Lesson 8: Implementing a Secure Network Architecture Flashcards
network architecture weaknesses
- single points of failure—a “pinch point” relying on a single hardware server or appliance or network channel
- complex dependencies—services that require many different systems to be available. Ideally, the failure of individual systems or services should not affect the overall performance of other network services
- lack of documentation and change control—network segments, appliances, and services might be added without proper change control procedures, leading to a lack of visibility into how the network is constituted
- overdependence on perimeter security—if the network architecture is “flat” (that is, if any host can contact any other host), penetrating the network edge gives the attacker freedom of movement
Cisco’s SAFE architecture
- good starting point for understanding the complex topic of network architecture design
SAFE’s Places In the Network (PIN)
represents types of network locations, including campus networks, branch offices, data centers, and the cloud
email workflow
- access–the client device must access the network, obtaining a physical channel and logical address (must be authenticated and authorized)
- email mailbox server–ensure that mailbox is only accessed by authorized clients and that it is fully available and fault tolerant
- mail transfer server–must connect with untrusted Internet hosts, so communications between untrusted network and trusted LAN must be carefully controlled
segment
- one where all the hosts attached to the segment can communicate freely with one another
segregation
hosts in one segment are restricted in the way they communicate with hosts in other segments
Ethernet network
network segments can be established physically by connecting all hosts in one segment to one switch and all the hosts in one segment to one switch and all the hosts in another segment to another switch
- the two switches can be connected by a router and router can enforce network policies or Access Control Lists (ACL) to restrict communications between two segments
- because enterprise networks typically feature hundreds of switching appliances and network ports (not to mention wireless access and remote access), segmentation is more likely to be enforced using virtual LANs (VLANs)
isolated segment
one that has no connectivity with other segments
air gapped
host or network segment that has no sort of physical connectivity with other hosts or networks is referred to as air gapped
virtualization
- segregation and isolation of hosts or applications can also be accomplished using virtualization
- when a host is running as a guest OS on a hypervisor, connectivity with or isolation from other networks can be completely controlled via the hypervisor
topology
- description of how a computer network is physically or logically organized
- essential to map the network topology when designing a computer network an to update the map when any changes or additions are made to it
zone
- main building of a security topology
- area of network where the security configuration is the same for all hosts within it
- should be segregated from one another by physical and/or logical segmentation, using VLANs, subnets, and possibly virtualization
firewall
- software or hardware that filters traffic passing into and out of a network segment
- bases its decisions on a set of rules called an access control list (ACL)
private network (intranet)
network of trusted hosts owned and controlled by organization
extranet
network of semi-trusted hosts, typically representing business partners, suppliers, or customers (hosts must authenticate to join extranet)
internet/guest
zone permitting anonymous access (or perhaps a mix of anonymous and authenticated access) by untrusted hosts over the Internet
Internet-facing
an Internet-facing host accepts inbound connections from and makes connections to hosts on the Internet
Demilitarized Zones (DMZs)
- Internet-facing host are placed in one or more Demilitarized Zones (DMZs)
- DMZ referred to as a perimeter network
- traffic cannot pass through it
- enables external clients to access data on private systems, such as web servers, without compromising the security of the internal network as a whole
- if communication is required between hosts on either side of a DMZ, a host within DMZ acts a proxy
- to configure a DMZ, two different security configurations must be enabled: one on the external interface
- DMZ and intranet are on different subnets, so communications between them need to be routed
- DMZ can also be established using a single router/firewall appliance
bastion hosts
- hosts in a DMZ are not fully trusted by the internal network, because of the possibility that they could be compromised from the Internet
- bastion host would not be configured with any services that run on the local network, such as user authentication
differences between services designed to be accessible to a public Internet versus those for an extranet
- dedicated DMZ for employee web browsing and proxy services
- DMZ for email, VoIP, and conferencing servers
- isolate remote access/Virtual Private Network (VPN) traffic
- isolate traffic for authorized cloud applications
- multi-tier DMZ to isolate front-end, middleware, and backend servers
- multi-tier DMZ to isolate front-end, middleware, and backend servers
subnet
- subdivision of larger network, isolated from the rest of the network by means of routers (or layer 3 switches)
- useful for security, as traffic passing between each subnet can be subjected to filtering and access control at the router
- important use of subnets is to implement a DMZ
three-legged firewall (or triple-homed)
- one with three network ports, each directing traffic to a separate subnet
screened host
- Internet access can still be implemented using a dual-homed proxy/gateway server acting as a screened host
zone types
- guest–zone that allows untrusted or semi-trusted hosts on local network
- wireless–traffic from WiFi networks might be less trusted than from the cabled network
- honeynet–network containing honeypot hots, designed to attract and study malicious activity
Cisco’s campus network hierarchy
- access–allowing end-user devices, such as computers, printers, and smartphones to connect to the network
- distribution–provides fault-tolerant interconnections between different access blocks and either the core or other distribution blocks
- core–provides a highly available network backbone, such as clients and server computers should not be attached directly to the core
layer 2 Ethernet switches
basic Ethernet switch might also be referred to as a LAN switch, data switch, or workgroup switch
- there are unmanaged and managed types
