A lot of network security starts with network security design.
We have a very busy diagram here that tries to show some
different network segments and so on, and we can see here a
number of things that we want to look at.
We have, for example, off on the left, an internet access with customers,
remote users, and the Internet of Things trying to get
access. That traffic reaches a firewall.
That firewall provides network segmentation to an
extranet down below where we may have,
for example, a VPN concentrator, a network access controller,
we could have our wireless access points out there, or even
Internet of Things connecting there as well.
At the top, we see that firewall leads to a demilitarized zone,
where we'll often have something like a web server.
The difference between a demilitarized zone and an extranet is that a
demilitarized zone is there for anybody. A customer who wants to come and
access our systems from over the internet would be routed up into the
demilitarized zone where they could then go and take a look at the data on our
website, and that is really open for everybody.
But if I have, for example, an employee who is working
remotely and they want to gain access,
then they'll be directed down into the extranet.
The purpose of this is that the extranet is only there for people that
are trusted or where we have set up some type of additional controls,
much more than in a demilitarized zone.
So that remote user may even have an encrypted communication using,
say, for example, a virtual private network, and that virtual
private network will terminate there in the extranet.
That allows the traffic now to be in clear text to go back
through the firewall towards the internal network.
Now the firewall is able to examine that traffic, because when the
traffic was encrypted, there's a good chance the firewall was very
limited and unable to really see very much. When I deal with the
Internet of Things devices,
maybe we have some types of sensors or controls that are communicating
back to us about water level in a river, for example,
those are using internet connections and those also are being routed
down into an extranet because it is a trusted device.
Now the advantage of the extranet is that it doesn't allow those devices or
those remote users direct access to the internal network.
It's a segment out there, and it allows us to do more analysis and
checking to make sure that traffic is certainly appropriate.
Now, we also see here the use of IDS, intrusion detection systems.
We have one up towards the web server and the demilitarized zone.
We have another one after the firewall into the internal
network, and it is watching the traffic so it can see what
made it through the firewall.
Maybe things got through the firewall that we didn't really want, but we now
have a record of that. Behind that, we have an intrusion prevention system,
IPS. That works together with a firewall so that we have what we would call
defense in depth or layered defense. If some type of malicious traffic did
get through the firewall, hopefully the IPS, being a prevention system,
would be able to stop that, the second layer of then control we have. Then
we have maybe servers and into our internal network, but we also have now
another firewall that separates off other subdomains, and there we can also
have intrusion detection and intrusion prevention systems,
both on hosts and on networks.
We see here that this internal network is then protected behind the firewall,
but it's also segmented from other more internal networks, where we have now
various virtual local area networks coming off of the switch. Each one of those
VLANs would operate as if it's its own independent network. Even though they
are the same physical network,
they would operate as completely different logical segments.
We know that it's important we protect the endpoints on the network.
We deploy concepts like zero trust and firewalls to protect even a laptop,
for example. But we know that one of the problems of the firewall is it can
be a little bit blinded by encrypted traffic.
That's the vulnerability of, of course, using a VPN, or virtual private
network. Our laptops that we connect as part of our endpoints should have
antivirus on them so they're able to pick up if there's some type of
malicious or unwanted traffic. But there, of course, we need to make sure
that those antivirus signatures are kept up to date, so as new malware is
discovered,
the signature is registered so our antivirus system knows to watch for it.
We can also go to other types of network models such as the cloud.
Maybe we use something like a cloud Software as a Service or Platform
as a Service or Infrastructure as a Service.
The difference is that in the case of Software as a Service,
I'm buying a service that is then the application is
managed by the cloud service provider.
Many of us do this if we watch,
say, for example, some type of entertainment shows at home on our television,
we actually subscribe to a service that then loads those
movies or tv shows for us, and that would be a Software as
a Service type of deployment.
But that company that is then selling us the, should we say, streaming
services, quite often they are also a cloud consumer.
They are, for example, using one of the major cloud providers such as,
say, Amazon or Microsoft, and we have, of course, Google as well, as some
of the major ones to host their application.
One of the most common best known streaming services actually is both
a cloud provider themselves and Software as a Service selling us TV
shows, and they are a cloud consumer, and that they are hosting their
data and TV shows on an Amazon cloud, and that is called Platform as
a Service, because they're using the cloud platform to run their
application.
We can also use something known as Infrastructure as a Service, and
Infrastructure as a Service is where we have a cloud service provider
that's providing the basic infrastructure,
power, network, the building, heating, ventilation,
air conditioning, but we are maybe even running our own
equipment in that cloud provider's facility.
And so these are different deployment models that we could look at
depending on what our needs and what suits, say,
for example,
our business model best. One of the things that's helped many companies
is to outsource a lot of their security, going to a managed security
service, because it's hard for us to develop our own trained and
competent staff often in order to make sure that we are able to manage
our security program well ourselves.
So we'll have a contract,
for example, with a third party for certain services being provided.
Do they monitor our networks?
Do they do, in some cases even, we've seen that they
will look after all of our hardware,
our laptops, and so on as well, so when we have equipment,
for example,
we know that that is being managed by someone who probably
gets a better price on it than we do as well.
But it's good to have clear contracts. A memorandum of understanding,
a memorandum of agreement, a service‑level agreement,
all of these help us to make sure that we have clear understanding of what
services are provided and which ones aren't, because we don't want to have a
situation where there is distrust and maybe,
for example,
allegations that one party or the other is not living
up to their side of that agreement.
Using a managed security service provider has a lot of benefits.
They have a team of trained staff that looks after services for many companies,
so therefore, there's economies of scale and very often they have a
level of competence I can't develop with my own staff, so this has
been a real advantage for many organizations.
The Key Points Review. Network security is challenging.
Why? Because networks are always changing,
attacks are always evolving, and experienced staff can be very hard to find.
We know that in the end security is the result of design, not just by chance.