3.2 Given a scenario, apply security principles to secure enterprise infrastructure

★ Starred in your notes: WAF · IPsec transport vs. tunnel mode · north–south vs. east–west · OSI mnemonic ("All People Seem To Need Data Processing") & Transport = ports · port security · DHCP snooping · loop protection.

Breakdown 1 — Zones, placement, and traffic direction

Concept	Meaning
Security zones	Trust levels: internet (untrusted) → screened subnet/DMZ (semi-trusted, public-facing servers) → internal LAN → restricted (databases, management)
Screened subnet (DMZ)	Outside can reach in, but the DMZ should not connect directly to the inside; admins reach it through a jump box (class)
Device placement	Firewalls at zone boundaries; IDS sensors where they can see traffic; WAF in front of web apps
Attack surface	Every exposed service/interface; minimize per zone
Connectivity	In-band (management on the same channel as data) vs. out-of-band (plug into the device via a cable / separate management network — class)
North–south vs. east–west	North–south = in/out of the data center from the internet; east–west = between systems inside the data center (class) — micro-segmentation protects east–west

Breakdown 2 — Failure modes and device attributes

Term	Meaning	Choose when
Fail-open	Device fails → traffic passes	Availability matters more (e.g., a monitoring tap)
Fail-closed	Device fails → traffic blocked	Security matters more (firewall, data diode)
Active	Device can act on traffic (block)	IPS, firewall
Passive	Device only observes	IDS, tap
Inline	Traffic flows through it (can block, adds latency, can be a point of failure)	IPS
Tap / monitor (SPAN)	Copy of traffic (cannot block)	IDS, NetFlow

Breakdown 3 — Network appliances (class Chapter 5–6)

Appliance	What it does	Class notes
Jump server / bastion	Hardened box you must go through to reach a secure zone	"DMZ uses jumpbox"
Proxy server	Intermediary between client and server; forward = egress/outbound (filters users' web traffic), reverse = internet → your servers (hides/protects them)
IDS vs. IPS	IDS detects/alerts only; IPS is inline and blocks. Host-based (HIDS/HIPS), network (NIDS/NIPS), wireless (WIDS)	Detection methods: signature (known patterns), heuristic/anomaly (deviation from baseline), stateful protocol analysis (SPI) — protocol anomaly detection
Load balancer	Spreads traffic across servers; active/active (all serve) vs. active/passive (some on standby)
Sensors	Collect traffic/logs for the SIEM
Port security / 802.1X	Only authenticated devices/known MACs get a switch port; EAP carries the authentication (supplicant → authenticator → authentication server)
Firewall types	WAF (web application firewall — SQLi/XSS at layer 7), UTM (unified threat management — "all in one; combines a lot; could be a point of failure"), NGFW (app-aware + IPS + identity), Layer 4 (ports/IPs, stateful) vs. Layer 7 (application content)	Stateless = one connection at a time, looks one way; stateful = knows both directions and connection state (class rope analogy)
Switch features	Port security, MAC filtering, DHCP snooping, DAI, loop protection (STP), flood guard, MACsec	see 2.5

Breakdown 4 — Secure communication and access

Technology	Key facts
VPN	Site-to-site (company ↔ company/branch, always on), host-to-site (remote user → company), host-to-host (computer ↔ computer). Full tunnel = everything goes through the VPN; split tunnel = only corporate traffic goes through, internet traffic goes direct (faster, less inspection)
IPsec	IKE (key exchange, UDP 500), AH (authentication header — integrity/authentication, no encryption), ESP (encapsulating security payload — encryption + integrity). Transport mode protects the payload only (host-to-host; AH and/or ESP); tunnel mode wraps the whole packet (site-to-site VPN; "ESP only — common")
TLS	Protects application traffic (HTTPS, and TLS VPNs on 443 that pass firewalls easily). Encryption happens at the presentation layer of the OSI model (class)
SSH	Encrypted by default; replaces Telnet; SCP/SFTP for files
Remote access	RDP over TLS/gateway, VPN, jump host — never expose RDP/SSH directly
SD-WAN	Software-defined WAN — routes branch traffic over multiple links by policy
SASE	Secure Access Service Edge — SD-WAN + cloud security stack (SWG, CASB, ZTNA, FWaaS) delivered from the cloud for remote/branch users

From class — OSI reminders: "All People Seem To Need Data Processing" (Application, Presentation, Session, Transport, Network, Data link, Physical). Presentation = encryption; Transport = ports; Network = IPsec/routing. Dense reference: ronbert.com/OSI.htm.

Breakdown 5 — Selection of effective controls (how scenarios are asked)

Scenario	Answer
Public web server must be reachable but isolated from the LAN	Screened subnet + reverse proxy/WAF
Admins need to reach servers in the secure zone	Jump server
Block SQL injection against a web app	WAF
Small office wants firewall + AV + content filter in one box	UTM (accept single point of failure)
Must never let malicious traffic through even if the device dies	Fail-closed inline IPS
Detect only, zero latency impact	Passive IDS on a tap
Remote workers, corporate traffic only through VPN, video calls direct	Split tunnel
Site-to-site VPN encryption	IPsec ESP tunnel mode
Only company laptops may plug into wall ports	802.1X with EAP-TLS
Stop lateral movement between servers	Micro-segmentation / east-west firewalls

Quick self-check

• AH vs. ESP? (AH = integrity only; ESP = encryption + integrity.)
• Forward vs. reverse proxy? (Forward = for clients going out; reverse = in front of your servers.)
• Fail-open or fail-closed for a firewall? (Fail-closed.)
• Stateful vs. stateless firewall? (Stateful tracks connections both ways.)