attacks.

I learned the purpose and function of four major network security components:

• Firewalls: They filter traffic based on rules, inspecting packet headers (and payloads in NGFWs) to allow or block connections. Every system should have its own firewall.

• Intrusion Detection Systems (IDS): IDS tools monitor network activity and alert administrators when they detect signatures of known attacks or suspicious anomalies. They don’t block traffic; they only notify analysts.

• Intrusion Prevention Systems (IPS): IPS devices actively block malicious traffic. They detect signatures and anomalies, then drop packets or block senders. Because they sit inline, a failure can disrupt connectivity.

• Security Information and Event Management (SIEM): SIEM tools collect logs from across the network—firewalls, IDS, IPS, VPNs, proxies, DNS—and centralize them into one dashboard. They provide real‑time monitoring and help analysts identify suspicious activity.

I also learned how full packet capture devices support investigations by recording all network traffic, which helps validate IDS alerts.

Overall, I gained an understanding of how these tools fit into network architecture, how they complement each other, and how security analysts use them together to detect, monitor, and respond to threats. I also learned that organizations must balance cost, risk, and staffing when deciding which tools to deploy.