Network & infrastructure
Definiciones en lenguaje claro del tema network & infrastructure.
DDoS
In network security, a DDoS (distributed denial-of-service) attack overwhelms a target with traffic from many sources at once, so that legitimate users cannot reach the service. The distribution across many hosts is what makes it hard to block by address and hard to absorb without dedicated capacity.
DMARC
In email security, DMARC is a policy that tells receiving mail servers what to do with a message that fails authentication and lets a domain owner collect reports on who is sending as their domain. It is the control that decides whether a spoofed phishing email is delivered, and the first thing checked on any external assessment.
DMZ (demilitarised zone)
A DMZ is a network segment that sits between an organisation’s internal network and an external one, usually the internet, so that what has to be published is not sitting next to what has to stay private.
DNS cache poisoning
In network security, DNS cache poisoning is the insertion of a forged answer into a resolver’s cache, so everyone who asks that resolver for a name is sent to an address the attacker chose. The domain’s own records are untouched and so is its registrar account: what is corrupted is the copy of the answer the resolver keeps and serves.
DNS hijacking
In network security, DNS hijacking is the redirection of traffic by tampering with how a domain resolves, at the registrar, the resolver or the record level. Because DNS is the first lookup almost every connection makes, controlling it lets an attacker send users and services to infrastructure they control.
DNS over HTTPS (DoH)
DNS over HTTPS, specified in RFC 8484, carries DNS queries inside ordinary HTTPS requests so that resolution is encrypted and indistinguishable from web traffic. It provides confidentiality for the query and says nothing about whether the answer is genuine, which is a different problem with a different solution.
DNS tunnelling
In offensive security, DNS tunnelling encodes data inside DNS queries and responses to create a covert channel for exfiltration or command and control. Because DNS is almost always allowed out, it survives egress filtering that blocks everything else, which is why a red team reaches for it when the other routes are closed.
DNSSEC
In network security, DNSSEC is a set of extensions that let a validating resolver confirm a DNS answer came from the zone’s owner and was not altered in transit. It gives authenticity and integrity, not confidentiality: the query and answer still travel in clear text. Encrypting the lookup itself is the job of DoH, DoT or DoQ.
File Transfer Protocol (FTP)
FTP is the classic protocol for moving files between a client and a server over TCP/IP. It was designed for an internet without adversaries, so it encrypts nothing: the username, the password and the contents of every file travel in the clear. It still runs everywhere, and that is precisely the problem.
Firewall
In network security, a firewall is a control point that allows or denies traffic according to policy. The single word now covers several distinct things: a stateful filter at the network layer, an application-aware next-generation firewall, a host firewall on the endpoint, and the cloud security group where much of the decision is actually made today.
MAC address
On a local network, a MAC address is the identifier the manufacturer burns into a device’s network interface and that travels in every link-layer frame. It exists to deliver traffic inside the segment, not to prove which device sent it: any operating system can change it in seconds.
Microsegmentation
In network security, microsegmentation enforces access policy at the level of the individual workload rather than the subnet, so that each server, container or service only talks to the specific others it needs. It is what actually stops the lateral movement a red team demonstrates on an internal test, and it operates a layer below network segmentation.
mTLS
mTLS, or mutual TLS, is TLS in which both sides present a certificate, so the client proves its identity to the server as well as the other way round. It gives service-to-service traffic an authenticated identity that does not depend on network position, which is why it underpins zero trust between workloads.
SASE
In network security, SASE (secure access service edge) is a cloud-delivered model that combines networking and security into one service: it bundles software-defined wide-area networking with controls such as a secure web gateway, a cloud access security broker, ZTNA and firewall-as-a-service. It is how organisations increasingly buy secure connectivity as a single platform.
SSE
Security Service Edge, or SSE, is the delivery of network security controls from a cloud platform instead of from appliances in an office: secure web gateway, cloud access security broker, zero trust network access and usually data loss prevention. It is the security half of SASE, without the networking half.
Zero trust
Zero trust is a security architecture that stops treating network location as evidence of anything: every request is authenticated, authorised and evaluated against policy, no matter where it comes from. It is a design principle described in NIST SP 800-207, not a product, and no supplier can sell you one.
ZTNA
In network security, ZTNA (zero trust network access) is the product that grants a user access to a specific application after verifying identity and device posture, rather than placing them on the network as a VPN does. It is what actually replaces the VPN, and the term that lets the VPN and zero trust entries stop confusing layers.