-: In this lesson, we're going to focus 2 2
on three main types of network architectures, 3 3
physical networks, virtual private networks, 4 4
and software-defined networks. 5 5
When we talk about physical networks, 6 6
we're referring to the cabling, switch ports, router ports, 7 7
and wireless access points 8 8
that supply cabled and wireless network access 9 9
and connectivity to our organizations. 10 10
This is what you traditionally think of 11 11
when you think of a network. 12 12
It includes all the physical infrastructure, 13 13
such as the switches and wireless access points, 14 14
as well as all the cabling involved in a network. 15 15
When you're dealing with physical networks 16 16
one of the main concerns 17 17
is somebody break into your network 18 18
and intercepting your communications. 19 19
For example, 20 20
if somebody can access one of your network switches, 21 21
they can actually set up port monitoring on that switch 22 22
and be able to see all the network traffic 23 23
that's going across that network switch. 24 24
To prevent this, you need to ensure 25 25
there are proper physical security controls in place 26 26
such as doors and walls, cameras, guards, and fences. 27 27
This will help keep people from accessing the network 28 28
and the communication closets, 29 29
and helps to keep your physical network architecture secure. 30 30
For example, an attacker can use a device 31 31
like a Wi-Fi pineapple 32 32
that can easily be used to penetrate your network 33 33
by connecting it to an open switch port 34 34
on your network switch 35 35
and then this will provide the attacker full access 36 36
to your entire network over a wireless connection. 37 37
This essentially expands your organization's wired network 38 38
into the wireless domain, 39 39
and then the attacker could then access your network 40 40
from outside of your building, such as from the parking lot, 41 41
if they can access that wireless signal from that distance. 42 42
The next area we need to discuss 43 43
is known as VPNs or virtual private networks. 44 44
These are essentially secure tunnels 45 45
that are created between two endpoints 46 46
that are connected over an unsecure network, 47 47
and most commonly this is done over the internet. 48 48
This would allow a user to extend their corporate network 49 49
to a remote location such as a hotel room 50 50
or some kind of remote office. 51 51
When somebody connects over a VPN, 52 52
that user is going to be able to extend the corporate network 53 53
from the headquarters into whatever room 54 54
they're actually accessing that VPN from, 55 55
including a hotel room or their home office. 56 56
This creates a secure and encrypted tunnel over the internet 57 57
from that user's endpoint, like a laptop or desktop, 58 58
all the way back to your organization's network. 59 59
Whenever you're using a VPN, 60 60
it's important to always use authentication 61 61
and authorization mechanisms to control your access. 62 62
as a cybersecurity analyst, 63 63
this is an important area to monitor 64 64
to ensure that your access to the network 65 65
is tightly controlled as well, 66 66
to help protect your network from attacks 67 67
over a VPN-based connection. 68 68
Now, one of the things that we have to worry about 69 69
when we're dealing with a VPN 70 70
is that we're actually tunneling our connection 71 71
over the internet, which is considered an unsecure network, 72 72
into our corporate private network. 73 73
Now, when we do this, 74 74
what do you think the vulnerability is here? 75 75
If you're thinking it's the internet? 76 76
Well, it's actually not that big of a vulnerability for us 77 77
because we are using end-to-end encryption 78 78
between our device and our organization's network. 79 79
Instead, the real vulnerability that I worry about 80 80
as a cybersecurity analyst when I'm dealing with a VPN 81 81
is that the remote computer being used by that end user 82 82
is in some kind of unsecure place. 83 83
This is because what we've done 84 84
is we've now extended the physical boundary of our network 85 85
from our corporate presence across the internet 86 86
to some other location like a hotel room. 87 87
So if I'm sitting in a hotel room 88 88
all the way across the country 89 89
and I'm accessing my corporate network over a VPN, 90 90
I'm actually extending that corporate network 91 91
into the hotel room. 92 92
Now, everything that I'm doing from my computer 93 93
all the way back to the servers are going to be secure 94 94
because I'm going through this encrypted 95 95
and secure VPN tunnel. 96 96
But the real vulnerability here 97 97
is that I'm still sitting in a hotel room, 98 98
and if I take the information from the corporate network 99 99
and I'm reading it in an unsecured place like a hotel room, 100 100
or maybe a coffee shop or something like that, 101 101
there's a good chance 102 102
that somebody could see what I'm doing. 103 103
So if I'm sitting in the coffee shop 104 104
or I'm in the lobby of the hotel, 105 105
or even in my room in the hotel, 106 106
how do I know somebody's not looking over my shoulder 107 107
and looking at the information on my laptop? 108 108
This is really the big concern here. 109 109
Now, as far as your corporate network is concerned, 110 110
my laptop is now part of the corporate network. 111 111
It's just as if I'm sitting there inside of my office. 112 112
So I'm authorized to see all that information. 113 113
But anybody else who's sitting in the room 114 114
that might be looking over my shoulder at my laptop, 115 115
they aren't. 116 116
And so this is one of the big areas that I worry about 117 117
as a cybersecurity analyst 118 118
when I'm using VPNs in an organization. 119 119
VPNs are a great thing. 120 120
They give us a lot of remote capability. 121 121
But they are dangerous for us 122 122
because we are now extending our corporate network 123 123
and all the information it contains 124 124
outside of our corporate building 125 125
into some area outside of our physical boundaries. 126 126
The next thing we're going to talk about 127 127
is software-defined networks or SDN. 128 128
Now, software-defined networks 129 129
and software-defined networking 130 130
is a technology that uses APIs and compatible hardware 131 131
to create programmable network appliances and systems 132 132
that allow us to virtualize our physical networks. 133 133
SDNs can create complex networks with expanded sizes, 134 134
scope, and the ability to rapidly change themself. 135 135
One of the best things about software-defined networks 136 136
is that they can automatically be changed by the network 137 137
using automation technologies and orchestration 138 138
instead of having humans having to do it. 139 139
But this rapid change can be really difficult for us 140 140
as system administrators, cybersecurity analysts, 141 141
and humans to keep up with. 142 142
If you're dealing with SDNs, 143 143
there are really three planes that you need to consider 144 144
when you're thinking about how to secure them. 145 145
This is the control plane, the data plane, 146 146
and the management plane. 147 147
The first plane we have is known as the control plane. 148 148
The control plane makes decisions 149 149
about how traffic should be prioritized, 150 150
secured, and routed. 151 151
Basically, the control plane 152 152
is focused on how traffic is moving across the network. 153 153
The second plane is known as the data plane. 154 154
The data plane handles the actual switching 155 155
and routing of traffic 156 156
and the imposition of access control lists for our security. 157 157
Basically, the data plane 158 158
is focused on moving the data around the network. 159 159
And the third plane we have 160 160
is known as the management plane. 161 161
The management plane 162 162
monitors traffic conditions and network status, 163 163
allows for configuration changes in oversight, 164 164
and things like that. 165 165
Basically, the management plane 166 166
is all about configuration and administration 167 167
of the network and its devices. 168 168
So all three of these planes 169 169
are always going to be working together. 170 170
The management plane is used to define the policy decisions 171 171
that are going to be controlled by that control plane. 172 172
The control plane is going to tell the the data where to go 173 173
and the data plane is going to move the data 174 174
from place to place. 175 175
Now, one of the best things about SDNs 176 176
is the ability for these fully automated deployments, 177 177
including the provisioning of network links, 178 178
appliances, and servers. 179 179
This makes them critical for high velocity 180 180
or high availability architectures 181 181
as well as for disaster recovery. 182 182
Additionally, because all of this stuff is just software, 183 183
it's really easy to collect security data 184 184
across the entire network too, 185 185
making it even easier to detect unusual traffic patterns 186 186
that may be an indication that you're under attack. 187 187
The last thing we need to discuss in this lesson 188 188
is the concept of SASE, 189 189
which stands for Secure Access Secure Edge. 190 190
Now, Secure Access Secure Edge, or SASE, 191 191
is a new type of network architecture 192 192
that combines both network security and wide area networks 193 193
or WAN capabilities into a single solution. 194 194
The Secure Access Secure Edge 195 195
is seen as a way to address the challenges 196 196
of securing and connecting users and data 197 197
that's being distributed across multiple locations 198 198
such as branch offices, remote workers, and mobile users, 199 199
as well as into the cloud. 200 200
a key aspect of SASE technology 201 201
is that it's using software-defined networking, or SDN, 202 202
to provide security and networking services from the cloud 203 203
rather than from traditional hardware-based appliances. 204 204
This allows for more flexibility, scalability, 205 205
and cost efficiency 206 206
than using a traditional network solution. 207 207
SASE or Secure Access Secure Edge solutions 208 208
are typically going to include 209 209
a wide variety of security services, 210 210
including things like firewalls, VPNs, 211 211
zero-trust network access, 212 212
and Cloud Access Security Brokers, which are known as CASBs. 213 213
These are all going to be delivered through a common set 214 214
of policy and management platforms as well 215 215
to achieve your networking goals. 216 216
SASE is going to help to address the challenges 217 217
of the modern distributed enterprise, 218 218
which is increasingly composed of mobile, cloud-based, 219 219
and multi-cloud applications and services, 220 220
and a large number of our users and devices 221 221
are constantly growing and moving 222 222
into larger and more distinct locations. 223 223
SASE is used to provide a more secure and efficient way 224 224
of connecting all these users and their devices 225 225
to the applications and services they want to use 226 226
regardless of the location 227 227
or the type of device they're using. 228 228
Now, all the major cloud providers, 229 229
including Amazon Web Services, Microsoft Azure, 230 230
and the Google Cloud Platform, 231 231
all offer solutions that align with the concepts 232 232
of Secure Access Secure Edge, 233 233
but they do refer to them by different names or acronyms, 234 234
depending on the specific service or product 235 235
that you're referencing. 236 236
For example, in Amazon Web Services, known as AWS, 237 237
the service that most closely aligns with SASE 238 238
is known as a VPC or Virtual Private Cloud. 239 239
Now, a Virtual Private Cloud provides a secure 240 240
and flexible network infrastructure 241 241
for your applications and data, 242 242
and AWS VPC enables us to be able to create virtual networks 243 243
in the cloud and connect it to our on-premise datacenters 244 244
or other AWS services to achieve that SASE capability. 245 245
Microsoft Azure actually has lots of different services 246 246
that will align with the SASE concept, 247 247
including Azure's Virtual WAN, 248 248
which provides secure, global, and efficient connectivity 249 249
between branch offices, datacenters, and Azure resources, 250 250
as well as using Azure ExpressRoutes, 251 251
which enables you to create a dedicated private connection 252 252
between an Azure datacenter 253 253
and your on-premise network infrastructure. 254 254
If you're using the Google Cloud Platform, 255 255
they call their SASE-aligned service 256 256
Google Cloud Interconnect. 257 257
Google Cloud Interconnect 258 258
allows you to connect your on-premise infrastructure 259 259
to the Google Cloud Platform, known as GCP, 260 260
over a dedicated private connection. 261 261
They also have a service known as Google Cloud VPN, 262 262
which allows you to securely connect 263 263
your on-premise infrastructure 264 264
to your virtual private cloud network 265 265
through an IPsec VPN tunnel. 266 266
Now, it's important to realize that these services 267 267
are not exclusively SASE providers, 268 268
and the definition of SASE here is not completely aligned 269 269
with all the features and functionality 270 270
of any single cloud service from these cloud providers, 271 271
but they do provide a lot of the aspects of SASE for you, 272 272
such as having secure, flexible, 273 273
and global networking capabilities 274 274
by using these different services. 275 275
Now, as you're preparing for your exam, 276 276
there's a couple of important pieces of information 277 277
you need to keep in mind 278 278
when it comes to the protection of your networks. 279 279
Remember, physical boundaries and controls 280 280
such as locks, doors, walls, guards, and fences 281 281
are going to be crucial for ensuring the security 282 282
of your physical network. 283 283
However, if you're using a virtual private network, or VPN, 284 284
it's always important to remember 285 285
that you can create a physical extension of your network 286 286
outside of your normal protective boundaries, 287 287
and because of this deperimeterization, 288 288
this means that you may have all your logical protections 289 289
in place, but you no longer have the same level 290 290
of physical protections, 291 291
and so you have to worry 292 292
about people looking over your shoulder 293 293
at the data you're using. 294 294
Another important thing to keep in mind 295 295
is that if you're using SDN or software-defined networking, 296 296
you're going to be able to do automatic deployment 297 297
and disaster recovery, 298 298
which is great for gathering security data, 299 299
because everything is software code, 300 300
and so it's all just ones and zeros 301 301
going across the network, 302 302
so you can actually capture it really, really easy. 303 303
However, it can be challenging for us 304 304
as technicians and administrators 305 305
to fully understand what we're seeing 306 306
inside of a software-defined network 307 307
because it is changing rapidly all of the time. 308 308
Additionally, if you're using virtual devices, 309 309
they can easily be placed 310 310
inside the network without detection 311 311
because they're simply pieces of code 312 312
inside of the SDN or SASE architecture, 313 313
and this makes it even more difficult 314 314
to locate and identify potential security threats 315 315
as compared to using a physical network 316 316
that you can hand over hand the cables 317 317
and look at what devices are in your networking cabinets 318 318
to identify any rogue devices that may be there.