Study notes covering Network Architecture.
{.is-info}
Security Zones — Portions of a network or system that have specific security concerns or requirements. They are used to isolate resources and apply different levels of protection based on risk and purpose.

Screened Subnets

Screened Subnet (DMZ) — Also known as a perimeter network or demilitarized zone, a screened subnet provides an additional layer of protection between an organization’s internal network and the internet.

Firewalls

Firewall — A network security device or software application designed to monitor, filter, and control incoming and outgoing traffic based on predetermined security rules.

Firewall Rules:
Lists of allow/deny statements used to enforce security policies, ensuring only authorized traffic passes through.

Virtual Private Networks (VPNs)

• Provide an alternative to:
  • WAN connections
  • Connections using telephone lines and a remote access server
• VPNs use tunneling protocols that encrypt packets, routing them securely through the internet:
  • Packets include headers with routing information.
  • Encryption is removed upon reaching the destination.
  • Only the destination device can decrypt and read the original packet.

VPN Tunnel Types

• Full Tunnel — Routes all user traffic through the VPN.
• Split Tunnel — Routes only specific traffic (e.g., to certain IPs or domains).

VPN Connection Types

Tunnel Endpoints: Devices that encrypt and decrypt VPN traffic (e.g., routers, firewalls, or dedicated VPN servers).
Purpose: Secures communications over untrusted networks, such as public Wi-Fi.

Network Access Control (NAC)

Network Access Control (NAC) — Authenticates users and devices before granting access and monitors traffic to ensure compliance with security policies.

• NAC enforces security using agent-based or agentless methods:
  • Agent-Based: Uses a locally installed agent to evaluate endpoint compliance.
  • Agentless: Uses network-based scans or 802.1X to assess connected devices.

Switch Security

Spanning Tree Protocol (STP)

Provides fault tolerance and prevents network loops by identifying redundant paths between switches.

• Automatically recovers from topology changes or device failures.
• Identifies the optimal, loop-free path between network devices.
• Uses the following port roles and states:

Port Roles

• Root Port: Connects directly to the root switch.
• Designated Port: Forwards frames to and from attached hosts.
• Blocked Port: Prevents loops by not forwarding traffic (used for redundancy).

Port States

• Blocked
• Listening
• Learning
• Forwarding
• Disabled

Securing Routers

Enterprise Network Architecture

Core Components

• Media — Physical transmission medium such as copper, fiber, or wireless.
• Devices — Routers, switches, firewalls, and endpoints.
• Protocols and Services — Define communication and management.
• Data Assets — Information and databases requiring protection.

Policy-Based Controls

• Define how traffic flows and who can access which resources.
• Help mitigate vulnerabilities by enforcing segmentation and least privilege.

OSI Model Overview

Architecture Considerations

• Cost
• Compute Resources
• Scalability and Ease of Deployment
• Resilience and Redundancy
• Power and Energy Efficiency
• Patch Availability
• Risk Transference

Network Security Principles

• Enforce segmentation to limit lateral movement.
• Apply access controls to restrict unauthorized connections.
• Continuously monitor for policy violations or suspicious activity.

Defense in Depth

A layered security strategy that uses multiple controls to protect systems.

• Endpoint Protection
• Firewalls
• Antivirus Software
• Intrusion Detection and Prevention Systems
• Data Loss Prevention (DLP) Tools