Enterprises have worked to secure cloud networks by disabling public endpoints, privatizing traffic, and replacing shared secrets with revocable identities, aligning with a zero-trust strategy. While the instinct is to simplify network security, real deployments require a layered approach, as different workloads necessitate varying controls and costs. Messaging infrastructure, like other services, starts permissively, accepting connections from anywhere via easily copied keys, making it crucial to transition to a secure posture.Network security is layered because no single rule covers all client scenarios effectively; for instance, an IP allow list suits stable addresses while a private endpoint benefits in-network clients. Each control addresses a specific question about access, such as which public addresses or virtual network subnets can reach a namespace, or if it should have a public surface at all. This "defense in depth" principle, common in on-premises security, remains vital in the cloud, albeit with cleaner tools.Azure Service Bus offers a comprehensive toolkit for layered network security, including IP firewall rules, service endpoints, private endpoints, and Network Security Perimeter. IP firewall rules restrict access to specific public IP addresses, ideal for known, stable callers, and are broadly applicable across tiers. Service endpoints secure namespaces by locking them to specific virtual network subnets, making them unreachable publicly when paired with public access denial. Private endpoints provide private IP access from within your virtual network, enabling cross-network communication over the Microsoft backbone and preventing data exfiltration, though they require more configuration.Network Security Perimeter allows managing rules for groups of platform resources as a logical boundary, complementing private endpoints by securing external conversations and internal resource interactions. Integrating network security with geo-replication demands careful planning; service endpoints simplify this across promotions, while private endpoints require creating one in each region and managing DNS updates.Identity forms a crucial top layer, determining authorization after network controls grant access. Replacing weak shared access signatures with stronger managed identities through Entra ID, which removes secrets and enables least-privilege roles, is highly recommended. The goal is to right-size the security stack to the workload, applying easy controls like IP firewall rules and service endpoints to close initial gaps, and adding more complex ones like private endpoints only when genuinely needed for critical pipelines. Therefore, network security should be viewed as an assembled stack of controls, each assuming the failure of the layer beneath it, to build truly resilient defenses.