In this lesson,
we're going to cover some infrastructure considerations.
Now, our network infrastructure forms the backbone
of all of our information technology environments
and requires us to make a wide variety of decisions
when we're designing the architecture
that can potentially impact the efficiency, security,
and resilience of our networks for years to come.
These infrastructure considerations and decisions
include things like the correct placement
of your devices in the architecture,
the use of security zones and screened subnets,
understanding your attack surface,
determining your connectivity methods,
understanding your device attributes,
and configuring the failure mode to utilize
when things go wrong.
Now first, let's consider the placement of your devices
inside of your network architecture.
The location of your devices,
including things like your routers, your switches,
and your access points can greatly influence
both the performance and security of your entire network.
The proper placement will ensure optimal data flow
minimizes latency, and it provides a robust defense
against potential security breaches.
For example, by placing a router at the network's edge,
you can help direct and filter
incoming and outgoing traffic much more efficiently.
Access points should also be strategically positioned
to provide adequate coverage while attempting to keep
all of your wireless signals located inside your facilities
and to ensure interference between your system
and others is being avoided.
Switches on the other hand, are going to be designed to serve
as the main connection point
for most of your network devices,
and so they need to be placed in a position
that allows for your various devices to be easily connected
to the proper physical segment of that network.
If you place your devices in the wrong places,
this can lead to network bottlenecks, vulnerability points,
or even areas without connectivity.
So it's really important that you carefully plan
and evaluate your placement decisions
while designing your network's architecture.
Second, we need to consider
how we're going to configure security zones
and screened subnets in our network architecture.
Now, a security zone is a distinct segment within a network,
often created by logically isolating the segment
using a firewall or other security device.
These security zones or segments are going to be designed
to contain devices with similar security requirements
and levels of trust.
For example, a company might have different zones
for its public-facing services, internal employee resources,
and sensitive data storage,
and each of these will be configured
with different access controls
and different security policies based on the sensitivity
or classification of the data
contained in each of those security zones.
Now, a screened subnet can also be created
to act as a protective layer or buffer zone
between an organization's internal network
and an untrusted external network like the Internet.
A screened subnet used to be referenced
as something known as a DMZ or demilitarized zone,
but in recent years, this term has been changed
to a screened subnet instead.
Note though, some network appliances
and equipment that you might use on a daily basis
may still use the term DMZ or demilitarized zone
when you're configuring them, but for the exam,
you should remember the term screened subnet instead
because that's the term you're going to be asked about.
Now, a screened subnet is used to host
public-facing services like web servers,
email servers, and DNS servers,
while ensuring that if a security breach occurs
inside of that screened subnet,
the attacker will not have direct access
to the core internal network
that contains your most sensitive data or systems.
This screened subnet is going to be used
to provide an additional layer of security
to make it harder for a malicious actor
to reach the inner most and most valuable portions
of your organization's network.
Third, we need to consider the attack surface
that our network architecture
is going to represent to our organization.
Now, the attack surface of a network
refers to all the points where an unauthorized user
can try and enter data to
or extract data from an environment.
In essence, it's the sum
of all the potential vulnerabilities and risk points
inside of a system, a network, or an application.
As our networks grow and become more complex
and we add additional devices, applications,
and access points, the surface area
and the attack surface will inevitably expand
and become larger and larger.
A larger attack surface generally equates
to a higher level of risk
because there are more opportunities for malicious actors
to exploit weaknesses and vulnerabilities in your systems,
including improper device placement,
improperly configured devices, outdated software,
unnecessary open ports, and weak access controls
that are being used.
To reduce your attack surface, you need to identify
the vulnerabilities and either eliminate them
or implement proper controls to mitigate the risk
associated with those vulnerabilities.
To safeguard our organization, it's really important
that you regularly assess and minimize
your organization's attack surface.
By taking a proactive approach,
you can ensure that you remain conscious
of any potential threats
and that you can act swiftly to address them
in order to maintain the integrity and security
of your organization's network.
Now, fourth, we need to consider
the different connectivity methods
that are going to be used for our network architecture.
Connectivity refers to how different components
of a network are going to communicate with each other
and with our external networks.
The connectivity method that you choose
will really influence the performance,
reliability and security of your entire network or system.
So if you're going to use
a traditional wired network connection like ethernet,
this is going to provide you with higher levels of stability
and much faster speeds, but it is going to be more restrictive
in terms of your end user's mobility
than using a wireless network,
and so it becomes much more difficult to move workstations
and laptops to different offices
because the wired cables will also have to be moved,
or new ones will have to be installed
to support your new office location.
On the other hand, wireless connectivity methods like Wi-Fi,
microwave links and satellite connections
do offer us greater levels of flexibility and scalability
because they're not limited to the preexisting wiring
of a given network, but they do suffer from interference
and potential security vulnerabilities
if you don't properly configure your wireless devices.
Furthermore, newer wired methods like fiber optics
do provide higher speed data transmission
over longer distances with minimal signal degradation
than a microwave link or a satellite connection would.
Sometimes to create a more robust connection,
you might use a hybrid method
that's going to combine various forms of connectivity
to leverage the strengths of each different technology
that's being used in order to ensure additional layers
of redundancy are being put into your networks.
Now, when you're designing or revising
your network architecture, it's essential for you
to weigh the benefits and drawbacks
of each connectivity method based upon the specific needs
and objectives of your organization's network.
You should think about the various factors
including scalability, speed requirements,
security considerations, and budgetary constraints
when you're determining the most suitable
connectivity option for your organization to utilize.
Fifth, we need to consider the device attributes
that will affect how each device can be utilized
in our network's architecture.
When I refer to a device's attributes,
I'm really referring to whether or not the device
is considered to be active or passive,
and if it's going to be placed in line or as a tap
or monitor inside of your network architecture.
Now, active devices like intrusion prevention systems
are going to be used to monitor and act on suspicious
or malicious network traffic by influencing data flows
and making real-time decisions
based on the network's current state.
On the other hand, passive devices
like an intrusion detection system will simply observe
and report on the network traffic
without actively intervening or altering its data flow.
Network security devices can be installed
as either an inline device or a tap-based configuration.
Now an inline device is going to be positioned
directly in the path of the network traffic
and they have the capability to influence
or block traffic as it passes through the device.
This makes an inline device like a firewall, a router,
or an intrusion prevention system, a really critical tool
for tasks like filtering malicious traffic
or optimizing our data flows.
Taps and monitors, on the other hand,
operate much more discreetly
because they're placed outside of the direct network path
and they're configured to only listen
to the network's activity by capturing data for analysis
without impacting the actual traffic.
This makes them ideal for monitoring network health,
performance and security without risking
any kind of disruptions to your network.
So, when you're selecting a security device
to place in your network, you need to ensure
that you consider whether it's going to be set up
as an inline or tap device to best optimize
your network security and performance.
Always make sure to align your choices
with the network's broader goals and challenges too.
For example, an organization that requires
real-time threat mitigation might prioritize
installing an inline security appliance
while a different organization
who's focused more on monitoring might select a passive tap
or monitor to use instead.
Sixth, we need to consider the failure mode
that we want to configure our devices to use
in case something goes wrong.
Now, the failure mode selected will determine
how a device behaves when it encounters
an error or malfunction.
There are two primary failure modes that we can utilize,
and these are known as fail-open or fail-closed.
Now, when a device is set to fail-open,
it's going to allow traffic to pass through
without any inspection or filtering
in the event of a failure
to ensure that there is no disruption
to the network service.
If you're operating a firewall that's configured
as a fail-open device, that firewall would simply allow
all incoming and outgoing data to flow freely through it
to maintain uninterrupted network connectivity
if something goes wrong.
But this firewall is no longer providing you
with any kind of security when it's operating
in this failed-open condition.
So it's important to realize that too.
Now, if you're using a device that's set to fail-closed,
it's going to do the opposite
and it's going to block all traffic in the event of a failure
to ensure that your security of your network remains intact.
If you're operating a firewall that's configured
as a fail-closed device,
if a malfunction occurs in your firewall,
that firewall is going to start blocking
all incoming and all outgoing data in order to maintain
the security of your data and your network.
But this will fully interrupt your network connectivity
and prevent any normal firewall operations to occur
during this failed state.
Now, your choice between using a failed-open
or failed-close mode is really going to depend
on the organization's security policy
and the criticality of the network segment
that device is trying to protect.
For example, a data center that's used to store
all the organization's sensitive financial data
might opt to use a failed-closed mode
to maintain the security of the data
in the case of a device failure.
On the other hand, if you're operating
a guest wireless network, you might prefer to use
a failed-open mode to ensure uninterrupted access
for all of your users,
because you're not really trying to protect
any sensitive data or servers
inside of that guest wireless network anyway.
So remember, infrastructure considerations
play a pivotal role in the efficiency and security
of a network environment.
Therefore, it's important to consider the device placement
in your network architecture so you can optimize
your data flow and security.
Security zones and screened subnets can also be used
to help isolate and protect network segments
inside of your architecture.
As a cybersecurity professional, it is our job to understand
our organization's attack surface
and provide ways to minimize it so that our security
is going to be increased.
Additionally, you need to consider
the various connectivity methods that you can use
in your networks so that you can choose the right one
to provide both the performance and flexibility
that your organization needs.
As you install various network and security appliances
in your architecture, you also need to consider
whether they should be placed in an active or passive role,
and if they're going to be installed
as either inline or as a tap or monitor position.
Finally, you should be aware that the failure mode
of your various devices includes things like fail-open
and fail-closed, and you need to know what they're going to do
and what protections they will or will not provide to you
if the device becomes overloaded
or fails to operate as designed.
By considering all these infrastructure considerations,
you can build a more secure network architecture
and that the security of your organizational network
remains intact.