Section 17: Enhance Security

Firewall Rules

are specific configurations that control how the firewall operates. These determine which traffic is allowed or denied.

Access Lists

are a series of commands applied to a firewall which selectively filter traffic based on the source and destination, protocols, and ports.

Ports and Protocols must be secured by firewalls

True

Screened Subnets

is a physical or logical subnetwork that contains and exposes an org’s external facing services to an untrusted network, usually the internet.

Don’t put publicly accessible servers in the actual LAN itself.

True

Agent-based Web Filtering

involves installing software agents on individual user devices. They enforce web access policies set by the org regardless of the network the device is connected to.

Use Case for Agent-based Web Filtering

useful for managing web access of remote employees.

Centralized Proxy

often part of a larger network security appliance, acts as an intermediary between users and the internet. It offers centralized management and control.

URL Scanning

Involves examining URLs requested by users to determine if should be allowed or blocked. Fundamental component of most web filtering solutions.

Content Categorization

classifying web pages into different categories.

Block Rules

are specific criteria set to block access to certain websites or content. Orgs can customize to align with security policies and compliance.

Reputation-based Filtering

filtering uses the reputation score of websites to determine whether they should be allowed or blocked. Effective against newly created malicious sites who may not have been categorized or have known URL pattern,

Group Policy

a feature in Windows OS that allows admins to control the working environment of user accounts and computer accounts. It provides centralized management and config OS.

Group Policy can enforce the following policies:

password policies, lockout policies, and audit policies. As well as configure users rights, security options, and control access to files, folders, and registry keys.

Group Policy

is how we maintain the security settings on windows machine,

SELinux

security module in Linux Systems provides a mechanism for supporting access control security policies. It enforces MAC that admins define to control access to all processes and files.

HTTP is not secure. HTTPS encrypts data between client and server.

True

For remote admin use this over Telnet

SSH

TLS for email

Protocols like SMTP, IMAP, and POP3 should be secured with Transport Layer Security (TLS) to protect email communications.

Secure File Transfer

Instead of FTP use SFTP (SSH File Transfer Protocol) or FTPS (FTP Secure)

For email use ports like

587 (SMTP with STARTTLS), 993 (IMAP over SSL), and 996 (POP3 over SSL)

Transport Method

Refers to how data is encapsulated and transmitted over the network. Its important to ensure that the data remains secure during transit.

DNS filtering

is a network security technique used to block access to malicious websites and content that is inappropriate or non-compliant with company policies. It involves using the Domian Name System to control web traffic based on domain names.