Chapter 12 - Network Security Flashcards
Defense-in-Depth
Defense-in-Depth, is a security concept stating that multiple security controls ensure that a failure in a single control or sometimes even multiple controls, is unlikely to cause a security breach.
Attack Surface
An organization or device’s Attack Surface consists of the points at which an unauthorized user could gain access.
Security Zone
Security Zones are network segments, physical or virtual network segments, or other components of an infrastructure that are able to be separate from less secure zones through logical or physical means.
Failure Modes
Failure Modes refer to the state in which a device will be once it fails. A fail-open device will allow traffic to continue passing through upon failure while a fail-closed device will no longer allow traffic to pass through after failing.
Reputation
Reputation describes services and data feeds that track IP addresses, domains, and hosts that engage in malicious activity.
Software-Defined Networking (SDN)
Software-Defined Networking uses software-based network configuration to control networks. SDN designs rely on controllers that manage network devices and configurations, centrally managing the Software-Defined Network. This allows networks to be dynamically tuned based on performance metrics and other configuration settings, and to be customized as needed in a flexible way.
Software-Defined Wide Area Network (SD-WAN)
A Software-Defined Wide Area Network is a virtual wide area network design that can combine multiple connectivity services for organizations. SD-WAN is commonly used with technologies like Multiprotocol Label Switching (MPLS), 4G and 5G, and broadband networks. SD-WAN can help by providing high availability and allowing for networks to route traffic based on application requirements while controlling costs by using less expensive connection methods when possible.
Secure Access Service Edge (SASE)
Secure Access Service Edge combines virtual private networks, SD-WAN, and cloud-based security tools like firewalls, cloud access security brokers (CASBs), and zero-trust networks to provide secure access for devices regardless of their location.
Screened Subnet/DMZ
Screened Subnets are network zones that contain systems that are exposed to less trusted areas (often the Internet).
In a Zero-Trust network, what are the four components of the Control Plane?
- Adaptive Identity (leverage context-bases authentication that considers data points such as where the user is logging in from or what device they are logging in from)
- Threat Scope Reduction (limits the scope of what a subject can do or what access is permitted to a resource limits what can go wrong if an issue does occur)
- Policy-Driven Access Control (policy engines rely on policies as they make decisions that are then enforced by the policy administrator and policy enforcement points)
- Policy Administrator (executes decisions made by a policy engine)
In a Zero-Trust network, what are the four components of the Data Plane?
- Implicit Trust Zones (allow use and movement once a subject is authenticated by a zero trust policy engine)
- Subjects and Systems (devices and users that are seeking access)
- Policy Enforcement Points
Network Access Control (NAC)
Network Access Control technologies focus on determining whether a system or device should be allowed to connect to a network. If it passes the requirements set for admission, NAC places it into an appropriate zone. NAC can use a software agent that is installed on the computer to perform these security checks or it can be agentless and run from a browser or by another means without installing software locally.
Port Security
Port Security is a capability that allows you to limit the number of MAC addresses that can be used on a single port. This prevents problems such as MAC address spoofing, content-addressable memory (CAM) table overflows, and in some cases, plugging in additional devices to extend the network.
IPSec VPN
IPSec VPNs operate at layer 3, require a client, and can operate in either tunnel mode or transport mode. In tunnel mode, entire packets of data sent to the other end of the VPN connection are protected. In transport mode, the IP header is not protected but the IP payload is.
SSL VPN
SSL VPNs (although they actually use TLS) can either use a portal-based approach, where users access it via a web page and then access services through that connection, or they can offer a tunnel mode like IPSec VPNs. SSL VPNs can be used without a client installed.
Full-Tunnel VPN
Full-Tunnel VPNs send all network traffic through the VPN tunnel, keeping it secure as it goes to the remote trusted network.
Split-Tunnel VPN
Split-Tunnel VPNs only send traffic intended for systems on the remote trusted network through the VPN tunnel.
Jump Server
Jump Servers are secure and monitored systems used to provide administrators with a way to securely operate in security zones of differing security levels. These servers are typically configured with the tools required for administrative work and is frequently accessed with SSH, RDP, or other remote desktop methods.
Load Balancer
Load Balancers are used to distribute traffic to multiple systems, provide redundancy, and allow for ease of upgrades and patching. Load Balancers typically present a virtual IP (VIP), which clients send service requests to on a service port. The Load Balancer then distributes those requests to servers in a pool or group.
Proxy Server
Proxy Servers accept and forward requests, centralizing the requests and allowing actions to be taken on the requests and responses. They can filter or modify traffic and cache data, and since they centralize requests, they can be used to support access restrictions by IP address or similar requirements.
Forward Proxy
Forward Proxies are placed between clients and servers, and they accept requests from clients and send them forward to servers. Since Forward Proxies conceal the original client, they can anonymize traffic or provide access to resources that might be blocked by IP address or geographic location.
Reverse Proxy
Reverse Proxies are placed between servers and clients, and they are used to help with load balancing and caching of content. Clients can thus query a single system but have traffic load spread to multiple systems or sites.
Web Filter
Web Filters, sometimes called content filters, are centralized proxy devices or agent-based tools that allow or block traffic based on content rules. These can be as simple as conducting URL scanning and blocking specific URLs, domains or hosts, or they may be complex, with pattern matching, IP reputation, and other elements built into the filtering rules.
Unified Threat Management (UTM)
Unified Threat Management devices frequently include firewall, IDS/IPS, anti-malware, URL and email filtering and security, data loss prevention, VPN, and security monitoring and analytics capabilities. The line between UTM and NGFW devices can be confusing, and the market continues to narrow the gaps between devices as each side offers additional features. UTM devices are typically used for an “out of box” solution where they can be quickly deployed and used, often for small to mid-sized organizations.
