Modern enterprise cybersecurity is grounded in defense-in-depth: securing communications across every layer of the network stack, from physical Ethernet frames to identity federations and distributed APIs.
This master cheat sheet catalogs 40+ essential network security protocols and cryptographic defensive architectures, categorized across Transport Layer Encryption, Network Layer VPNs, Identity Federation & IAM, Threat Intelligence, and Public Key Infrastructure (PKI).
🔗 Related Cheat Sheets: Fundamental Network Communication Protocols Cheat Sheet · Cryptography Algorithms Master Cheat Sheet · Operations & High-Concurrency Systems Cheat Sheet
1. Transport Layer Security & Encrypted Channel Protocols
| Protocol | Version / Standard | Operating Layer | Primary Handshake & Cryptographic Mechanisms | Core Security Guarantees | Production Use Case |
|---|---|---|---|---|---|
| TLS 1.3 | RFC 8446 | Transport (L4.5) | 1-RTT handshake (0-RTT PSK resumption); enforces Forward Secrecy (ECDHE); eliminates obsolete ciphers (RSA key exchange, CBC, SHA-1) | Confidentiality, integrity, replay defense, downgrade attack prevention | Universal web security standard (HTTPS, gRPC, secure web APIs) |
| mTLS | Mutual TLS (RFC 8446) | Transport (L4.5) | Dual-certificate mutual authentication: both client and server present X.509 certificates validated against trusted CAs | Cryptographic zero-trust verification of service identity on both ends | Microservice service meshes (Istio, Linkerd), financial API gateways |
| SSH-2 | RFC 4253 | Transport / App | Diffie-Hellman key exchange; asymmetric host authentication (Ed25519/RSA); symmetric payload encryption (AES-GCM, ChaCha20) | Secure command execution, encrypted port forwarding, zero-trust remote shell | Linux server administration, Git repository access, secure bastion jumping |
| DTLS 1.3 | RFC 9147 | Transport (Over UDP) | Adapts TLS 1.3 for datagrams; adds replay detection windows, sequence numbers, and packet retransmission timers | Low-latency stream encryption with packet-loss resilience | WebRTC video streams, OpenVPN (UDP mode), IoT CoAP security |
| QUIC Crypto | RFC 9001 | Transport (Over UDP) | Injects TLS 1.3 cryptographic handshake natively into the QUIC packet transport layer | Complete encryption of packet payloads and transport connection headers | HTTP/3 web transport, modern content delivery networks (CDNs) |
2. Network & Link Layer Cryptographic Protocols (VPNs & Tunnels)
| Protocol / Suite | Layer Scope | Handshake & Exchange | Encapsulation & Packet Framing | Key Security Strengths | Typical Production Deployment |
|---|---|---|---|---|---|
| IPsec (ESP / AH) | Network (L3) | IKEv2 (Internet Key Exchange) with asymmetric certificates or pre-shared keys | ESP (Encapsulating Security Payload) encrypts L3 packets; AH provides header integrity; Tunnel vs Transport modes | Operating-system kernel-level transparent packet encryption for all IP applications | Corporate site-to-site cross-datacenter VPNs, SD-WAN backbones |
| WireGuard | Network (L3) | Noise Protocol Framework (1-RTT handshake via Curve25519) | Compact fixed-size headers; ChaCha20-Poly1305 symmetric encryption; BLAKE2s hashing | Extreme simplicity (~4,000 lines of code), instantaneous connection roaming, high throughput | Modern remote-work corporate VPNs, cloud VPC interconnects |
| OpenVPN | Network (L3/L2) | Custom TLS-based control channel for key exchange | TUN (L3 routed IP) or TAP (L2 bridged Ethernet) encapsulated inside UDP or TCP datagrams | Highly configurable, traverses restrictive firewalls by running over standard TCP 443 | Cross-platform legacy remote-access enterprise VPN gateways |
| MACsec (802.1AE) | Data Link (L2) | 802.1X EAP-TLS port-level key derivation (MKA protocol) | Appends SecTAG headers directly into Ethernet frames; line-rate AES-GCM-128/256 hardware encryption | Protects against rogue switch taps, ARP spoofing, and man-in-the-middle packet injection on physical wires | Direct fiber interconnects between private data centers, campus backbones |
| GRE over IPsec | Network (L3) | IPsec ESP tunnel encrypting outer GRE packets | GRE encapsulates arbitrary broadcast/multicast routing protocols (OSPF/BGP), then IPsec encrypts | Enables dynamic routing protocols to safely traverse unencrypted public WANs | Multi-office dynamic routing across enterprise cloud backbones |
3. Identity Federation, Authentication & Authorization Protocols
| Protocol | Primary Role | Core Token / Assertion Format | Flow & Architecture | Security Guarantees | Typical Production Scope |
|---|---|---|---|---|---|
| OAuth 2.0 / 2.1 | Delegated Authorization | Bearer Access Tokens (opaque or JWT) | Front-channel authorization code grant with PKCE (Proof Key for Code Exchange) + Back-channel token exchange | Least-privilege scoped API permissions without exposing user credentials | Third-party API authorization (Google Login, GitHub App access) |
| OpenID Connect | Identity Authentication Layer | Cryptographically signed identity tokens (JWT / JWS) | Extends OAuth 2.0 with standardized id_token claims (sub, iss, aud) and userinfo endpoint |
Standardized identity federation across distributed domains | Modern enterprise Single Sign-On (SSO) and mobile app auth |
| SAML 2.0 | Enterprise Identity Federation | XML-based signed assertions (XML-DSig) | Web browser redirect / POST bindings between Service Provider (SP) and Identity Provider (IdP) | Cross-domain enterprise single sign-on; robust role attributes | Corporate enterprise SaaS integrations (Okta, Azure AD, Salesforce) |
| Kerberos v5 | Symmetric Ticket Authentication | Encrypted binary session tickets (Ticket Granting Ticket) | Three-party trust model: Client ➔ Key Distribution Center (KDC) ➔ Ticket Granting Service (TGS) ➔ Target Service | Mutual authentication resistant to eavesdropping and replay attacks on LANs | Microsoft Active Directory enterprise internal domain authentication |
| RADIUS | Centralized Network AAA | UDP datagrams with MD5 response authenticators | Client-Server architecture handling Authentication, Authorization, and Accounting | Centralizes access controls for physical network infrastructure | Enterprise Wi-Fi (WPA3-Enterprise 802.1X), VPN user authentication |
| TACACS+ | Administrative Network AAA | TCP port 49 with complete payload encryption | Strictly separates Authentication, Authorization, and Accounting into distinct modular stages | Granular per-command authorization auditing on network hardware | Privileged command auditing on core enterprise switches and routers |
4. Zero Trust & Application Security Protocols
| Protocol / Standard | Governing Body | Architectural Function | Core Enforcement Mechanism | Business Security Value |
|---|---|---|---|---|
| SPIFFE / SPIRE | CNCF Graduated | Workload Identity Cryptography | Assigns cryptographic SPIFFE IDs (spiffe://domain/ns/prod/sa/app) bound to Short-lived X.509 SVIDs |
Completely eliminates static cloud credentials; provides automated zero-trust workload identities |
| ACME (RFC 8555) | IETF Standard | Automated Certificate Lifecycle | Verifies domain ownership via automated HTTP-01 or DNS-01 challenge responses | Eliminates manual certificate purchasing, deployment, and outage-causing expirations (Let's Encrypt, Certbot) |
| OCSP Stapling | RFC 6066 | Real-Time Certificate Revocation | Web server caches time-stamped CA-signed OCSP responses and serves them directly in the TLS handshake | Eliminates privacy leaks and DNS roundtrip delays during browser certificate revocation checks |
| KMIP | OASIS Standard | Enterprise Key Management | Standardized API for provisioning, storing, and rotating symmetric/asymmetric keys across heterogeneous appliances | Prevents vendor lock-in between storage arrays, databases (TDE), and Hardware Security Modules (HSMs) |
| PKCS#11 | OASIS Standard | Cryptographic Hardware Interface | Platform-independent C API (Cryptoki) abstracting physical smart cards and hardware security modules |
Ensures private keys are generated inside tamper-resistant hardware and never leave the physical silicon |
5. Email Security & Anti-Spoofing Protocols
[Incoming Email]
│
├── 1. SPF Check (RFC 7208)
│ └─ Verify sending server IP against sender domain's DNS TXT record
│
├── 2. DKIM Check (RFC 6376)
│ └─ Validate cryptographic public-key signature in email header against DNS
│
└── 3. DMARC Policy Evaluation (RFC 7489)
└─ Enforce domain owner's policy: p=none / p=quarantine / p=reject
| Protocol | Standard | Verification Target | Protection Mechanism | Business Impact |
|---|---|---|---|---|
| SPF | RFC 7208 | Sending Server IP Address | DNS TXT record declaring authorized sender IP addresses | Blocks attackers from sending forged plaintext emails using your domain |
| DKIM | RFC 6376 | Message Integrity & Non-repudiation | Asymmetric digital signature embedded in email headers, verified against domain DNS public key | Guarantees email body and attachments were not tampered with during transit |
| DMARC | RFC 7489 | Unified Spoofing Enforcement Policy | Instructs recipient servers on how to handle SPF/DKIM failures (reject, quarantine) with aggregate reporting |
The gold standard for defeating Business Email Compromise (BEC) and phishing impersonation |
| MTA-STS | RFC 8461 | Enforced Mail Transport Encryption | DNS and HTTPS policy records mandating TLS encryption for all inbound server-to-server mail | Prevents STARTTLS stripping and man-in-the-middle eavesdropping between email providers |