Chapter 12 Network Security

Security Appliances and Controls

• Network appliances include Jump servers, Proxy servers, Intrusion Prevention Systems (IPS), Intrusion Detection Systems (IDS), Load balancers, and Sensors.
• Port security protocols: 802.1X for authentication and Extensible Authentication Protocol (EAP) for secure access.
• Different firewall types: Web Application Firewall (WAF), Unified Threat Management (UTM), Next-Generation Firewall (NGFW), Layer 4 and Layer 7 firewalls.
• Secure communication methods incorporate Virtual Private Networks (VPN), Remote Access, Tunneling with Transport Layer Security (TLS) and Internet Protocol Security (IPSec).
• Software-Defined WAN (SD-WAN) facilitates optimal network routing and cost efficiency by integrating various connection technologies.

Security Operations Techniques

• Hardening techniques for computing resources focus on securing switches and routers.
• Security alerting involves tools such as Simple Network Management Protocol (SNMP) traps for monitoring.
• Modifications to enterprise capabilities include firewall rule adjustments, access control lists, and trends in IDS/IPS signatures.
• Web filtering strategies consist of agent-based solutions, URL scanning, content categorization, and block rules based on domain reputation.
• Email security employs DMARC, DKIM, and SPF to authenticate email sources and prevent spoofing.

Software-Defined Networking (SDN) and SD-WAN

• SDN leverages software for network control, allowing dynamic tuning based on performance metrics.
• Centralized controllers in SDN manage network devices for flexible configurations.
• SD-WAN combines various connectivity services (MPLS, 4G, 5G) to enhance high availability and maintain cost-effectiveness.

Network Segmentation

• VLANs allow different ports on switches to belong to the same broadcast domain, reducing noise.
• Concept of screened subnets (DMZs) for systems exposed to less trusted areas, mainly for web servers.
• Intranets serve internal information purposes, while extranets provide access to external partners or customers.
• Zero Trust architecture assumes no inherent trust, implementing strict internal and external security measures.

DNS Security

• DNSSEC authenticates DNS data, ensuring queries are validated even when not encrypted.
• Configuring DNS servers to prevent zone transfers and enable logging is crucial for DNS security.
• DNS filtering blocks access to malicious domains and redirects users to informational warning pages.

Email Security Protocols

• DKIM allows message content to be verified as originating from the claimed domain.
• SPF helps to verify sender's domain, while DMARC combines both DKIM and SPF for better protection against spoofing.
• Secure protocols for email include POPS and IMAPS, implementing TLS for secure communication.
• S/MIME encrypts email content and attachments, requiring certificate management which adds complexity.
• SMTP is not inherently secure, yet efforts like SMTPS have not gained widespread adoption.

Physical Isolation

• Separates devices with no connection between them
• Commonly referred to as an air-gapped design
• Prevents remote attackers from accessing data between systems

Reputation Services

• Track IP addresses, domains, and hosts involved in malicious activity
• Allow organizations to monitor or block potentially malicious actors and systems
• Often combined with threat feeds and log monitoring

Secure Access Service Edge (SASE)

• Combines VPNs, SD-WAN, and cloud-based security tools
• Provides secure access for devices regardless of their location
• Ensures endpoint and data security, and delivers policy-based security across an organization's infrastructure and services

Subjects, Policy Engines, and Policy Administrators

• Subjects: Users, services, or systems that request access to resources.
• Policy Engines: Determine access based on rules and external systems like threat intelligence, identity management, and SIEM devices. They use a trust algorithm and log decisions.
• Policy Administrators: Components that control access by establishing or removing communication paths between subjects and resources. They create session-specific tokens, deny access, and end sessions.
• Policy Enforcement Points: Communicate with Policy Administrators to forward requests and receive instructions on allowed connections. They are typically deployed as a local client/application and a gateway element.

Zero Trust Planes

• Two key planes:
  • Control Plane: Responsible for policy decision-making and access control.
  • Data Plane: Responsible for enforcing access control decisions and managing trust zones.
• Control Plane Components:
  • Adaptive Identity: Context-based authentication considering location, device, and security requirements. May request additional validation or decline authentication.
  • Threat Scope Reduction: Limits the impact of security breaches by using least privilege and identity-based network segmentation.
  • Policy-driven Access Control: Uses policies enforced by Policy Engines, Policy Administrators, and Policy Enforcement Points.

Data Plane Components

• Implicit Trust Zones: Allow access and movement once a subject is authenticated by a Zero Trust Policy Engine.
• Subjects/Systems: Devices and users seeking access.
• Policy Enforcement Points: Enforce access control decisions based on policies.

Inline Network Devices

• Inline network devices have network traffic pass through them.
• They provide the opportunity to interact with traffic, including modifying or stopping it.
• Inline devices can be a potential point of failure, as they can cause an outage if they stop working.
• Some inline devices are equipped with features that allow them to fail open instead of failing closed.

Taps or Monitors

• Taps copy network traffic for inspection, allowing access to a copy of the traffic without interrupting it.
• Taps don't allow interaction with traffic.
• Taps are used for monitoring, analysis, and security purposes.
• Taps avoid the problem of potential failures causing outages.

Active Taps

• Require power to operate.
• Have physically separate network ports without a direct connection.
• Power outages or software failures can interrupt traffic.

Passive Taps

• Have a direct path between network ports.
• Passive optical taps split light to create copies.
• Copper network passive taps require power but maintain a direct path, meaning power outages won't interrupt traffic.