3.2 Secure Infrastructures

Question 1

Device Placement

Answer 1

Every network is different– There are often similarities
* Firewalls– Separate trusted from untrusted– Provide additional security checks
* Other services may require their own security technologies– Honeypots, jump server, load balancers, sensors

Question 2

Security Zones

Answer 2

Zone-based security technologies– More flexible (and secure) than IP address ranges
* Each area of the network is associated with a zone– Trusted, untrusted– Internal, external– Inside, Internet, Servers, Databases, Screened
* This simplifies security policies– Trusted to Untrusted– Untrusted to Screened– Untrusted to Trusted

Question 3

Attack surface

Answer 3

• How many ways into your home?– Doors, windows, basements
• Everything can be a vulnerability– Application code– Open ports
• Authentication process– Human error
• Minimize the surface– Audit the code– Block ports on the firewall– Monitor network traffic in real-time

Question 4

Connectivity

Answer 4

• Everything contributes to security– Including the network connection
• Secure network cabling– Protect the physical drops
• Application-level encryption– The hard work has already been done
• Network-level encryption– IPsec tunnels, VPN connections

Question 5

Security zones (see example in notes)