9: Evaluate Network Security Capabilities

What is a secure baseline?

A documented, standardized set of security configurations that every system of a given type must meet. It defines the minimum acceptable security posture and serves as the reference point for detecting configuration drift.

What are the three phases of secure baseline management?

• Establish — define the configuration standard using benchmarks like CIS or DISA STIGs.

• Deploy — push it consistently via imaging, GPO, or configuration management tools.

• Maintain — monitor for drift, and update the baseline as threats and software change.

What is system hardening?

The process of reducing a system's attack surface by removing unnecessary software, services, and accounts; closing unused ports; applying patches; changing default credentials; and enforcing least privilege.

How do you harden workstations and servers?

Apply patches promptly, install host-based firewalls and EDR/antivirus, disable unneeded services and ports, remove default and unused accounts, enforce least privilege, encrypt disks, and enable logging.

How do you harden switches and routers?

Change default credentials, disable unused physical ports and services (Telnet, HTTP), use SSH and SNMPv3 instead of insecure protocols, apply ACLs, restrict management access to a dedicated network, and keep firmware updated.

How do you harden mobile devices?

Enforce policy through MDM: require screen locks and biometrics, enable full-device encryption and remote wipe, restrict app installs to approved stores, block jailbroken/rooted devices, and require updates.

How do you harden ICS/SCADA systems?

These control physical processes and often cannot be patched or taken offline, so rely on network segmentation, air gaps, strict access control, and passive monitoring rather than aggressive scanning or frequent patching.

What is an RTOS, and how are embedded systems hardened?

A real-time operating system runs tasks under strict timing guarantees for embedded/industrial use. Harden by disabling unused interfaces, using signed firmware updates, segmenting them off the main network, and applying vendor-supplied patches — since general-purpose security tools usually cannot be installed.

How do you harden IoT devices?

Change default credentials immediately, disable UPnP and unused features, place devices on a segmented VLAN, keep firmware updated, and disable unneeded cloud/remote access.

How do you harden cloud infrastructure?

Apply least-privilege IAM roles, enable MFA on all accounts (especially root), encrypt data at rest and in transit, close public access on storage buckets, enable logging/monitoring, and use CSP benchmarks and security posture management tools.

What are a wireless site survey and a heat map?

A site survey physically walks a facility to measure signal strength, interference, and coverage before or after AP installation. A heat map is the visual output — a color-coded overlay of signal coverage used to place APs, eliminate dead zones, and limit signal bleed outside the building.

What is WPA3, and what does it improve over WPA2?

The current Wi-Fi security standard. It replaces WPA2's pre-shared key handshake with SAE, adds forward secrecy, mandates protected management frames, and offers Enhanced Open (opportunistic wireless encryption) for public networks.

What is SAE?

Simultaneous Authentication of Equals — WPA3's handshake, also called Dragonfly. It resists offline dictionary attacks against captured handshakes and provides forward secrecy, fixing WPA2-Personal's biggest weakness.

What is AAA, and what is RADIUS?

AAA is Authentication (who you are), Authorization (what you're allowed to do), and Accounting (logging what you did). RADIUS is the protocol that centralizes AAA, commonly serving as the authentication server behind enterprise Wi-Fi and 802.1X.

What is 802.1X, and what are its three roles?

A port-based network access control standard requiring authentication before network access is granted. Supplicant — the client device. Authenticator — the switch or AP controlling the port. Authentication server — the RADIUS server that validates credentials.

What is EAP?

Extensible Authentication Protocol — an authentication framework, not a single method, used within 802.1X. It defines how credentials are exchanged, with the specific method determined by the EAP variant in use.

What are the major EAP variants?

EAP-TLS — mutual certificate authentication on both client and server; strongest but requires a PKI. PEAP — builds a TLS tunnel using a server-side certificate, then passes username/password inside. EAP-TTLS — similar tunneled approach supporting legacy authentication inside. EAP-FAST — Cisco's method using a Protected Access Credential instead of certificates.

What is network access control (NAC)?

A capability that evaluates devices before granting network access, checking identity and health posture (patch level, AV status, encryption). Failing devices are blocked or quarantined to a remediation VLAN.

What is the difference between agent-based and agentless NAC?

Agent-based NAC installs software on the endpoint for deep, persistent posture checks; agents may be permanent or dissolvable (temporary, run once). Agentless NAC requires no install and is better for BYOD and guests, but provides a shallower health assessment.

What is port security?

A switch feature limiting which devices may connect to a physical port, typically by restricting the number of MAC addresses or binding a port to specific MACs. Violations can shut down or restrict the port, defending against MAC flooding and rogue devices.

What is the difference between an IDS and an IPS?

An IDS detects and alerts on suspicious traffic but does not stop it. An IPS sits inline and can actively block or drop malicious traffic — faster response, but a false positive can disrupt legitimate traffic.

What are signature-based, anomaly-based, and behavior-based detection?

Signature-based matches traffic against known attack patterns — accurate but blind to zero-days. Anomaly-based compares activity to a learned baseline and flags deviations. Behavior-based flags actions matching known malicious behavior. The latter two catch novel attacks but produce more false positives.

What is the difference between inline and passive IDS/IPS placement?

Inline means all traffic flows through the device, so it can block in real time but becomes a potential point of failure or latency. Passive means it receives copied traffic from a SPAN port or network tap — it cannot block, but it cannot disrupt the network either.

What is the difference between a stateless and a stateful firewall?

A stateless firewall evaluates each packet independently against ACLs — fast, but blind to context. A stateful firewall tracks active connections and allows return traffic for sessions it has already permitted, blocking unsolicited inbound packets.

What is a next-generation firewall (NGFW), and what is a UTM?

An NGFW adds deep packet inspection, application awareness, user identity, and integrated IPS/threat intelligence to traditional firewalling. A UTM (unified threat management) is a single appliance bundling firewall, IPS, antivirus, web filtering, and VPN — convenient, but a single point of failure.

What is a web application firewall (WAF)?

A firewall that inspects HTTP/HTTPS traffic to protect a specific web application from attacks like SQL injection and XSS. It operates at Layer 7 and understands application requests, unlike a traditional network firewall.

What is a proxy server, and what is the difference between forward and reverse?

A proxy sits between clients and servers, forwarding requests on their behalf. A forward proxy sits in front of internal users to filter and log outbound traffic. A reverse proxy sits in front of servers to distribute load, terminate TLS, and hide backend infrastructure.

What is a screened subnet?

Formerly called a DMZ — an isolated network segment between the internet and the internal LAN that hosts public-facing services like web and mail servers. If a public server is compromised, the attacker still cannot reach the internal network directly.

What are firewall rules and access control lists, and what is implicit deny?

Rules/ACLs permit or block traffic based on source and destination IP, port, and protocol, evaluated top-down with the first match applied. Implicit deny is the default rule at the bottom: anything not explicitly permitted is blocked.

How are web filters deployed, and what techniques do they use?

Deployed either agent-based (software on each endpoint, protecting devices off-network) or as a centralized proxy (all traffic routed through one gateway). Techniques include URL scanning, content categorization, block rules, and reputation-based filtering of known-malicious domains.