Please enable JavaScript.

Coggle requires JavaScript to display documents.

SECURING NETWORKS, image, top, image, image, image - Coggle Diagram

- - - - All networks are targets. However, the main focus of this course is on securing Campus Area Networks (CANs). Campus Area Networks consists of interconnected LANs within a limited geographic area.
      - Network professionals must implement various network security techniques to protect the organization’s assets from outside and inside threats. Connections to untrusted networks must be checked in-depth by multiple layers of defense before reaching enterprise resources. This is known as defense-in-depth.
      - The figure displays a sample CAN with a defense in-depth approach that uses various security features and security devices to secure it. The table provides an explanation of the elements of the defense-in-depth design that are shown in the figure.
  - - - Home and SOHO networks are typically protected using a consumer grade router. These routers provide basic security features that adequately protect inside assets from outside attackers.
  - - - Outside perimeter security - This can include on-premise security officers, fences, gates, continuous video surveillance, and security breach alarms.
      - Inside perimeter security - This can include continuous video surveillance, electronic motion detectors, security traps, and biometric access and exit sensors.
      - Data Center Physical Security
        
        Security traps provide access to the data halls where data center data is stored. As shown in the figure below, a security trap is similar to an air lock. A person must first enter the security trap using their badge ID proximity card. After the person is inside the security trap, facial recognition, fingerprints, or other biometric verifications are used to open the second door. The user must repeat the process to exit the data hall.
        
        Security Traps
        
        The figure below displays the biometric finger print scanner that is used to secure access to the Cisco Allen Data Center, in Allen, Texas.
        
        Biometric Access
  - - - An attacker could hijack a VM hypervisor (VM controlling software) and then use it as a launch point to attack other devices on the data center network.
    - - When a VM that has not been used for a period of time is brought online, it may have outdated security policies that deviate from the baseline security and can introduce security vulnerabilities.
    - - This happens when all VMs attempt to download antivirus data files at the same time.
    - - ASA devices and a Virtual Security Gateway integrated into the Cisco Nexus Series switches are deployed in a data center network to provide secure segmentation. This provides granular inter-virtual-machine security.
    - - ASAs and IPS devices in data center networks use threat intelligence, passive OS fingerprinting, and reputation and contextual analysis to provide threat defense.
    - - Visibility solutions are provided using software such as the Cisco Security Manager which help simplify operations and compliance reporting.
  - - - MDM features secure, monitor, and manage mobile devices, including corporate-owned devices and employee-owned devices.
      - Critical Functions
        
        PIN Enforcement
        
        Educing the likelihood of brute-force attacks.
        
        Data Wipe
        
        Lost or stolen devices can be remotely fully- or partially-wiped, either by the user or by an administrator
        
        Data Encryption
        
        Most devices have built-in encryption capabilities, both at the device and file level.
        
        Data Loss Prevention (DPL)
        
        Prevents authorized users from doing careless or malicious things with critical data.
        
        Jailbreak/Root Detection
        
        Are a means to bypass the management of a device.
  - - - The WAN span a wide geographical area, often over the public internet. Organizations must ensure secure transport for the data in motion as it travels between sites over the public network.
        Network security professionals must use secure devices on the edge of the networks, which provides stateful firewall features and establishes secure VPN tunnels to various destinations.
- - - - attacks can come more from inside than from outside the network
        
        Connect an infected USB drive into a corporate computer system.
        
        Disconnect a critical network connection and cause a network outage.
        
        Compromise internal servers or network infrastructure devices.
        
        Steal and copy confidential data to removable media, email, messaging software, and other media.
        
        An internal user, such as an employee, can accidentally or intentionally:
  - - - Data loss, or data exfiltration, is when data is intentionally or unintentionally lost, stolen, or leaked to the outside world. The data loss can result in:
        
        Brand damage and loss of reputation
        
        Loss of competitive advantage
        
        Loss of customers
        
        Loss of revenue
        
        Litigation/legal action that results in fines and civil penalties
        
        Significant cost and effort to notify affected parties and recover from the breach