Networking and Systems for IT and Cyber Security, The Short Answer
Networking is the foundation on which every modern IT and cyber security role is built. Every data breach, every intrusion, every denial-of-service attack propagates across a network. Every cloud platform, web application, and email system traverses infrastructure governed by protocols, routing tables, and security controls. Understanding how data travels between devices, how protocols define communication, and how systems are administered and secured is non-negotiable knowledge for anyone pursuing a career in IT or cyber security.
Networking concepts are specifically examined in CompTIA Network+ (the most widely held networking certification globally, with over 400,000 certified professionals), CompTIA Security+, and the CEH. They form a significant component of both the Computing Online Degree Pathway (ODP 7713, ATHE Level 4 Extended Diploma) and the Cyber Security Online Degree Pathway (ODP 7733, Qualifi Level 5 Extended Diploma), which support progression to a university top-up year for a full honours degree.
In the UK, network engineers and systems administrators are in consistent demand across every sector. Entry-level network roles start at approximately £28,000; senior network architects command £70,000 or more. Systems administration, managing the servers, operating systems, and infrastructure an organisation depends on daily, requires the same foundational knowledge applied to operational rather than design contexts.
Core Networking Concepts
The following concepts form the bedrock of all networking knowledge. They appear across certifications from CompTIA Network+ to Cisco CCNA and are tested in technical interviews for roles from IT support engineer to cyber security analyst. Building this knowledge base before advancing to network security topics significantly accelerates progression through more advanced material.
The OSI Model
The Open Systems Interconnection model is a seven-layer conceptual framework describing how data travels from an application on one device to an application on another. From bottom to top, the layers are: Physical (cables and electrical signals), Data Link (MAC addresses and switching), Network (IP addresses and routing), Transport (TCP and UDP, ports), Session (session establishment and teardown), Presentation (encryption and encoding), and Application (HTTP, SMTP, DNS). The OSI model gives networking and security professionals a precise language for identifying at which layer a fault or attack is occurring, which is essential for troubleshooting, firewall rule design, and security analysis alike.
TCP/IP Protocol Suite
TCP/IP is the practical communications framework that underlies all internet and most private network traffic. IPv4 addresses (such as 192.168.1.1) identify devices on a network; IPv6 is the expanded successor addressing IPv4 address exhaustion. TCP (Transmission Control Protocol) establishes reliable, ordered, error-checked delivery through a three-way handshake (SYN, SYN-ACK, ACK) before data transfer begins. UDP (User Datagram Protocol) provides faster, connectionless delivery suited to real-time applications such as video streaming, DNS, and VoIP. Port numbers associate traffic with specific services: 22 (SSH), 80 (HTTP), 443 (HTTPS), 25 (SMTP), and 53 (DNS) are foundational reference knowledge for any networking or security role.
IP Addressing and Subnetting
IP addressing assigns a unique numerical identifier to every device on a network. Subnetting divides a larger address space into smaller, manageable subnetworks using subnet masks, expressed either in dotted-decimal notation (255.255.255.0) or CIDR format (/24). Understanding subnetting is essential for network design, firewall rule authoring, and security analysis: whether two IP addresses share a subnet determines whether they communicate directly or must traverse a router, which directly affects how firewall rules and intrusion detection signatures behave. Subnetting calculation is one of the most frequently examined areas in both CompTIA Network+ and Cisco CCNA examinations.
DNS, DHCP, and ARP
DNS (Domain Name System) resolves human-readable hostnames into IP addresses, enabling users and applications to connect to services by name rather than numerical address. DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, gateway addresses, and DNS server information to devices joining a network. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within a local network segment. All three protocols are frequent attack targets: DNS poisoning redirects users to malicious servers, DHCP spoofing hijacks network configuration, and ARP spoofing enables man-in-the-middle attacks on local network traffic. Understanding how they function is prerequisite knowledge for both network administration and security analysis.
Routing and Switching
Switches operate at OSI Layer 2, forwarding Ethernet frames within a local network by reading MAC addresses from their forwarding tables. Routers operate at Layer 3, forwarding packets between different networks based on IP addresses and routing tables populated by protocols such as OSPF, BGP, and EIGRP. VLANs (Virtual Local Area Networks) logically segment a physical network into isolated broadcast domains without requiring separate physical infrastructure, a primary technique for enforcing network separation and limiting the blast radius of a security incident. VLAN design is a core recommendation in both NIST and Cyber Essentials guidance for network security architecture.
Network Security Technologies
Network security applies technical controls that restrict, monitor, and protect traffic traversing an organisation's infrastructure. These controls are the practical implementation of the principles described in frameworks such as Cyber Essentials, NIST CSF, and ISO 27001. Understanding how they work and how to configure them correctly is central to security engineering, SOC analyst, and network administration roles.
Firewalls
Firewalls control network traffic by permitting or blocking packets based on defined rules covering source, destination, port, and protocol. Packet-filtering firewalls operate at OSI Layers 3 and 4. Stateful inspection firewalls track connection state, making them far more effective at blocking unsolicited inbound traffic. Next-generation firewalls (NGFWs) add application-layer inspection, deep packet inspection, intrusion prevention, and SSL decryption. Firewall configuration is one of the five Cyber Essentials technical controls, and maintaining firewall rule sets correctly is a daily operational task in both network and security operations roles.
IDS and IPS
An IDS (Intrusion Detection System) monitors network traffic for suspicious patterns and generates alerts when potential threats are identified without actively blocking them. An IPS (Intrusion Prevention System) adds active blocking capability, dropping traffic that matches threat signatures in real time. Snort and Suricata are widely used open-source tools supporting both modes. Network-based systems (NIDS/NIPS) monitor traffic at network chokepoints; host-based systems (HIDS) monitor activity on individual endpoints. SIEM platforms such as Splunk, Microsoft Sentinel, and IBM QRadar aggregate alerts from IDS/IPS alongside other security data sources, giving analysts a centralised and correlated view of security events across the environment.
VPNs and Zero Trust
A VPN (Virtual Private Network) creates an encrypted tunnel over a public network, enabling users to access internal resources securely from remote locations. IPsec and SSL/TLS are the primary VPN protocols. Zero Trust Network Access (ZTNA) is the architectural evolution of traditional VPN, grounded in the principle that no user, device, or system should be trusted by default regardless of network location. Access is granted based on continuous verification of identity, device health, and context. NIST SP 800-207 formalised the Zero Trust architecture standard in 2020, and the NCSC endorses Zero Trust principles for modernising enterprise network security in the UK.
Wireless Network Security
Wireless networks extend an organisation's attack surface beyond the physical perimeter. WPA3 is the current standard for Wi-Fi security, replacing the weaker WEP and WPA2 protocols. Enterprise deployments use 802.1X authentication with RADIUS servers to authenticate individual users and devices rather than relying on shared credentials. Rogue access points, unauthorised wireless devices connected to the corporate network, are a persistent attack vector that requires regular wireless scanning to detect. Wireless security concepts appear in CompTIA Network+ and Security+, and the Cyber Essentials boundary controls requirement explicitly covers wireless network configuration.
Network Monitoring and SIEM
Effective network security requires continuous visibility into traffic patterns and device behaviour. NetFlow and sFlow protocols export traffic summary data from routers and switches for analysis. Wireshark and tcpdump capture full packet contents for deep forensic investigation. SIEM platforms, including Splunk, Microsoft Sentinel, and IBM QRadar, collect, normalise, and correlate log data from network devices, firewalls, endpoint agents, and cloud services. SOC analysts spend a substantial portion of their working time reviewing SIEM dashboards and log data, making log analysis and SIEM query skills among the most practically valuable capabilities for entry-level security roles.
Network Segmentation
Network segmentation isolates different parts of an organisation's infrastructure into separate security zones, limiting lateral movement if an attacker gains an initial foothold. VLANs provide logical segmentation within a campus network. DMZs (Demilitarised Zones) separate internet-facing services such as web servers from internal systems. Microsegmentation, applied in cloud and virtualised environments, extends the principle to the level of individual workloads and containers. Both NIST and ISO 27001 recommend segmentation as a primary control for limiting the blast radius of security incidents, and the concept is integral to modern security architecture design across all sectors.
Systems Administration
Systems administrators manage the servers, operating systems, and infrastructure components that organisations rely on continuously. The role blends networking knowledge with operating system expertise, scripting capability, and an understanding of the security requirements that apply to each system under management. Sys-admin skills underpin both infrastructure-focused career paths and cyber security roles that require hands-on knowledge of the environments being protected.
Windows Server Administration
Windows Server environments require the management of Active Directory (user accounts, groups, organisational units, and Group Policy Objects), DNS and DHCP server roles, file and print services, and update management through WSUS. PowerShell is the primary automation and scripting tool for Windows administration, enabling bulk user account operations, service management, configuration enforcement, and reporting. Microsoft certifications including AZ-104 (Azure Administrator Associate) and MD-102 (Endpoint Administrator) validate Windows administration skills in cloud-integrated and hybrid environments. Active Directory knowledge is essential for both administration and security roles, as AD is the most frequently targeted component in enterprise attack chains.
Linux Server Administration
Linux dominates the server landscape for web hosting, cloud infrastructure, and embedded systems. Core administration skills cover web server management (Apache, Nginx), database administration (MySQL, PostgreSQL), package management (apt on Debian and Ubuntu; yum on RHEL and CentOS), user and file permissions management, systemd service control, and Bash scripting for automation. The RHCSA (Red Hat Certified System Administrator) and LFCS (Linux Foundation Certified System Administrator) certifications validate Linux administration skills. Kali Linux, a specialist security distribution, is also Debian-based, making Linux command-line proficiency a direct prerequisite for pen testing work as well.
Patch Management
Patch management, the disciplined process of testing and deploying software updates to address known vulnerabilities, is one of the five controls in the Cyber Essentials scheme. The NCSC recommends patching high-severity vulnerabilities within 14 days of a patch becoming available. Enterprise patch management tools including Microsoft WSUS, Ivanti, and ManageEngine automate update deployment across large, heterogeneous environments. The consequences of patch management failure are severe and well-documented: the 2017 WannaCry ransomware attack, which disrupted NHS services across England, exploited a Microsoft vulnerability for which a patch had been available for two months before the attack began.
Backup and Disaster Recovery
Organisational continuity depends on reliable backup and tested recovery capabilities. The 3-2-1 backup rule recommends three copies of data held on two different media types with one copy stored offsite. Recovery Time Objective (RTO) defines the maximum acceptable system downtime; Recovery Point Objective (RPO) defines the maximum acceptable data loss window. Ransomware attacks have made backup integrity a critical security concern: attackers now routinely identify and encrypt backup systems before triggering visible ransomware to eliminate recovery options and maximise leverage. Testing backup restoration regularly, not just creating backups, is as operationally important as the backup process itself.
Active Directory Security
Active Directory (AD) is Microsoft's directory service for managing identities and access in Windows environments and is the backbone of enterprise IT management in most UK organisations. From a security perspective, AD is one of the highest-value targets in an enterprise network. Compromising a domain controller gives attackers control over all domain-joined systems. Attack techniques including Pass-the-Hash, Kerberoasting, and DCSync specifically target AD authentication mechanisms to escalate privileges and move laterally across the network. Understanding AD structure and its associated attack vectors is directly relevant to security operations, penetration testing, and incident response roles.
Virtualisation and Containers
Virtualisation enables multiple operating systems to run concurrently on a single physical host using a hypervisor (VMware ESXi, Microsoft Hyper-V, or open-source KVM). Containerisation using Docker packages applications with their dependencies into isolated units that run consistently across different environments. Kubernetes orchestrates containers at scale. Both technologies are foundational in modern cloud infrastructure and are relevant to security because they introduce new attack surfaces, such as container escape vulnerabilities and hypervisor attacks, that systems and security administrators need to understand and mitigate.
Certifications and Career Paths
Networking and systems skills are validated by a well-established set of vendor-neutral and vendor-specific certifications that are widely recognised by UK employers. The career paths available to those with strong networking and systems knowledge range from dedicated network engineering through systems administration to cyber security operations and architecture roles.
CompTIA Network+ (N10-009)
The most widely held vendor-neutral networking certification globally, with over 400,000 certified professionals. Network+ validates knowledge of networking concepts, IP addressing, routing and switching, network services, network security, and troubleshooting. It is the standard foundation certification for anyone moving from IT support into networking or beginning cyber security study. CompTIA recommends Network+ before Security+ for candidates without prior networking experience, and most security hiring managers expect candidates to be comfortable with Network+ level material as a baseline.
Cisco CCNA
Cisco's entry-level networking certification is more technically demanding than Network+ and includes hands-on configuration of Cisco IOS devices covering OSPF and EIGRP routing, VLAN and spanning tree configuration, WAN technologies, and security fundamentals. CCNA is the standard entry credential for dedicated network engineer roles in organisations using Cisco infrastructure, which covers a majority of UK enterprise and service-provider networks. Entry-level network engineer roles typically advertise salary ranges of £28,000–£40,000, rising to £70,000 or more at senior architect level.
Microsoft and Linux Administration Certifications
For systems administration roles, Microsoft AZ-104 (Azure Administrator Associate) and MD-102 (Endpoint Administrator) validate Windows and cloud skills in hybrid environments. The Red Hat Certified System Administrator (RHCSA) is the standard credential for Linux server administration in enterprise environments. The Linux Foundation Certified System Administrator (LFCS) provides a vendor-neutral alternative. Systems administrators typically start at £28,000–£38,000 and progress to £50,000+ for senior roles managing large enterprise environments. DevOps and cloud-focused systems engineers can progress further with AWS, Azure, or Google Cloud certifications.
Networking for Cyber Security Roles
Networking knowledge directly enables progression into cyber security roles. CompTIA Security+ recommends Network+ as a prerequisite. CEH and OSCP preparation both require confident networking knowledge. SOC analyst roles require the ability to interpret SIEM alerts and network logs. Penetration testers rely on Nmap, Wireshark, and protocol exploitation throughout their work. For learners pursuing the Cyber Security Online Degree Pathway (ODP 7733), networking content forms a core component of the network security and risk management modules, with the academic Level 5 treatment providing the depth needed for university progression and more senior security roles.
Frequently Asked Questions
What is CompTIA Network+ and who should study it?+
CompTIA Network+ (current version N10-009) is a vendor-neutral certification validating the knowledge needed to design, configure, manage, and troubleshoot wired and wireless network infrastructure. Its domains cover networking concepts, addressing and subnetting, routing and switching, network services (DNS, DHCP, NTP), network security, and troubleshooting methodology. Network+ is the most widely held intermediate networking certification globally, with over 400,000 certified professionals. It is recommended for IT support professionals moving into networking roles and for cyber security learners who need to formalise networking knowledge before pursuing CompTIA Security+. Most hiring managers treat Network+ as reliable evidence of solid networking fundamentals in entry-level and mid-level technical roles.
What is the difference between a hub, switch, and router?+
A hub is a Layer 1 device that broadcasts all incoming traffic to every connected port simultaneously, creating collision domains and making it highly inefficient. Hubs are obsolete in modern network design. A switch operates at Layer 2, maintaining a MAC address table and forwarding Ethernet frames only to the port associated with the destination address, dramatically improving efficiency and reducing unnecessary traffic. A router operates at Layer 3, connecting separate networks and forwarding packets based on IP addresses and routing tables. In consumer and small business equipment these functions are often combined in a single device. In enterprise environments they are implemented as separate, managed hardware. This distinction is foundational knowledge tested in both CompTIA Network+ and cyber security role interviews.
How does networking knowledge support a cyber security career?+
Networking knowledge is foundational to cyber security for multiple concrete reasons. Security incidents propagate over networks, and understanding traffic flows helps analysts trace intrusion paths and contain threats. Firewalls, IDS/IPS, and SIEM tools all operate on network data, so configuring and interpreting them requires solid protocol and addressing knowledge. Penetration testers rely on network scanning (Nmap) and packet analysis (Wireshark) throughout every engagement. Many of the attack techniques covered in CEH and OSCP curricula exploit networking protocols: ARP spoofing, DNS poisoning, and man-in-the-middle attacks are network-layer attacks by definition. CompTIA recommends Network+ as prerequisite knowledge before Security+, and most cyber security hiring managers expect candidates to be comfortable with subnetting, TCP/IP, and common network services.
What is Active Directory and why does it matter for security?+
Active Directory (AD) is Microsoft's directory service for managing users, computers, groups, and policies in Windows-based enterprise environments. It is the identity backbone of the majority of UK organisations with more than a few dozen employees. AD uses a hierarchical domain structure to organise resources and enforce Group Policy settings across all domain-joined devices. From a security perspective, AD is one of the most frequently targeted components in enterprise attacks because compromising a domain administrator account or a domain controller grants effective control over all domain-joined systems. Well-documented attack techniques including Pass-the-Hash, Kerberoasting, and DCSync are specifically designed to exploit AD authentication. Both Windows administrators and cyber security professionals need a thorough understanding of AD architecture and its associated attack surface.
What is Zero Trust and how does it differ from traditional network security?+
Traditional network security operated on a perimeter model: everything inside the corporate network was trusted, everything outside was not. The proliferation of remote working, cloud services, mobile devices, and third-party access has made this boundary concept unworkable. Zero Trust is a security model that assumes no user, device, or system should be implicitly trusted regardless of its location, whether inside or outside a conventional network perimeter. Every access request must be authenticated, authorised based on verified identity and device posture, and continuously monitored. NIST published the formal Zero Trust Architecture standard (NIST SP 800-207) in 2020, and the NCSC recommends Zero Trust principles for organisations modernising their network security approach. Knowledge of Zero Trust architecture is increasingly expected in senior security engineering and architecture roles.
How does Cisco CCNA compare to CompTIA Network+?+
The Cisco CCNA is Cisco's entry-level networking certification and is more technically demanding than CompTIA Network+. CCNA includes hands-on configuration of Cisco IOS devices and validates knowledge of OSPF and EIGRP routing, VLAN and spanning tree configuration, WAN technologies, and network security fundamentals. It is the standard entry credential for dedicated network engineer roles in organisations using Cisco infrastructure, which covers a majority of UK enterprise and service-provider networks. Network+ provides a vendor-neutral foundation and is a reasonable preparatory step before CCNA, though many candidates go directly to CCNA. Both certifications are valued by UK employers, with CCNA carrying more weight for specialist networking roles and Network+ more broadly applicable across mixed-technology environments.
What networking topics appear in CEH and CompTIA Security+?+
CompTIA Security+ covers networking topics including wireless security (WPA3, 802.1X, RADIUS), VPN types (IPsec, SSL/TLS), network segmentation and DMZ architecture, DNS security including DNSSEC, common network protocol attacks (spoofing, session hijacking, man-in-the-middle), and firewall and IDS/IPS concepts and placement. The CEH covers more offensive networking content: network scanning with Nmap, packet capture and analysis with Wireshark, session hijacking techniques, denial-of-service attack types and mitigations, and methods for evading IDS/IPS detection. Both examinations expect solid understanding of the TCP/IP protocol suite, OSI model, and common network service protocols. Completing Network+ before either certification is strongly recommended for learners without existing networking experience.
How does networking relate to the Online Degree programmes in Computing and Cyber Security?+
Both the Computing Online Degree Pathway (ODP 7713, ATHE Level 4 Extended Diploma) and the Cyber Security Online Degree Pathway (ODP 7733, Qualifi Level 5 Extended Diploma) include networking content as part of their core curricula. The computing pathway covers networking fundamentals within its systems and infrastructure modules, providing the foundation needed for software engineering and systems development contexts. The cyber security pathway addresses network security architecture, secure network design, and defensive network controls in depth, aligning with the content expected in university-level cyber security degree programmes. Learners who have studied networking fundamentals before or alongside these pathways will be better prepared for programme content and for subsequent technical interviews when progressing to employment or university study.
Build Your Networking Foundation
Networking knowledge underpins every IT and cyber security career. Speak to an advisor about the right study route for your goals and existing experience level.