Introduction

This chapter covers the second objective in Domain 3.0, Security Architecture, of the CompTIA Security+ exam.

In this chapter, we will investigate methods of applying security principles for enterprise infrastructure, considering both the importance of device placement and the creation of security zones to ensure all of our data is not in the same area of the network. After that, we’ll look at different security appliances and their uses, including firewall types, so that we can choose the best one for a given scenario. In the final sections, we will review several methods of secure communication and access and the selection of secure controls.

This chapter will give you an overview of how to apply security principles to secure enterprise infrastructure and ensure you are prepared to successfully answer all exam questions related to these concepts for your certification.

Note

A full breakdown of Exam Objective 3.2 will be provided at the end of the...

Infrastructure Considerations

Securing an enterprise infrastructure demands a multifaceted approach. Beyond the deployment of security tools and technologies, one must consider the holistic picture. This entails an assessment of the organization’s unique risk profile, an understanding of the ever-evolving threat landscape, and the alignment of security measures with business objectives.

You also need to set up security zones, organize device placement, implement preventative and detective controls, protect access points, and ensure your enterprise infrastructure maintains adaptability in the face of emerging trends, such as cloud computing, remote workforces, and IoT proliferation.

A resilient security posture is attained through not only technology but also a culture of vigilance, continuous learning, and proactive defense. We need to adopt a defense-in-depth model that enhances network protection by creating multiple barriers and security measures, making it significantly...

Secure Communication/Access

Organizations and individuals rely on the seamless exchange of information and the ability to connect remotely, so safeguarding these interactions is not just a recommendation but an absolute necessity. The following sections will explore different forms of secure communication, starting with Virtual Private Networks.

Virtual Private Network (VPN)

A VPN server resides within a company’s network, and the client employs specific software to facilitate the connection, all of which takes place over the internet, reducing costs. This VPN setup allows for stringent control over incoming sessions, ensuring that only authorized users can gain access to the network.

Historically, PPTP and SSL VPNs were prevalent choices, but they have since been surpassed by the more secure L2TP/Internet Protocol Security (IPSec) and user-friendly HTML5 VPNs.

HTML5 VPNs stand out for their simplicity, requiring only an HTML5-compatible browser such as Opera, Edge...

Selection of Effective Controls

In order to maintain network security, there are a number of controls that could be used for data, such as access lists or audit trails, systems such as firewalls and IDSs, or two main categories of controls. The selection and implementation of controls depend on the unique circumstances of an organization. They are categorized into two main groups: preventative and detective. Let’s explore scenarios where these can be used to protect our network:

• Preventative controls: Preventative controls are placed at the network perimeter to defend against potential threats before they breach the network. These controls reside on network routers, switches, and dedicated appliances, and they tirelessly scrutinize incoming and outgoing traffic, ensuring that only legitimate data is permitted. Devices that can be used for this purpose include firewall appliances, IPSs, and ACLs.
• Detective controls: Detective controls are located within the network...

Summary

This chapter covered the application of security principles to secure enterprise infrastructure, beginning with device placement and security zones. Later sections considered network appliances and switch protection using port security, as well as firewall types, secure communication and access, and the selection of effective controls.

The knowledge gained in this chapter will prepare you to answer any questions relating to Exam Objective 3.2 in your CompTIA Security+ certification exam.

The next chapter of the book is Chapter 12, Compare and contrast concepts and strategies to protect data.

Exam Objectives 3.2

Given a scenario, apply security principles to secure enterprise infrastructure.

• Infrastructure considerations: Key network design factors
• Device placement: Where devices are located
• Security zones: Network segments with distinct security policies
• Attack surface: Vulnerable points exposed to threats
• Connectivity: Network connections between devices
• Failure modes: How devices respond to failures
  • Fail-open: Device allows traffic on failure
  • Fail-closed: Device blocks traffic on failure
• Device attribute: Device characteristics
  • Active vs. passive: Device interaction level
  • Inline vs. tap/monitor: Traffic handling approach
• Network appliances: Devices with specific functions
  • Jump server: Secure access intermediary
  • Proxy server: Intermediary for client-server requests
  • IPS/IDS: Intrusion prevention and detection
  • Load balancer: Distributes network traffic evenly
• Sensors: Monitor network traffic for anomalies
• Port security: Protects physical...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

1. You are the network administrator for a multinational corporation with a large, complex network environment in which security considerations are paramount. The IT manager has asked you to explain to the board of directors why you have recommended that they include a stateful firewall in next year’s budget to enhance your cybersecurity posture. Which of the following is the BEST description of why the organization should purchase a stateful firewall?
   1. To filter packets based solely on IP addresses and port numbers
   2. To analyze network traffic patterns and detect anomalies in real...