Các chủ đề (Topics) nghiên cứu/học tập trong an ninh mạng (Network Security)

Chủ đề cơ bản (Foundation)

Mô hình OSI/TCP-IP & bảo mật từng lớp.
Firewall: Stateful, Next-Gen (App-ID, User-ID, SSL Decrypt), Rule design.
VPN: IPsec (Site-to-Site, Remote Access), SSL/TLS VPN, WireGuard, Zero Trust Network Access (ZTNA).
IDS/IPS: Signature-based, Anomaly-based, Suricata/Snort/Zeek, Tuning false positive.
NAC (Network Access Control): 802.1X, MAB, Posture Assessment, Guest/ BYOD.
Phân đoạn mạng: VLAN, VRF, Micro-segmentation (Cisco ACI, VMware NSX, Illumio).
DNS Security: DNSSEC, DNS over HTTPS/TLS, RPZ, Threat Intelligence Feeds.
Proxy/CASB: Forward/Reverse Proxy, SSL Inspection, DLP, Shadow IT discovery.

Zero Trust Architecture (ZTA): Never trust, always verify. NIST SP 800-207, Google BeyondCorp.
SASE / SSE: Converged network + security (Cato, Zscaler, Netskope, Palo Alto Prisma, Cloudflare One).
Cloud Network Security: AWS VPC/TGW/Network Firewall, Azure VNet/Firewall/Private Link, GCP VPC/Service Controls/Cloud Armor.
Container/Kubernetes Network Security: CNI (Calico, Cilium), Network Policies, Service Mesh (Istio, Linkerd), eBPF.
Threat Hunting & Detection Engineering: MITRE ATT&CK mapping, Sigma rules, KQL/Splunk SPL, SOAR playbooks.
Encryption & PKI Automation: mTLS everywhere, SPIFFE/SPIRE, cert-manager, ACME, Post-Quantum Crypto (PQC).
OT/ICS/IIoT Security: Purdue Model, IEC 62443, Unidirectional Gateways (Data Diodes), Passive Monitoring (Nozomi, Claroty, Dragos).
AI/ML trong bảo mật mạng: UEBA, NDR (Network Detection & Response), Automated Threat Hunting, Adversarial ML.
Supply Chain & SBOM: Software Bill of Materials, SLSA, Sigstore, Dependency Confusion.
Ransomware Resilience: Immutable Backup, Air-gap, Cyber Recovery Vault, Tabletop Exercise.

Lightweight Cryptography cho IoT/Constrained devices.
P4/Programmable Data Plane Security (INT, In-band Network Telemetry).
Moving Target Defense (MTD) trong mạng SDN.
Federated Learning cho Threat Detection bảo toàn privacy.
Blockchain/DLT cho PKI, Routing Security (RPKI), Audit Log.
Quantum Key Distribution (QKD) & Post-Quantum TLS.
Side-channel attacks trên network equipment.
Automated Vulnerability Discovery (Fuzzing, Symbolic Execution) cho network protocols.

Conference: Black Hat, DEF CON, RSA, USENIX Security, NDSS, SANS Summits.
Blog: Cloudflare, Google Security, Microsoft Security, Palo Alto Unit 42, Mandiant, CrowdStrike, Wiz, Sysdig.
Framework: NIST CSF 2.0, MITRE ATT&CK, CIS Controls v8, Zero Trust Reference Architecture.