Cyberstudy
PDF p.128 In progress

Device Placement

Open PDF at p.128 18 flashcards

Summary

PDF p.128

Effective control selection for network infrastructure involves choosing the type and placement of security appliances and software to enforce segmentation, apply access controls, and monitor traffic for policy violations. This is guided by the principle of defense in depth, which includes preventive, detective, and corrective controls at each OSI model layer.

In plain words

Supplementary — not from your PDF

Where you put a security device decides what it can protect. Preventive controls such as firewalls sit at zone borders. Detective controls such as IDS sensors sit inside the perimeter, watching internal traffic. Corrective controls such as load balancers sit in the traffic path to fix problems like overload. Endpoint protection adds another layer on each host.

Detailed explanation

PDF p.128
  • Defense in Depth
    • Principle: Security-critical zones are protected by diverse controls at each OSI model layer.
    • Device Placement: Ensures defense in depth through strategic placement within the network topology.
  • Types of Controls
    • Preventive Controls
      • Placement: At the border of a network segment or zone.
      • Examples: Firewalls to enforce security policies, load balancers for high availability.
    • Detective Controls
      • Placement: Within the perimeter to monitor internal traffic.
      • Examples: Intrusion detection systems (IDS) to alert on malicious traffic.
    • Corrective Controls
      • Placement: Within the traffic to correct detected errors or irregularities.
      • Examples: Load balancers to mitigate denial of service attacks.
  • Endpoint Protection
    • Additional Layer: Preventive, detective, and corrective controls installed on hosts.
    • Examples: Host firewalls, anti-virus, intrusion detection, data loss prevention.
  • Illustration of Control Placement
    • Network Border
      • Preventive Control: Firewall enforcing ingress and egress traffic rules.
    • Inline Sensor
      • Detective Control: Relays traffic to IDS to identify malicious traffic.
    • Internal Routers
      • Access Control Lists: Enforce rules for traffic between internal zones and hosts.
    • Public-Facing Servers
      • Corrective Control: Load balancer mediates incoming traffic, mitigates denial of service attacks.
    • Mirrored Switch Ports
      • Sensors: Enable intrusion detection for sensitive hosts or zones.
    • Hosts
      • Endpoint Protection Software: Applies preventive, detective, and corrective controls.

Important terms

taken from the text above
Principle
Security-critical zones are protected by diverse controls at each OSI model layer.
Device Placement
Ensures defense in depth through strategic placement within the network topology.
Placement
At the border of a network segment or zone.
Additional Layer
Preventive, detective, and corrective controls installed on hosts.
Preventive Control
Firewall enforcing ingress and egress traffic rules.
Detective Control
Relays traffic to IDS to identify malicious traffic.
Access Control Lists
Enforce rules for traffic between internal zones and hosts.
Corrective Control
Load balancer mediates incoming traffic, mitigates denial of service attacks.
Sensors
Enable intrusion detection for sensitive hosts or zones.
Endpoint Protection Software
Applies preventive, detective, and corrective controls.
IDS Intrusion detection systems

Examples & real-world scenarios

Supplementary — not from your PDF
  • An edge firewall enforcing inbound and outbound rules.
  • An IDS sensor on a mirrored switch port near sensitive servers.
  • A load balancer in front of public web servers to absorb traffic spikes.

Scenario

A company has only an edge firewall. Adding an internal IDS sensor and host firewalls gives detective and endpoint layers, so an internal compromise is more likely to be seen.

Common mistakes

Supplementary — not from your PDF
  • Putting every control at the perimeter.
  • Thinking an IDS prevents attacks. It's a detective control.

Practical skills

Supplementary — not from your PDF
  • Place preventive, detective and corrective controls on a network diagram.

What I should remember

Key Points PDF p.128
  • Defense in Depth
    • Principle: Diverse controls at each OSI model layer.
    • Device Placement: Strategic within network topology.
  • Types of Controls
    • Preventive: Firewalls, load balancers.
    • Detective: Intrusion detection systems.
    • Corrective: Load balancers for attack mitigation.
  • Endpoint Protection
    • Additional Layer: Host firewalls, anti-virus, IDS, data loss prevention.
  • Illustration of Control Placement
    • Network Border: Firewall.
    • Inline Sensor: IDS.
    • Internal Routers: Access control lists.
    • Public-Facing Servers: Load balancer.
    • Mirrored Switch Ports: Intrusion detection sensors.
    • Hosts: Endpoint protection software.