Security Zones
Summary
PDF p.119Security zones are created by segmenting network architecture into subnets, allowing for a zone-based security topology. On-premises networks have a clear boundary at the network perimeter, with varying levels of trust and access control within. Zones are defined based on similar access control requirements to ensure confidentiality, integrity, and availability.
In plain words
Supplementary — not from your PDFA security zone is a group of systems with similar access needs, separated from other zones and controlled at known entry and exit points (usually firewalls or routers). Traffic between zones follows least privilege. For example, guests reach the Internet but not the LAN, and public web servers accept requests but can't start connections into the LAN.
Detailed explanation
PDF p.119-
Zone-Based Security Topology
- Network Perimeter: Clear organizational boundary.
- Public Internet Zone: Hosts outside the perimeter, untrusted.
- Internal Zones: Different levels of trust and access control.
-
Mapping Internal Security Topology
- Systems and Data Assets: Identify workflows with similar access control requirements.
-
Database and File Systems
- Priority: Confidentiality and integrity.
- Segmentation: Separate different types of data to reduce breach impact.
-
Client Devices
- Priority: Integrity and availability.
- Data Storage: Should not store data, lower confidentiality requirement.
-
Public-Facing Application Servers
- Priority: Integrity and availability.
- Data Storage: Should not store sensitive data.
- Trust Level: Not fully trusted.
-
Network Infrastructure Application Servers
- Priority: High levels of confidentiality, integrity, and availability.
- Impact: Compromise could have catastrophic impacts.
-
Security Zones Creation
- Segregation: Physical and/or logical segmentation.
- Traffic Control: Use security devices (e.g., firewalls) to control traffic between zones.
- Principle of Least Privilege: Apply traffic policies.
-
Trusted Hosts
- Administrative Control: Subject to security mechanisms (antivirus, user rights, software updates).
-
Zone Entry and Exit Points
- Known Points: Authorized access points (e.g., routers).
- Security Violations: Unauthorized devices (e.g., wireless access points) within zones.
-
Access Control Examples
- Low Privilege Zone: Hosts (e.g., printers) can accept connections but not initiate requests.
- Client Devices: Can make authorized requests but not accept new connections.
- Guest Zone: Access to the Internet, no access to enterprise LAN.
- Public-Facing Servers: Accept requests from the Internet, cannot initiate requests to LAN or Internet.
- VLANs within Zones: Additional access rules (e.g., app servers to databases).
Important terms
taken from the text above- Network Perimeter
- Clear organizational boundary.
- Public Internet Zone
- Hosts outside the perimeter, untrusted.
- Internal Zones
- Different levels of trust and access control.
- Systems and Data Assets
- Identify workflows with similar access control requirements.
- Priority
- Confidentiality and integrity.
- Segmentation
- Separate different types of data to reduce breach impact.
- Data Storage
- Should not store data, lower confidentiality requirement.
- Trust Level
- Not fully trusted.
- Segregation
- Physical and/or logical segmentation.
- Traffic Control
- Use security devices (e.g., firewalls) to control traffic between zones.
- Principle of Least Privilege
- Apply traffic policies.
- Administrative Control
- Subject to security mechanisms (antivirus, user rights, software updates).
- Known Points
- Authorized access points (e.g., routers).
- Security Violations
- Unauthorized devices (e.g., wireless access points) within zones.
- Low Privilege Zone
- Hosts (e.g., printers) can accept connections but not initiate requests.
- Client Devices
- Can make authorized requests but not accept new connections.
- Guest Zone
- Access to the Internet, no access to enterprise LAN.
- Public-Facing Servers
- Accept requests from the Internet, cannot initiate requests to LAN or Internet.
- VLANs within Zones
- Additional access rules (e.g., app servers to databases).
Examples & real-world scenarios
Supplementary — not from your PDF- A guest Wi-Fi zone with Internet-only access.
- A server zone that clients can query but that can't reach clients.
- A printer zone that accepts print jobs but never starts connections.
Scenario
Someone plugs an unauthorized wireless access point into the finance zone. It creates an unknown entry point, a security violation that bypasses the zone's controlled borders.
Common mistakes
Supplementary — not from your PDF- Putting all internal systems in one trusted zone.
- Forgetting that public-facing servers should not be fully trusted or hold sensitive data.
Practical skills
Supplementary — not from your PDF- Group systems into zones by their CIA priorities.
- Write simple allow and deny rules between zones.
What I should remember
Key Points PDF p.119-
Zone-Based Security Topology
- Network Perimeter: Public Internet zone, internal zones.
- Internal Zones: Different trust and access control levels.
-
Mapping Internal Security Topology
- Systems and Data Assets: Similar access control requirements.
- Database and File Systems: Confidentiality, integrity, segmentation.
- Client Devices: Integrity, availability, lower confidentiality.
- Public-Facing Servers: Integrity, availability, not fully trusted.
- Infrastructure Servers: High confidentiality, integrity, availability.
-
Security Zones Creation
- Segregation: Physical/logical.
- Traffic Control: Security devices, least privilege.
-
Trusted Hosts
- Administrative Control: Security mechanisms.
-
Zone Entry and Exit Points
- Authorized Points: Known entry/exit.
- Security Violations: Unauthorized devices.
-
Access Control Examples
- Low Privilege Zone: Accept connections, not initiate.
- Client Devices: Authorized requests, no new connections.
- Guest Zone: Internet access, no LAN access.
- Public-Facing Servers: Accept requests, no initiation.
- VLANs within Zones: Additional rules.