You're reading from CompTIA Security+ SY0-701 Certification Guide - Third Edition

Product typeBook

Published inJan 2024

PublisherPackt

ISBN-139781835461532

Edition3rd Edition

Concepts

Cybersecurity

Author (1)

Ian Neil

Introduction

This chapter covers objective one of Domain 3.0 Security Architecture of the CompTIA Security+ 701 exam.

In this chapter, we will review the architecture and types of infrastructure that organizations use, from the cloud to on-premises infrastructure. This will include an exploration of centralized and decentralized models, as well as additional functions such as virtualization, embedded systems, high availability, and other considerations.

The final sections will also examine several network infrastructure security methods, such as software-defined networks, physical isolation, and logical segmentation, which are designed to minimize the impact of potential attacks.

This chapter will give you an overview of why companies rely on these processes to keep their environment safe to ensure you are prepared to successfully answer all exam questions related to these concepts for your certification.

Note

A full breakdown of Exam Objective 3.1 will be provided at...

Securing the Network

Effective network security is crucial for protecting data and resources in any organization. It involves a multi-layered strategy where different technologies work in concert to defend against various cyber threats. At the forefront of this strategy are the key elements of firewalls, access control lists (ACLs), intrusion detection systems (IDSs) and intrusion prevention systems (IPSs), and security information and event management (SIEM).

Within the network, firewalls act as the first line of defense, monitoring and filtering incoming and outgoing network traffic. They use an ACL in which the only default rule is “deny all.” Allow rules need to be created to allow any traffic through. While ACLs act as barriers based on specific criteria, IDSs and IPSs further enhance security by detecting and preventing suspicious activities in real time. The ACL, IDS, and IPS technologies work together to create a robust security perimeter.

While IDSs/IPSs...

Architecture and Infrastructure Concepts

Understanding the interoperability between different architectural models and their security implications is essential for any secure architecture. Most of the devices on a corporate network use wireless or cloud services. However, wireless networks can be vulnerable to different types of attacks compared to wired networks, and cloud services often involve storing and accessing data off-premises, which introduces unique security challenges. Therefore, security methodologies for corporate devices need to take into account several architecture and infrastructure concepts unique to cloud computing. These concepts are detailed in the following sections.

Cloud Computing

Cloud computing is a flexible and scalable technology that allows access to and storage of data and applications over the internet. The demand for cloud computing has risen over the last few years as the workforce has shifted in large numbers to a work-from-home system and become...

Infrastructure as Code (IaC)

Infrastructure as Code (IaC) is the practice of defining and managing IT infrastructure through machine-readable code or scripts. IaC is written in languages such as YAML and JSON. Gone are the days of manual, error-prone infrastructure provisioning or configuration. With IaC, infrastructure components (from servers and networks to databases and storage) are defined in code, enabling automation, scalability, and repeatability. The benefits of IaC are as follows:

Efficiency Redefined: IaC streamlines infrastructure management, reducing the time and effort required for provisioning and configuration. Tasks that once took weeks or days can now be accomplished in minutes or seconds, accelerating the pace of IT operations.
Consistency and Reproducibility: IaC ensures that infrastructure configurations are consistent across environments, reducing the risk of configuration errors. This consistency extends from development to production, fostering reliability...

Serverless

Unlike traditional server-based models, serverless computing offloads operational overhead, enabling developers to focus solely on writing and deploying code. In a serverless environment, there’s no need to provision, configure, or manage servers as the cloud provider handles all these aspects of server management, including scaling resources up or down to meet demand.

The CSP manages and secures the infrastructure. Since CSPs typically possess greater expertise and dedicated resources, they generally offer more secure solutions compared to traditional server-based models. In this arrangement, the customer does not own the physical server; instead, their databases are hosted by the CSP, enhancing security. Serverless computing often incorporates Backend as a Service (BaaS) products, which means that certain backend functions and services, such as databases, authentication, and file storage, are provided by the CSP.

However, the customer must bear in mind that...

Network Infrastructure

Network infrastructure is a mixture of networking devices, protocols, and routing packets that all work together in an interconnected environment.

Table 10.2 presents an extract of the OSI reference model, which consists of four key layers. Here, you’ll see the names of those essential devices that comprise network infrastructure, including their functions and the layers at which they operate:

Considerations for Your Infrastructure

When assessing architecture and its associated controls, several pivotal factors merit attention. Achieving equilibrium among these factors is essential for creating a secure and future-ready architectural foundation fortified by effective controls. Let’s look at these factors, each in turn:

Availability: You must ensure that data remains available at all times. This might mean building another datacenter or holding the data in the cloud using geographically dispersed regions. Failure to do so could result in the business suffering downtime or even financial and reputational loss.
Resilience: Resiliency is measured by the amount of time it takes the organization to recover from a critical failure. A load balancer can make a web server resilient by balancing the load. Automated resiliency (such as obtaining your data from another geographically dispersed region) is immediate. This is the benefit of data storage and backup in...

Summary

The chapter outlines the importance of robust network security in organizations, focusing on multi-layered strategies involving firewalls, ACLs, IDS, IPS, and SIEM systems. It emphasizes the need for securing critical servers, such as domain controllers and SQL servers, and discusses the security measures for mail servers, video conference applications, and cloud storage solutions. The chapter also highlights the necessity of securing hosts with endpoint security solutions and MFA to protect against malware and unauthorized access.

The chapter also discussed various cloud models (public, private, community, and hybrid) and services (IaaS, SaaS, PaaS, SECaaS, and XaaS), emphasizing their security implications, especially in wireless and cloud environments. It covers advanced concepts such as IaC, serverless computing, microservices architecture, and network infrastructure, including the OSI model. The discussion extends to specialized systems such as SCADA and RTOS, and their...

Exam Objectives 3.1

Compare and contrast security implications of different architecture models.

Architecture and infrastructure concepts
Cloud computing
- Responsibility matrix: Defining roles and responsibilities in cloud management
- Hybrid considerations: Balancing on-premises and cloud resources
- Third-party vendors: Integrating external services into the cloud environment
Infrastructure as code (IaC): Automating infrastructure provisioning and management
Serverless: Leveraging serverless computing for scalable applications
Microservices: Building applications as small, independent services
Network infrastructure: Designing and securing cloud network architecture
- Physical isolation: Separating resources physically for enhanced security
- Air-gapped: Isolating systems from external networks for security
- Logical segmentation: Creating isolated network segments for security
- Software-defined networking (SDN): Implementing flexible network management in the cloud
- On-premises...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

In a rapidly evolving technology company, a new software update is about to be implemented that could have a significant impact on the efficiency of customer support operations. What component of change management is essential to ensure that customer support operations are not adversely affected by this update?
1. Ownership
2. Test results
3. An approval process
4. A maintenance window
In the context of digital security, what designation is attributed to a record of explicitly authorized entities or actions that shape a meticulously controlled environment?
1. Cryptography
2. Threat actors
3. An allow list...

The rest of the chapter is locked

You have been reading a chapter from

CompTIA Security+ SY0-701 Certification Guide - Third Edition

Published in: Jan 2024Publisher: PacktISBN-13: 9781835461532

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Ian Neil

Ian Neil is one of the world's top trainers of Security+. He is able to break down information into manageable chunks so that people with no background knowledge can gain the skills required to become certified. He has recently worked for the US Army in Europe and designed a Security+ course that catered to people from all backgrounds (not just IT professionals), with an extremely successful pass rate. He is an MCT, MCSE, A+, Network+, Security+, CASP, and RESILIA practitioner that has worked with high-end training providers over the past 23 years and was one of the first technical trainers to train Microsoft internal staff when they opened their Bucharest Office in 2006.
Read more about Ian Neil

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages

Layer	Devices	Function
Layer 7 Application Layer	Web Application Firewall (WAF) Network Intrusion Prevention System (NIPS)	Protocols: DNS, SMTP, HTTP, SMB, and FTP
Layer 4 Transport Layer	Load Balancer	TCP/UDP
Layer 3 Network Layer	Routers / Subnets ...