Given a scenario, implement secure network designs Flashcards
Load balancing
Active/active Active/passive Scheduling Virtual IP Persistence
A load balancer distributes client requests across available server nodes in a farm or pool. This is used to provision services that can scale from light to heavy loads, and to provide mitigation against DDoS attacks. A load balancer also provides fault tolerance. If there are multiple servers available in a farm, all addressed by a single name/IP address via a load balancer, then if a single server fails, client requests can be routed to another server in the farm.
Active/active
An active/active cluster means that both nodes are processing connections concurrently. This allows the administrator to use the maximum capacity from the available hardware while all nodes are functional. In the event of a failover the workload of the failed node is immediately and transparently shifted onto the remaining node. At this time, the workload on the remaining nodes is higher and performance is degraded.
Active/passive
if one node is active, the other is passive. This is referred to as active/passive clustering. The major advantage of active/passive configurations is that performance is not adversely affected during failover. However, the hardware and operating system costs are higher because of the unused capacity.
Scheduling
The scheduling algorithm is the code and metrics that determine which node is selected for processing each incoming request. The simplest type of scheduling is called round robin; this just means picking the next node. Other methods include picking the node with the fewest connections or the best response time. Each method can also be weighted, using administrator set preferences or dynamic load information or both.
The load balancer must also use some type of heartbeat or health check probe to verify whether each node is available and under load or not. Layer 4 load balancers can only make basic connectivity tests while layer 7 appliances can test the application’s state, as opposed to only verifying host availability.
Virtual IP
For example, you might want to provision two load balancer appliances so that if one fails, the other can still handle client connections. Unlike load balancing with a single appliance, the public IP used to access the service is shared between the two instances in the cluster. This is referred to as a virtual IP or shared or floating address. The instances are configured with a private connection, on which each is identified by its “real” IP address. This connection runs some type of redundancy protocol, such as Common Address Redundancy Protocol (CARP), that enables the active node to “own” the virtual IP and respond to connections. The redundancy protocol also implements a heartbeat mechanism to allow failover to the passive node if the active one should suffer a fault.
Persistence
In load balancing, the configuration option that enables a client to maintain a connection with a load-balanced server over the duration of the session. Also referred to as sticky sessions.
Network segmentation
Virtual local area network (VLAN) Screened subnet (previously known as demilitarized zone) East-west traffic Extranet Intranet Zero Trust
A network segment is one where all the hosts attached to the segment can use local (layer 2) forwarding to communicate freely with one another. The hosts are said to be within the same broadcast domain.
Virtual local area network (VLAN)
Logically separate network, created by using switching technology. Even though hosts on two VLANs may be physically connected to the same cabling, local traffic is isolated to each VLAN so they must use a router to communicate.
Because enterprise networks typically feature hundreds of switching appliances and network ports (not to mention wireless access and remote access), segmentation is more likely to be enforced using virtual LANs (VLANs). Any given switch port can be assigned to any VLAN in the same topology, regardless of the physical location of the switch. The segmentation enforced by VLANs at layer 2 can be mapped to logical divisions enforced by IP subnets at layer 3.
Screened subnet (previously known as demilitarized zone)
A segment isolated from the rest of a private network by one or more firewalls that accepts connections from the Internet over designated ports.
A screened subnet uses two firewalls placed on either side of the DMZ. The edge firewall restricts traffic on the external/public interface and allows permitted traffic to the hosts in the DMZ. The edge firewall can be referred to as the screening firewall or router. The internal firewall filters communications between hosts in the DMZ and hosts on the LAN. This firewall is often described as the choke firewall. A choke point is a purposefully narrow gateway that facilitates better access control and easier monitoring.
East-west traffic
In computer networking, east-west traffic is network traffic among devices within a specific data center.
Extranet
An extranet is a controlled private network that allows access to partners, vendors and suppliers or an authorized set of customers
Intranet
What is an intranet?
An intranet is a private network contained within an enterprise that is used to securely share company information and computing resources among employees. … A database that includes all the usernames of employees who have access rights to the network is often used to maintain intranet security.
Zero Trust
Security design paradigm where any request (host-to-host or container-to-container) must be authenticated before being allowed.
Virtual private network (VPN)
Always-on Split tunnel vs. full tunnel Remote access vs. site-to-site IPSec SSL/TLS HTML5 Layer 2 tunneling protocol (L2TP)
Always-on
Traditional remote access VPN solutions require the user to initiate the connection and enter their authentication credentials. An always-on VPN means that the computer establishes the VPN whenever an Internet connection over a trusted network is detected, using the user’s cached credentials to authenticate.
Split tunnel vs. full tunnel
Split == VPN configuration where only traffic for the private network is routed via the VPN gateway. == The client accesses the Internet directly using its “native” IP configuration and DNS servers.
Full == VPN configuration where all traffic is routed via the VPN gateway. == Internet access is mediated by the corporate network, which will alter the client’s IP address and DNS servers and may use a proxy.
Remote access vs. site-to-site
Remote == With a remote access VPN, clients connect to a VPN gateway on the edge of the private network. This is the “telecommuter” model, allowing home-workers and employees working in the field to connect to the corporate network. The VPN protocol establishes a secure tunnel so that the contents are kept private, even when the packets pass over ISPs’ routers.
Site to site == A VPN can also be deployed in a site-to-site model to connect two or more private networks. Where remote access VPN connections are typically initiated by the client, a site-to-site VPN is configured to operate automatically. The gateways exchange security information using whichever protocol the VPN is based on. This establishes a trust relationship between the gateways and sets up a secure connection through which to tunnel data. Hosts at each site do not need to be configured with any information about the VPN. The routing infrastructure at each site determines whether to deliver traffic locally or send it over the VPN tunnel.
IPSec
A set of open, non-proprietary standards that are used to secure data through authentication and encryption as the data travels across the network or the Internet.
Internet Protocol Security (IPSec) operates at the network layer (layer 3) of the OSI model, so it can be implemented without having to configure specific application support. IPSec can provide both confidentiality (by encrypting data packets) and integrity/anti-replay (by signing each packet). The main drawback is that it adds overhead to data communications. IPSec can be used to secure communications on local networks and as a remote access protocol.
SSL/TLS
SSL stands for Secure Sockets Layer and, in short, it’s the standard technology for keeping an internet connection secure and safeguarding any sensitive data that is being sent between two systems, preventing criminals from reading and modifying any information transferred, including potential personal details. The two systems can be a server and a client (for example, a shopping website and browser) or server to server (for example, an application with personal identifiable information or with payroll information).
It does this by making sure that any data transferred between users and sites, or between two systems remain impossible to read. It uses encryption algorithms to scramble data in transit, preventing hackers from reading it as it is sent over the connection. This information could be anything sensitive or personal which can include credit card numbers and other financial information, names and addresses.
TLS (Transport Layer Security) is just an updated, more secure, version of SSL. We still refer to our security certificates as SSL because it is a more commonly used term, but when you are buying SSL from DigiCert you are actually buying the most up to date TLS certificates with the option of ECC, RSA or DSA encryption.
HTML5 VPN
Traditionally, these remote desktop products require a client app. The canvas element introduced in HTML5 allows a browser to draw and update a desktop with relatively little lag. It can also handle audio. This is referred to as an HTML5 VPN or as a clientless remote desktop gateway (guacamole.apache.org). This solution also uses a protocol called WebSockets, which enables bidirectional messages to be sent between the server and client without requiring the overhead of separate HTTP requests.
Layer 2 tunneling protocol (L2TP)
VPN protocol for tunneling PPP sessions across a variety of network protocols such as IP, Frame Relay, or ATM.
This first version of IKE is optimized to ensure the mutual authentication of two peer hosts, such as in a site-to-site VPN. On its own, it does not provide a simple means for a client user account to authenticate to a remote network directory. Consequently, for remote access VPNs, a combination of IPSec with the Layer 2 Tunneling Protocol (L2TP) VPN protocol is often used.
DNS
The Domain Name System (DNS) is the hierarchical and decentralized naming system used to identify computers, services, and other resources reachable through the Internet or other Internet Protocol (IP) networks. The resource records contained in the DNS associate domain names with other forms of information.
Network access control (NAC)
Agent and agentless
A general term for the collected protocols, policies, and hardware that authenticate and authorize access to a network at the device level.
Agent and agentless
Most NAC solutions use client software called an agent to gather information about the device, such as its antivirus and patch status, presence of prohibited applications, or anything else defined by the health policy.
Out-of-band management
Out-of-Band (OoB) network management is a concept that uses an alternate communication path to manage network infrastructure devices. … This isolation prevents compromised user devices or malicious network traffic from impacting network operations or compromising network infrastructure.
