Difference between revisions of "Network Security Topologies"
m (Text replacement - "<table border="0" cellspacing="0" width="100%">" to "<table border="0" cellspacing="0">") |
m (Text replacement - "<hr> <table border="0" cellspacing="0"> <tr>" to "<!-- Ezoic - BottomOfPage - bottom_of_page --> <div id="ezoic-pub-ad-placeholder-114"></div> <!-- End Ezoic - BottomOfPage - bottom_of_page --> <hr> <table border="0" cellspacing="0"> <tr>") |
||
| Line 57: | Line 57: | ||
<htmlet>securityplus</htmlet> | <htmlet>securityplus</htmlet> | ||
| + | <!-- Ezoic - BottomOfPage - bottom_of_page --> | ||
| + | <div id="ezoic-pub-ad-placeholder-114"></div> | ||
| + | <!-- End Ezoic - BottomOfPage - bottom_of_page --> | ||
<hr> | <hr> | ||
<table border="0" cellspacing="0"> | <table border="0" cellspacing="0"> | ||
Revision as of 19:38, 10 May 2016
| Previous | Table of Contents | Next |
| IT Media Security Basics | Intrusion Detection Systems |
| Purchase and download the full PDF and ePub versions of this Security+ eBook for only $8.99
|
In this chapter of Security+ Essentials the topic of security as it pertains to network topologies will be explored. Topologies are created by dividing networks into security zones providing both a multi-layered defense strategy and different levels of security commensurate with the purpose of each specific zone (for example less security is necessary for a web server than for an internal server containing sensitive customer information).
DMZ
The acronym DMZ originates from the military term Demilitarized Zone which refers to an area declared as a buffer between two sides in a war. In IT security the term DMZ is used to refer to what is essentially a buffer between the internet and the internal network. The DMZ is separated by an outer firewall on the internet facing side of the DMZ and an inner firewall on the internal network side of the DMZ. Any devices placed within the DMZ are accessible from both the internet and the internal network. There is no communication, however, from the internet directly though the DMZ to the internal network.
Any systems placed in the DMZ must be configured to the highest level of security possible (with the caveat that they must still be able to perform the role for which they are intended). These systems should always be considered to be compromised and must never be given direct and unrestricted access to the inner network. Servers typically placed in the DMZ are web, ftp, email and remote access servers.
Internet
Whilst the internet seems like one giant network it is in reality a mesh of interconnected networks held together by routers which control and direct the flow of data from point to point until it reaches its destination.
The internet is completely open and as such there is no way to control what takes place on it. Whilst much of the activity on the internet is harmless it is also a fertile breeding ground for those with malicious intentions. It is for this reason that any computers or networks with access to the internet must be protected by a firewall.
Intranet
An intranet can be described as a mini-internet build within the safety of a secure networking environment. Intranets are typically used to provide internal corporate web sites for employee only access. Because the intranet servers have internal, private IP addresses and reside behind firewalls they are generally not accessible to the outside world. If external access is needed to an intranet this is best achieved through the implementation of a Virtual Private Network (VPN).
Extranet
An extranet is a portion of an intranet which is made accessible to external partners. Access to an extranet is typically controlled by strict levels of authentication and authorization through the use of VPNs, firewalls and security policies.
Virtual Local Area Network (VLAN)
A local area network (LAN) is typically a collection of devices connected to a single switch. A virtual local area network (VLAN) typically involves grouping devices on a single switch into multiple broadcast domains and network segments. This provides a way to limit broadcast traffic on each segment of the network (improving overall performance) and increased security through the deployment of multiple isolated LANs on a single switch. A concept known as trunking can be used to create a VLAN which spans multiple switches. This enables users to be grouped on VLANs based on function rather than by physical location. For example all members of the accounting department can be placed in the same VLAN regardless of the switches to which they are physically connected.
Network Address Translation (NAT)
Network Address Translation (NAT) provides a mechanism for using two sets of IP addresses for internal network devices, one set for internal use and another for external use. NAT was originally developed to address the problem that the supply of available IPv4 IP addresses is beginning to run out.
NAT translation typically takes place at a router or firewall and allows internal networks to assign so-called non-routable or private IP addresses for internal devices whilst using a single IP address for external communication across the internet.
Private IP addresses fall into specific ranges known as classes. Each of the following classes is considered to be non-routable on the internet:
- Class A - 10.0.0.0 - 10.255.255.255. Valid IP addresses are from 10.0.0.1 to 10.255.255.254.
- Class B - 172.16.0.0 - 172.31.255.255. Valid IP addresses are from 172.16.0.1 to 172.31.255.254.
- Class C - 192.168.0.0 - 192.168.255.255. Valid IP address are from 192.168.0.1 to 192.168.255.254
Tunneling
Tunneling involves the packaging of data packets so that they can securely traverse a public network. In essence, the packets for one protocal are encapsulated in the packets of another protocol. An example is the Point-to-Point Tunneling Protocol which encapsulates its own packets into the TCP/IP protocol. Encapsulation is often combined with encryption to increase the level of security.
| Purchase and download the full PDF and ePub versions of this Security+ eBook for only $8.99
|
| Previous | Table of Contents | Next |
| IT Media Security Basics | Intrusion Detection Systems |
