Network threats

Network security is a combination of strategies, policies and features that aim to protect your network from threats, for example by fending off attacks from the outside. Find out more about basic and advanced measures that build on one another to improve the security of your IT system.

• Classic firewall (port level): A firewall is a vital element of network security and the protection of the company network. Put simply, it keeps network segments separate from one another. It checks incoming and outgoing data packets, for example between a company network and the Internet. The ports are managed in line with previously defined rules and the data traffic is either allowed or blocked if suspicious activity is detected. Firewalls can be physical devices, virtual devices, or a combination of both.
   
• Next-generation firewall (application level): A next-generation firewall offers a greater range of features than a conventional firewall and ensures a higher level of security by filtering the data traffic within the network. For example, application management can be used to block specific applications or application groups, or to redirect data traffic. This prevents the use of risky applications and deliberately controls the data traffic. For example, this can prevent the egress of data via cloud-sharing services such as Dropbox. Also possible is a finer segmentation of the network to permit applications that are important for specific tasks.
   
• Unified Threat Management: UTM combines several security functions into a single device that takes up the position as a central component of network security. This allows a firewall to support additional features such as spam/content filters, application control (AM/AV), intrusion detection (IDS/IPS), and others. By centralizing these components, UTM improves the efficiency of the individual devices, not only because they are fully compatible, but also because they greatly simplify administration and maintenance.
   
• Network access control: NAC gives you a precise overview of the users and devices on your network. You can see precisely who is allowed to perform certain functions and who is not. Furthermore, an end device can only join the network if it authenticates in line with established policies. This helps to defend against malware and unauthorized access.
   
• Network segmentation and permissions management (including VPN): With segmented networks, the infrastructures and applications are divided into different areas. Each segment is subject to differentiated access permissions and rules, so that if one segment is compromised, this does not lead to serious impact on the other segments. The company network as a whole remains protected. Virtual private networks (VPN) can also be used to help implement permissions management. A VPN allows you to access a network (e.g. the company network) even though you are currently in a different environment (e.g. your home network). The software redirects the data traffic to the target server and, from the outside, the entire exchange appears to take place within the target network. The exchanged data is encrypted and the vulnerable network connection from the home network or public place is secured.
   
• Web application firewalls: A web application firewall monitors the HTTPS data traffic between company-network based web applications and the Internet, it filters the exchanged data packets, and it blocks suspicious interactions. This protects your own web server against attacks from the Internet, for example, by detecting incorrect entries in online forms.
   
• Sandboxing with machine learning: With sandboxing, any executable files are transferred to an isolated test environment – the “sandbox” – before being executed. They are then closely monitored for malware, but they remain fully isolated from the other network activity. Potential dangers are detected and eliminated, and your own data remains protected. In the context of network security, machine learning means that the security components are able to recognize patterns based on previously fed data and real-time analysis conducted by the sandbox: Even without previous knowledge of the specific type of attack, the system can tell the difference between attacks on the network and harmless activities. This type of classification can also prevent “zero-day attacks” that do not match any of the known rules.