CYS406 · Chapter 11 · Annotated SlidesNetwork Segmentation and Firewalls
Original
Overview

Network Segmentation and Firewalls

Network segmentation and its types, bastion hosts and where to place them, the DMZ, then firewalls: hardware, software and host-based types, packet filtering, circuit-level and application-level gateways, stateful inspection, proxies, NAT, NGFWs, capabilities, limitations and secure deployment.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 41 slides
  1. 1 Slide 1
  2. 2 Module Objectives
  3. 3 Module Flow
  4. 4 What is Network Segmentation?
  5. 5 Types of Network Segmentation
  6. 6 Types of Network Segmentation (Cont’d)
  7. 7 Types of Network Segmentation (Cont’d)
  8. 8 Introduction to Bastion Host
  9. 9 Need for Bastion Host
  10. 10 Positioning the Bastion Host
  11. 11 Positioning the Bastion Host (Cont’d)
  12. 12 Types of Bastion Hosts: Single-homed
  13. 13 Types of Bastion Hosts: Multi-homed
  14. 14 Types of Bastion Hosts: Internal Bastion Host
  15. 15 Types of Bastion Hosts (Cont’d)
  16. 16 What is Demilitarized Zone (DMZ)?
  17. 17 Different Ways to Create a DMZ
  18. 18 Different Ways to Create a DMZ (Cont’d)
  19. 19 Module Flow
  20. 20 What is a Firewall?
  21. 21 Types of Firewalls: Hardware Firewalls
  22. 22 Types of Firewalls: Software Firewalls
  23. 23 Types of Firewalls: Host-based and Network-based Firewalls
  24. 24 Firewall Technologies
  25. 25 Firewall technologies operating at each OSI layer
  26. 26 Packet Filtering Firewall
  27. 27 Circuit-Level Gateway
  28. 28 Application Level Gateways
  29. 29 Stateful Multilayer Inspection Firewall
  30. 30 Application Proxy
  31. 31 Network Address Translation (NAT)
  32. 32 Virtual Private Network
  33. 33 Next Generation Firewall (NGFW)
  34. 34 Firewall Capabilities
  35. 35 Firewall Limitations
  36. 36 Firewall Implementation and Deployment Process
  37. 37 Host-based Firewall Protection with Iptables
  38. 38 Host- based Firewall Protection with Iptables (Cont’d)
  39. 39 Secure Firewall Implementation: Best Practices
  40. 40 Secure Firewall Implementation: Recommendations
  41. 41 Secure Firewall Implementation: Do’s and Don’ts
Slide 1 / 41

Slide 1

Slide 1: Slide 1
Slide 2 / 41

Module Objectives

Slide 2: Module Objectives
Slide 3 / 41

Module Flow

Slide 3: Module Flow
Slide 4 / 41

What is Network Segmentation?

Slide 4: What is Network Segmentation?

Notes

  1. Segmentation splits the network into zones so a breach in one doesn’t expose everything (physical, logical/VLAN, network virtualization).

Slide 5 / 41

Types of Network Segmentation

Slide 5: Types of Network Segmentation
Slide 6 / 41

Types of Network Segmentation (Cont’d)

Slide 6: Types of Network Segmentation (Cont’d)
Slide 7 / 41

Types of Network Segmentation (Cont’d)

Slide 7: Types of Network Segmentation (Cont’d)
Slide 8 / 41

Introduction to Bastion Host

Slide 8: Introduction to Bastion Host

Notes

  1. Bastion host: a hardened system exposed to attack, e.g. in the DMZ, running only essential services.

Slide 9 / 41

Need for Bastion Host

Slide 9: Need for Bastion Host
Slide 10 / 41

Positioning the Bastion Host

Slide 10: Positioning the Bastion Host
Slide 11 / 41

Positioning the Bastion Host (Cont’d)

Slide 11: Positioning the Bastion Host (Cont’d)
Slide 12 / 41

Types of Bastion Hosts: Single-homed

Slide 12: Types of Bastion Hosts: Single-homed
Slide 13 / 41

Types of Bastion Hosts: Multi-homed

Slide 13: Types of Bastion Hosts: Multi-homed
Slide 14 / 41

Types of Bastion Hosts: Internal Bastion Host

Slide 14: Types of Bastion Hosts: Internal Bastion Host
Slide 15 / 41

Types of Bastion Hosts (Cont’d)

Slide 15: Types of Bastion Hosts (Cont’d)
Slide 16 / 41

What is Demilitarized Zone (DMZ)?

Slide 16: What is Demilitarized Zone (DMZ)?

Exam angle

PredictionQ1

A company’s public web server should be placed in the:

Slide 17 / 41

Different Ways to Create a DMZ

Slide 17: Different Ways to Create a DMZ
Slide 18 / 41

Different Ways to Create a DMZ (Cont’d)

Slide 18: Different Ways to Create a DMZ (Cont’d)
Slide 19 / 41

Module Flow

Slide 19: Module Flow
Slide 20 / 41

What is a Firewall?

Slide 20: What is a Firewall?

Notes

  1. Firewall: enforces a policy on traffic between networks; default-deny is best practice.

Slide 21 / 41

Types of Firewalls: Hardware Firewalls

Slide 21: Types of Firewalls: Hardware Firewalls
Slide 22 / 41

Types of Firewalls: Software Firewalls

Slide 22: Types of Firewalls: Software Firewalls
Slide 23 / 41

Types of Firewalls: Host-based and Network-based Firewalls

Slide 23: Types of Firewalls: Host-based and Network-based Firewalls
Slide 24 / 41

Firewall Technologies

Slide 24: Firewall Technologies
Slide 25 / 41

Firewall technologies operating at each OSI layer

Slide 25: Firewall technologies operating at each OSI layer
Slide 26 / 41

Packet Filtering Firewall

Slide 26: Packet Filtering Firewall

Notes

  1. Packet filter (layer 3/4): checks IPs, ports, protocol of each packet independently. Fast but stateless.

Slide 27 / 41

Circuit-Level Gateway

Slide 27: Circuit-Level Gateway
Slide 28 / 41

Application Level Gateways

Slide 28: Application Level Gateways
Slide 29 / 41

Stateful Multilayer Inspection Firewall

Slide 29: Stateful Multilayer Inspection Firewall

Notes

  1. Stateful multilayer inspection: tracks connection state and examines multiple layers.

Exam angle

PredictionQ1

A firewall that tracks the state of connections in a table is a:

PredictionQ2

Which firewall type can inspect HTTP content?

Slide 30 / 41

Application Proxy

Slide 30: Application Proxy
Slide 31 / 41

Network Address Translation (NAT)

Slide 31: Network Address Translation (NAT)

Notes

  1. NAT hides internal addresses behind one public IP.

Slide 32 / 41

Virtual Private Network

Slide 32: Virtual Private Network
Slide 33 / 41

Next Generation Firewall (NGFW)

Slide 33: Next Generation Firewall (NGFW)

Notes

  1. NGFW: stateful firewall + deep packet inspection, application awareness, IPS, user identity.

Slide 34 / 41

Firewall Capabilities

Slide 34: Firewall Capabilities
Slide 35 / 41

Firewall Limitations

Slide 35: Firewall Limitations

Notes

  1. Limitations: can’t stop insider attacks, malware in allowed traffic, social engineering, encrypted payloads it can’t inspect.

Exam angle

PredictionQ1

A firewall protects against attacks from inside the network.

Slide 36 / 41

Firewall Implementation and Deployment Process

Slide 36: Firewall Implementation and Deployment Process
Slide 37 / 41

Host-based Firewall Protection with Iptables

Slide 37: Host-based Firewall Protection with Iptables
Slide 38 / 41

Host- based Firewall Protection with Iptables (Cont’d)

Slide 38: Host- based Firewall Protection with Iptables (Cont’d)
Slide 39 / 41

Secure Firewall Implementation: Best Practices

Slide 39: Secure Firewall Implementation: Best Practices
Slide 40 / 41

Secure Firewall Implementation: Recommendations

Slide 40: Secure Firewall Implementation: Recommendations
Slide 41 / 41

Secure Firewall Implementation: Do’s and Don’ts

Slide 41: Secure Firewall Implementation: Do’s and Don’ts