36. Secure Network Design

IP addresses

What type of addresses uniquely identify systems on a network?

public addresses

What type of IP addresses are assigned by a central network authority and may be used to reach systems located across the internet?

private addresses

What type of IP addresses are available for anyone's use, but may only be used on local networks and will not work across the internet?

ICANN

What group breaks addresses up into blocks and gives them out to regional authorities in different countries for distribution?

The use of private IP address ranges.

One of the major issues with IP addresses is the fact that they are a scarce resource, what is the solution?

The only catch is that they are reserved for use on those private networks and cannot be used for routing traffic across the internet.

What is the only catch when using private IP addresses?

network address translation, or NAT

 Systems that have private IP addresses cannot communicate on the internet using those addresses because those addresses are not routable. What technology is the solution?

Correlate activity on a public IP address back to the true originator. For this reason, most organizations maintain logs of their NAT translations that allow them to determine which device was using a particular public IP address at any given time. 

NAT does introduce new security concerns. It brings the privacy benefit of hiding internal IP addresses from the public internet and limiting direct access to systems, but it also makes it difficult to do what?

Port address translation, or PAT

NAT is a very useful technology, but it's somewhat limited because it requires a public IP address for every system on the network that needs to communicate on the internet. NAT requires a large pool of public IP addresses. Since most organizations have a limited pool of public addresses, they can quickly run into a situation where that pool is exhausted and no new systems can communicate on the internet. What is the solution?

Port address translation, or PAT

What allows multiple systems to share the same public address? Instead of recording translations between IP addresses, it assigns each connection a different port on a public IP address. This way, many different systems can share the same public IP address at any point in time.

Subnetting

What is the term for breaking a large network address space into manageable pieces that adminstrators may assign to smaller subnetworks?

subnet mask

Once you start shifting the dividing line between network and host addresses around, you'll need to tell network devices how you've done that. Identifying the dividing line between network and host addresses is known as the what?

1. Internet Zone

2. Intranet Zone

3. DMZ

Typical network border firewalls have what three network interfaces?

Internet Zone

What network interface connects to the internet or another untrusted network?

Intranet Zone

What network interface connects to the internal network where most of the organization’s systems reside?

DMZ

What is the network interface where you can place systems that must accept connections from the outside world, such as mail and web servers?

zero trust approach

Under this approach, systems do not gain privileges based solely upon their network location.

Extranets

What special purpose network are special intranet segments that are accessible by outside parties?

Honeynets

What are special purpose networks that are decoy networks designed to attract attackers?

Ad hoc networks

What are special purpose networks that spring up whenever someone sets up a wired or wireless network outside of your standard security design?

east-west traffic

Networking professionals often refer to the type of traffic on a network using terms derived from compass directions. Network traffic between systems in a data center is called what?

north-south traffic

Networking professionals often refer to the type of traffic on a network using terms derived from compass directions. Traffic between systems in a data center and systems located on the internet is called what?

an air gapped system

We can use isolation to segregate systems of different security levels into different zones of security, allowing us to reduce the risk that a compromise in a system at a lower security level will impact a system at a higher security level.

This complete physical isolation creates a lot of overhead, but it's also a very robust security control. Because there's no connection to other networks, this is commonly called what?

Jump servers

What is designed to facilitate connecting or jumping between security zones? They live on the border between two networks by having two different network interfaces, one connected to each network.

True

True or False.

Jump servers, jump boxes, and jump hosts are all the same thing. 

In-band management

Physical segmentation can take several forms.

What form involves managing devices through the same network that the devices use for regular traffic?  Jump servers in this setup facilitate the management of these devices from a centralized platform, minimizing the need to physically interact with the device.

Out-of-band management

Physical segmentation can take several forms.

What form uses a dedicated management network or channel that's separate from the network's data channels?  Jump servers configured for this setup allow administrators to manage network devices over this secure dedicated channel, further isolating sensitive management operations from general network traffic. 

Air gap systems

Physical segmentation can take several forms.

What are physically isolated from other networks, and we don't generally use jump servers with these types of systems due to the strict isolation. However, in cases where updates or management must occur, a jump server can be used temporarily with strict protocols in place to ensure that this system is reinstated after the necessary operations are complete.