network-administration

# Network administration The network is the substrate everything else assumes works. It gets attention when it fails and is otherwise expected to be invisible, which is why its design debts persist for years. ## Segment by trust, and mean it A flat network means one compromised laptop reaches the finance server. Segmentation is the highest- value structural control available and the most commonly deferred. Separate at minimum: user devices, servers, management interfaces, guest, and anything unmanaged — printers, cameras, building systems, contractor equipment. That last category is the recurring entry point, because it is rarely patched and rarely owned. Default deny between segments, and permit specific flows. Rules that accumulate without review become an allow-all with extra steps; review them on a cadence and remove what no longer has a reason. ## Remote access The perimeter stopped being a perimeter when the workforce and the workloads left it. Treat network location as weak evidence of trust: being on the corporate network should not by itself grant access to anything sensitive. Prefer per-application access over full network access. A remote user needing one internal application does not need a route to the entire internal estate, which is what a traditional VPN grants by default. Authentication and authorization policy belongs to `security:access-and-identity`; this skill implements the network path. ## DNS and addressing are load-bearing DNS failure prese...