block 11 part 2 boundary protection Flashcards
boundary protection
Prevent/Detect unauthorized Access
protects base’s “network perimeter”
allows only authorized personnel access to (C&I) through single logical service delivery point (SDP)
what is National Institute of Standards and Technologies (NIST)
- device controls communication at external boundary of system
- key internal boundaries within system.
what should informations systems do?
establish communication path between remote users with firewalls controlling outgoing/incoming network traffic
separate computing systems and network infrastructures
what is a parallel configuration?
wide but shallow
many entrances
(ex. mall)
serial configuration?
very narrow but very deep
ex. bank or airport
single entrance (several gateways or checkpoints)
what does network security policy do?
- controls network traffic, usage, identifies resources, threats
- defines network use, responsibilities, details action plans for when security policy is violated.
when you deploy a network security policy it should
strategically enforced at defensible boundaries within your network.
strategic boundaries=perimeter networks
To establish a collection of perimeter networks
networks of computers and network security mechanisms need to be designated and defined
what are the three types of perimeters present?
-Outermost (Untrusted)
- Internal (DMZ)
- Innermost (Trusted)
what is outermost (untrusted)?
identifies separation point between controlled/uncontrolled assets.
- DOD COM. most insecure/untrusted part of network
what is internal (DMZ)?
- located between the
innermost and outermost networks.
uses intranet firewalls, IAP and filtering routers.
what goes out must come back in
what is innermost (trusted)?
last line of protection from outside intrusion. contains the computers, servers, routers, and switches
- protection on devices (OS firewall or access lists on the routers)
contains more layers of security than other layers
what is POLP?
principle of least privilege =
All accounts will only have access to what they need to conduct day-to-day mission requirements.
why do most orgs prefer a single link to connect to the internet?
Managing/policing Internet connection becomes much easier this way.
firewall system; restrict access to services and systems, and can be a monitoring station, keeping logs of attempts to access services and systems from off-site.
what is the most insecure area of a network infrastructure?
outermost perimeter
this area is reserved for external routers, public Internet servers, such as HTTP, FTP, and Gopher servers.
easiest area to gain access and therefore, it is the most frequently attacked.
