All
right, so whenever you're able to access a web based resource without
authenticating or logging into it properly, you might be using a federated
identity or single sign on type of scenario.
What is network segmentation?
It's chopping up your network for security
and performance concerns, splitting a network into smaller network
segments, separating groups of systems or applications from each other.
The benefits are improved security, better
access control, improved monitoring, maintenance, and so forth.
We can do this both logically and physically.
Physical segmentation, you are physically separating devices with routers
and hubs or switches, which we're probably never going to use a hub these days, so
we'll go switch on that, and you're physically carving up the network.
That's the way it's been done historically.
That's also the more secure approach.
However, we can also do it with logical segmentation using VLANs, which are
anything that's logically configured or implemented is configured with software.
And if it's configured with software, it
can be hacked versus physical, which you have two physically air gap machines,
pretty tough for a packet to jump from one or the other.
If it's software enforced, there's
different types of attacks that may allow that to take place.
Logical segmentation uses VLANs
isolated Logical without considering the physical location of the devices.
You can actually use port groupings and
associations on switches to create virtual land segments.
Network virtualization is the same idea,
but this time everything is done within software.
All right, so it allows you to
configure and layer everything out in software defined networking or in a
hypervisor where you can lay out specific logical subnets.
And you've got the actual physical layer and then the virtual layer, which is again
implemented through VLANs or whatever mechanism you're using.
All right, so a couple of different variants on that.
We're going to see in later chapters.
Software defined networks, software defined networking, and we'll talk a
little bit more about packet switching, cloud, and that thing.
All right, the B astion Host.
The B astion Host is
a computer system designed and configured to protect network resources from attacks.
So it is the system that's accessible from the internet.
And as such, it needs to be hardened and resilient to different network attacks.
Now, you should probably have a individual basket host free service.
A lot of times that's not done.
But you've got a whole united we stand,
united we fall mentality versus a divided we stand, divided we fall.
Imagine that you're running DNS web and mail on the same bastion host.
There's a vulnerability in the mail server
that leads to a compromise of all three services on the host.
So if you ever have a concern with that
thing, you separate everything out into different individual hosts.
Each one configured to provide the minimum service.
So the bastion Host is the single resource that you put out there that everybody can
access in all your public available services.
The need for a bastion Host, it minimizes the chances of penetration by intruders,
creates logs which can be used to identify attack or attempts to attack,
can actually act as a scapegoat, provides an additional level of security.
Now, more likely than not, we're going to
use DMZs with multiple hosts or relay agents.
But positioning the bastion Host,
physical location, it needs to be on a segment separate from everything else.
Since you allow access to the B astion
Host, you're allowing outside world into a network segment.
It shouldn't be sitting side by side with sensitive systems.
The network location typically set on a
DMZ that does not contain or carry sensitive data.
Avoid placing on internal networks.
You should never, ever put your web based
accessible resources inside your security perimeter.
Positioning the bash and nose.
Typically, again, you put them on the DMZ or an external subnet.
You have DMZs and you have extra nets.
The DMZ is a demilitarized zone.
Extra net is typically an isolated subnet that requires some authentication, but
both of these are to provide external access to resources.
The batch nodes can be single homed, which
means it has only one network interface, or multi homed, which means it has two.
And the idea with two interfaces is that
you're separating the two networks, thereby improving security, versus a
single interface which is more likely to be compromised.
Can Internal bastion Host reside inside the internal network of an organization?
It can be single homed or multi homed.
Internal network devices communicate with the internal bastion Host.
The DMZ.
Again, the DMZ is a demilitarized zone.
It's a network segment that you populate all your publicly available resources on
web servers, email servers, dns servers, for example.
Both internal and external networks can connect to the DMZ.
Hosts can connect to external networks,
but they cannot connect to internal networks.
Different ways to create a DMZ.
You can use a single firewall DMZ.
Not a big fan of this one since it's a
single point of compromise or single point of failure.
You have a single firewall multi home or three legged firewall.
Then you have a dual firewall DMZ where
you have a public and an internal and the DMZ sits between the two.
I'll go a little bit on traffic flow.
East to west means traffic inside your security perimeter.
North, south means traffic to and from the internet.
In North, South, for example, you got the client from the
outside world connected to your network, and east, west it's inside the security
perimeter where data is being exchanged between internal hosts.
You should actually secure both using
firewalls, which we're going to talk about.
A zero trust network.
The zero trust model implies that nobody is ever trusted.
Every user trying to access every resource is not trusted by default,
verifies every incoming connection before allowing access to the network.
Follows the principle, trust no one and validate before providing a cloud service.