Network Infrastructure Models
Security implications of different network infrastructure approaches including physical isolation (air-gapped networks), logical segmentation (VLANs, subnets), and software-defined networking (SDN) with programmatic network control.
Understanding Network Infrastructure Models
Network infrastructure models determine how systems connect and communicate. The choice of model has significant security implications for isolation, attack surface, and operational capabilities.
Key network models: • Physical isolation (Air gap) — Complete network separation • Logical segmentation — Virtual separation on shared infrastructure • Software-defined networking — Programmatic network control
The 2010 Stuxnet attack proved that even air-gapped networks aren't impenetrable—the malware spread via infected USB drives to Iran's nuclear facility, demonstrating that physical isolation alone isn't sufficient.
Each model offers different security trade-offs between isolation, usability, cost, and management complexity.
Why This Matters for the Exam
Network infrastructure models are tested on SY0-701 as they're fundamental to security architecture. Questions cover when to use each model and their security implications.
Understanding these models helps with network security design, compliance requirements, and risk management. The right model depends on security requirements, operational needs, and resources.
The exam tests comparison of models and appropriate use cases for each.
Deep Dive
What Is an Air-Gapped Network and When Should You Use One?
Complete physical separation between networks with no connectivity.
True Air Gap Characteristics:
- •No network connectivity (wired or wireless)
- •No shared infrastructure
- •Physical separation of equipment
- •Data transfer only via sneakernet (removable media)
Air Gap Use Cases:
- •Military/classified systems
- •Critical infrastructure (nuclear, utilities)
- •Industrial control systems
- •Sensitive research
- •High-security financial systems
Air Gap Security Benefits:
| Benefit | Description |
|---|---|
| No remote attacks | Network-based attacks impossible |
| Malware containment | Can't spread via network |
| Data exfiltration harder | No network path out |
| Highest isolation | Complete separation |
Air Gap Challenges:
| Challenge | Security Implication |
|---|---|
| Updates | Difficult to patch, may remain vulnerable |
| Usability | Manual data transfer is slow |
| Human factor | USB drives can bridge gap |
| Cost | Duplicate infrastructure expensive |
How Can Air-Gapped Networks Be Compromised?
Despite physical isolation, air gaps can be bridged: • USB/removable media (Stuxnet example) • Supply chain compromise • Social engineering • Side-channel attacks (acoustic, electromagnetic)
What Is Logical Network Segmentation?
Virtual separation using VLANs, subnets, and access controls on shared infrastructure.
Logical Segmentation Methods:
| Method | Layer | Description |
|---|---|---|
| VLANs | 2 | Switch-based isolation |
| Subnets | 3 | IP-based separation |
| Firewalls | 3-7 | Traffic filtering |
| ACLs | 3-4 | Router-based filtering |
Logical Segmentation Benefits:
- •Cost-effective (shared infrastructure)
- •Flexible (easy to reconfigure)
- •Scalable
- •Manageable
Logical Segmentation Limitations:
- •Configuration errors can break isolation
- •Shared hardware = potential side channels
- •Software vulnerabilities can bypass
- •Less secure than physical separation
How Do Air Gap and Logical Segmentation Compare?
What Is Software-Defined Networking (SDN) and Its Security Implications?
Programmatic control of network behavior separating control from data plane.
SDN Architecture:
| Component | Function |
|---|---|
| Application layer | Network applications, security tools |
| Control plane | SDN controller, centralized decisions |
| Data plane | Physical switches, packet forwarding |
SDN Security Benefits:
- •Centralized visibility and control
- •Programmatic security policy
- •Rapid response to threats
- •Microsegmentation capabilities
- •Automated provisioning
SDN Security Risks:
| Risk | Description |
|---|---|
| Controller compromise | Single point of failure |
| API vulnerabilities | Programmatic access = new attack surface |
| Misconfiguration | Errors affect entire network |
| Complexity | New skills required |
SDN Security Controls:
- •Controller hardening
- •Secure API authentication
- •Encryption between components
- •Redundant controllers
- •Change management for policies
How Do You Choose Between Network Models?
Comparison Matrix:
| Aspect | Air Gap | Logical | SDN |
|---|---|---|---|
| Security | Highest | Medium | Medium-High |
| Cost | High | Low | Medium |
| Flexibility | Low | Medium | High |
| Management | Complex | Moderate | Centralized |
| Scalability | Poor | Good | Excellent |
| Remote access | None | Possible | Possible |
Use Air Gap When:
- •Highest security required
- •Compliance mandates isolation
- •Remote access not needed
- •Cost is secondary to security
Use Logical Segmentation When:
- •Balance of security and usability
- •Resources need controlled interconnection
- •Cost-effective isolation needed
- •Standard compliance requirements
Use SDN When:
- •Dynamic environment
- •Centralized control needed
- •Automation is priority
- •Cloud or hybrid deployment
How CompTIA Tests This
Example Analysis
Scenario: A utility company needs to secure their SCADA/ICS network controlling power distribution. They're debating between air-gapping the OT network, using logical segmentation with firewalls, or implementing SDN for flexibility.
Analysis - Network Model Selection:
Requirements Analysis:
| Requirement | Weight |
|---|---|
| Security (critical infrastructure) | Highest |
| Reliability (power distribution) | Highest |
| Remote monitoring | Medium |
| Update capability | Medium |
Option Evaluation:
Air Gap:
- •✅ Highest security
- •✅ No remote attack vector
- •❌ No remote monitoring without bridging
- •❌ Difficult to update/patch
- •Risk: Unpatched systems become vulnerable
Logical Segmentation with Industrial Firewalls:
- •✅ Controlled remote access possible
- •✅ Can still isolate effectively
- •✅ Allows secure updates
- •❌ Configuration errors possible
- •❌ Firewall vulnerabilities
SDN:
- •✅ Centralized control
- •✅ Rapid response capability
- •❌ Controller = single point of failure
- •❌ Added complexity for OT environment
- •❌ Staff may lack SDN expertise
Recommendation:
- •Layered approach:
- 1.Physical separation of IT and OT networks
- 2.Industrial DMZ between zones
- 3.Unidirectional gateways (data diodes) for monitoring
- 4.Strict logical segmentation within OT
- 5.Air gap for most critical systems
Key insight: Critical infrastructure often uses hybrid approaches—air gap for the most sensitive components with controlled connectivity for less critical systems.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
Think of network models like building security:
Air Gap = A building on a private island. No bridges, no ferries, no connections. Maximum security, but getting supplies there is a nightmare. (Stuxnet showed someone can still swim over with a USB-shaped message in a bottle.)
Logical Segmentation = A building with multiple secure floors. Everyone shares the elevator, but you need different keycards for different floors. Cheaper than separate buildings, but a determined attacker in the elevator shaft could reach any floor.
SDN = A smart building where one security center controls all doors remotely. Flexible and efficient, but if someone hacks the security center, they control everything.
- •The exam pattern:
- •"Highest isolation" = Air gap
- •"Cost-effective separation" = Logical/VLANs
- •"Centralized control, programmatic" = SDN
- •"Single point of failure" = SDN controller risk
Test Your Knowledge
Q1.A military facility requires the highest level of network isolation for classified systems. What network model should be used?
Q2.What is the PRIMARY security risk of Software-Defined Networking (SDN)?
Q3.The Stuxnet malware demonstrated that air-gapped networks can be compromised through:
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee