Securing enterprise infrastructure

This scenario objective covers where to place devices, how to group them into security zones, how failure modes affect safety, and which network appliances, secure communication, and access methods fit a given need.

Placement, zones, and failure modes

Device placement follows the flow of risk. Put firewalls at zone boundaries, sensors where they can see the traffic you care about, and public-facing servers in a screened subnet (DMZ) between the internet and the internal network. Security zones group assets by trust level and purpose, and the attack surface shrinks when each zone only exposes what it must.

When a security device fails, it fails open (traffic passes, preserving availability) or fails closed (traffic stops, preserving security). A door lock on an emergency exit fails open for life safety; a firewall protecting a payment network usually fails closed.

Devices are deployed inline (traffic flows through them, so they can block) or as a tap/monitor (they get a copy of traffic, so they can only alert). Active devices take action; passive devices observe.

Network appliances

Port security on switches limits which devices may connect; 802.1X with EAP authenticates a device or user before the port passes traffic, usually backed by a RADIUS server.

Secure communication and access

A virtual private network (VPN) creates an encrypted tunnel over an untrusted network. Remote access VPNs connect individual users; site-to-site VPNs connect offices. IPsec works at the network layer; TLS VPNs work through a browser or client. Software-defined WAN (SD-WAN) routes branch traffic over multiple links under central policy, and secure access service edge (SASE) combines networking and cloud-delivered security services close to the user.

Key terms

Screened subnet (DMZ)

A network zone between the internet and the internal network that hosts public-facing services.

Fail-open

A failure mode where a device lets traffic or people through when it fails, favoring availability or safety.

Fail-closed

A failure mode where a device blocks traffic or access when it fails, favoring security.

Jump server

A hardened, monitored host that administrators connect through to reach sensitive systems.

Proxy server

A server that makes requests on behalf of clients and can filter, log, and cache them.

Intrusion prevention system (IPS)

An inline device that detects malicious traffic and blocks it in real time.

Load balancer

A device that distributes incoming traffic across multiple servers to improve availability and performance.

Web application firewall (WAF)

A filter that inspects HTTP traffic to block web attacks such as SQL injection and cross-site scripting.

Unified threat management (UTM)

A single appliance combining firewall, IPS, antivirus, filtering, and VPN functions.

Next-generation firewall (NGFW)

A firewall that identifies applications and users and includes intrusion prevention, beyond ports and protocols.

802.1X

A port-based network access control standard that authenticates devices before granting network access.

Site-to-site VPN

An encrypted tunnel that connects two networks, such as a branch office and headquarters.

Secure access service edge (SASE)

A cloud-delivered model that combines networking and security services close to the user.

Inline vs. tap deployment

Whether a device sits in the traffic path and can block, or receives a copy and can only observe.