Enhancing enterprise security

This scenario objective asks what to change in the environment: firewall rules, IDS/IPS signatures, web filters, operating system security, secure protocols, DNS filtering, email security, file integrity monitoring, DLP, network access control, EDR/XDR, and user behavior analytics.

Network controls

Firewall rules are processed top-down; the most specific rules go first and an implicit deny sits at the end. Screened subnets hold public servers. IDS/IPS use signatures (known patterns) and trends (anomalies). Web filtering can be agent-based or centralized through a proxy, using URL scanning, content categorization, block rules, and reputation.

Email, endpoint, and behavior

Email authentication uses three DNS records: SPF lists the servers allowed to send for a domain, DKIM signs messages so receivers can verify them, and DMARC tells receivers what to do when SPF or DKIM fail and where to send reports. A secure email gateway filters spam, malware, and phishing.

File integrity monitoring alerts on changes to critical files. Network access control (NAC) checks device health before allowing a connection. Endpoint detection and response (EDR) records endpoint behavior and can respond; extended detection and response (XDR) correlates across endpoints, network, cloud, and email. User behavior analytics (UBA) baselines normal activity and flags deviations.

Key terms

Implicit deny

The default firewall behavior of blocking any traffic not explicitly allowed by a rule.

Sender Policy Framework (SPF)

A DNS record listing which mail servers are authorized to send email for a domain.

DomainKeys Identified Mail (DKIM)

A method that digitally signs outgoing email so receivers can verify it wasn't altered and came from the domain.

DMARC

A DNS policy that tells receivers how to handle mail failing SPF or DKIM and where to send reports.

DNS filtering

Blocking name resolution for known malicious or unwanted domains.

File integrity monitoring (FIM)

A tool that detects and alerts on changes to critical system and application files.

Network access control (NAC)

A control that checks a device's identity and security posture before granting network access.

Endpoint detection and response (EDR)

Endpoint software that records behavior, detects threats, and can contain or remediate them.

Extended detection and response (XDR)

A platform that correlates detection data across endpoints, network, cloud, and email.

User behavior analytics (UBA)

Analytics that learn normal user behavior and flag unusual activity.

Secure protocol replacement

Swapping an insecure protocol for an encrypted equivalent, such as Telnet for SSH.