Firewalls, IDS, IPS and zero trust: network security basics
Learn how firewalls, intrusion detection and intrusion prevention differ, and how segmentation and zero trust contribute to layered security.
Networks carry requests and data among users, devices and services. Security controls can limit communications, observe suspicious activity and support a response. Firewalls, intrusion detection systems and intrusion prevention systems have different roles, and real products may combine features. A control's effectiveness depends on configuration, placement, traffic visibility and ongoing operation.
## Firewall: apply traffic rules
A firewall is a device or software that controls network traffic according to a security policy. For example, a rule might allow an application to reach a database on a required port while denying other connections. The rule must reflect the environment and be reviewed as systems change. A firewall does not prove that all allowed traffic is safe. [NIST's firewall guidance](https://csrc.nist.gov/pubs/sp/800/41/r1/final) describes firewall technologies and policies.
## IDS and IPS: detect, alert and sometimes block
An intrusion detection system (IDS) monitors and analyzes system or network events to identify suspicious activity and alert operators. An intrusion prevention system (IPS) can also attempt to stop detected activity, for example by blocking a matching connection when configured to do so. A combined intrusion detection and prevention system may provide both functions. The letters IPS here mean intrusion prevention system, not the plural of an IP address. See the [NIST IDS definition](https://csrc.nist.gov/glossary/term/intrusion_detection_system) and [IPS definition](https://csrc.nist.gov/glossary/term/intrusion_prevention_system).
Detection is not certainty: alerts can be false positives, while attacks may go unnoticed when coverage or visibility is incomplete. Automatic blocking can interrupt legitimate operations, so test rules, define response authority, monitor results and maintain a safe recovery procedure.
## Segmentation, VPNs and proxy services
Network segmentation separates systems into groups and restricts which groups can communicate. For example, a sensitive database may accept connections only from an approved application tier. Segmentation can reduce unnecessary paths, but its protection depends on correctly enforced and maintained rules.
A virtual private network (VPN) creates a protected communication connection across another network. It does not automatically determine what every connected user may access. A proxy is an intermediary that receives a request and forwards it on behalf of a client or service; its specific filtering, logging and trust behavior depends on its configuration. These are different functions, and they can be used together.
## Zero trust and least privilege
Zero trust is a security approach that avoids granting implicit trust solely based on a user's or device's network location or ownership. It focuses on protecting resources and applying authentication and authorization for access. It does not mean that network controls or segmentation are unnecessary. [NIST SP 800-207](https://csrc.nist.gov/pubs/sp/800/207/final) explains the architecture and its assumptions.
Least privilege means giving an account or process only the permissions needed for its authorized task. In practice, identify the resource, allow the necessary access and review or remove permissions when needs change. Neither an access rule nor an alert alone proves a system is secure.
For an illustrative workflow, an organization restricts a service's network paths, monitors relevant events and gives an analyst authority to investigate alerts before applying disruptive blocks. Logs and incident plans help the team understand and recover from mistakes. See [Mithril's security operations guide](https://blog.mithril.fund/siem-soar-edr-xdr-explained?lang=en). This guide describes general concepts, not a claim that Mithril offers any particular firewall or monitoring service. Sources reviewed on 2026-10-29.