Cyberstudy
PDF p.119 In progress

Security Zones

Open PDF at p.119 26 flashcards

Summary

PDF p.119

Security zones are created by segmenting network architecture into subnets, allowing for a zone-based security topology. On-premises networks have a clear boundary at the network perimeter, with varying levels of trust and access control within. Zones are defined based on similar access control requirements to ensure confidentiality, integrity, and availability.

In plain words

Supplementary — not from your PDF

A security zone is a group of systems with similar access needs, separated from other zones and controlled at known entry and exit points (usually firewalls or routers). Traffic between zones follows least privilege. For example, guests reach the Internet but not the LAN, and public web servers accept requests but can't start connections into the LAN.

Detailed explanation

PDF p.119
  • Zone-Based Security Topology
    • Network Perimeter: Clear organizational boundary.
    • Public Internet Zone: Hosts outside the perimeter, untrusted.
    • Internal Zones: Different levels of trust and access control.
  • Mapping Internal Security Topology
    • Systems and Data Assets: Identify workflows with similar access control requirements.
    • Database and File Systems
      • Priority: Confidentiality and integrity.
      • Segmentation: Separate different types of data to reduce breach impact.
    • Client Devices
      • Priority: Integrity and availability.
      • Data Storage: Should not store data, lower confidentiality requirement.
    • Public-Facing Application Servers
      • Priority: Integrity and availability.
      • Data Storage: Should not store sensitive data.
      • Trust Level: Not fully trusted.
    • Network Infrastructure Application Servers
      • Priority: High levels of confidentiality, integrity, and availability.
      • Impact: Compromise could have catastrophic impacts.
  • Security Zones Creation
    • Segregation: Physical and/or logical segmentation.
    • Traffic Control: Use security devices (e.g., firewalls) to control traffic between zones.
    • Principle of Least Privilege: Apply traffic policies.
  • Trusted Hosts
    • Administrative Control: Subject to security mechanisms (antivirus, user rights, software updates).
  • Zone Entry and Exit Points
    • Known Points: Authorized access points (e.g., routers).
    • Security Violations: Unauthorized devices (e.g., wireless access points) within zones.
  • Access Control Examples
    • Low Privilege Zone: Hosts (e.g., printers) can accept connections but not initiate requests.
    • Client Devices: Can make authorized requests but not accept new connections.
    • Guest Zone: Access to the Internet, no access to enterprise LAN.
    • Public-Facing Servers: Accept requests from the Internet, cannot initiate requests to LAN or Internet.
    • VLANs within Zones: Additional access rules (e.g., app servers to databases).

Important terms

taken from the text above
Network Perimeter
Clear organizational boundary.
Public Internet Zone
Hosts outside the perimeter, untrusted.
Internal Zones
Different levels of trust and access control.
Systems and Data Assets
Identify workflows with similar access control requirements.
Priority
Confidentiality and integrity.
Segmentation
Separate different types of data to reduce breach impact.
Data Storage
Should not store data, lower confidentiality requirement.
Trust Level
Not fully trusted.
Segregation
Physical and/or logical segmentation.
Traffic Control
Use security devices (e.g., firewalls) to control traffic between zones.
Principle of Least Privilege
Apply traffic policies.
Administrative Control
Subject to security mechanisms (antivirus, user rights, software updates).
Known Points
Authorized access points (e.g., routers).
Security Violations
Unauthorized devices (e.g., wireless access points) within zones.
Low Privilege Zone
Hosts (e.g., printers) can accept connections but not initiate requests.
Client Devices
Can make authorized requests but not accept new connections.
Guest Zone
Access to the Internet, no access to enterprise LAN.
Public-Facing Servers
Accept requests from the Internet, cannot initiate requests to LAN or Internet.
VLANs within Zones
Additional access rules (e.g., app servers to databases).

Examples & real-world scenarios

Supplementary — not from your PDF
  • A guest Wi-Fi zone with Internet-only access.
  • A server zone that clients can query but that can't reach clients.
  • A printer zone that accepts print jobs but never starts connections.

Scenario

Someone plugs an unauthorized wireless access point into the finance zone. It creates an unknown entry point, a security violation that bypasses the zone's controlled borders.

Common mistakes

Supplementary — not from your PDF
  • Putting all internal systems in one trusted zone.
  • Forgetting that public-facing servers should not be fully trusted or hold sensitive data.

Practical skills

Supplementary — not from your PDF
  • Group systems into zones by their CIA priorities.
  • Write simple allow and deny rules between zones.

What I should remember

Key Points PDF p.119
  • Zone-Based Security Topology
    • Network Perimeter: Public Internet zone, internal zones.
    • Internal Zones: Different trust and access control levels.
  • Mapping Internal Security Topology
    • Systems and Data Assets: Similar access control requirements.
    • Database and File Systems: Confidentiality, integrity, segmentation.
    • Client Devices: Integrity, availability, lower confidentiality.
    • Public-Facing Servers: Integrity, availability, not fully trusted.
    • Infrastructure Servers: High confidentiality, integrity, availability.
  • Security Zones Creation
    • Segregation: Physical/logical.
    • Traffic Control: Security devices, least privilege.
  • Trusted Hosts
    • Administrative Control: Security mechanisms.
  • Zone Entry and Exit Points
    • Authorized Points: Known entry/exit.
    • Security Violations: Unauthorized devices.
  • Access Control Examples
    • Low Privilege Zone: Accept connections, not initiate.
    • Client Devices: Authorized requests, no new connections.
    • Guest Zone: Internet access, no LAN access.
    • Public-Facing Servers: Accept requests, no initiation.
    • VLANs within Zones: Additional rules.