Talking about secure networks is like talking about safe pools. A pool is just a body of water, and if it has enough water to swim in, then it has more than enough water to drown in. A pool is inherently unsafe. We, therefore, take care in how we use a pool: We don’t swim alone; we don’t run around the pool; we don’t dive in the shallow end; and we don’t swim less than 15 minutes after eating. (Is that 15-minute rule still a thing?) These pool-safety policies ensure that our use of the pool is as safe as possible, but they do not make the pool safe in and of itself.

\n This distinction applies to data networks. A data network simply moves data from place to place and that’s all, so in addition to all of its desired uses, it can be used to facilitate attacks. We, therefore, use additional systems to secure our use of networks: we identify endpoints; we encrypt data flows; we control which endpoints can communicate with one another; and we inspect the data flows to block malware.…