4.5 Given a scenario, modify enterprise capabilities to enhance security

★ Starred in your notes: email — never trust a double extension · DNS 53 / NTP 123 / LDAP 389–636 · DHCP relay (67/68) · NS record · SPF/DKIM/DMARC · GPO order.

Breakdown 1 — Firewall

• Rules / access lists: ordered top-down, first match wins, implicit deny at the bottom. Specify source, destination, port/protocol, action.
• Ports/protocols: allow only what's needed; egress (outbound) filtering stops exfiltration/C2 too, not just ingress.
• Screened subnet: public services live between two firewall interfaces; internal network never reachable directly from the internet.

Breakdown 2 — IDS/IPS, web and DNS filtering

Capability	Tuning knobs
IDS/IPS	Signatures (update them; write custom ones), trends (anomaly baselines); tune to cut false positives
Web filter	Agent-based (on the endpoint — works off-network) vs. centralized proxy (all traffic through it); URL scanning, content categorization (gambling, malware…), block rules, reputation scores
DNS filtering	Block resolution of malicious/unwanted domains; DNS sinkhole returns a safe IP and logs the requester

Breakdown 3 — Operating system security

Mechanism	Know
Group Policy (GPO)	Windows/AD central config. Processing order (class: remember it): Local → Site → Domain → OU → child OU ("LSDOU"); the last applied wins on conflicts, so the closest OU policy usually takes effect. AGDLP for permissions: Accounts → Global groups → Domain Local groups → Permissions
SELinux	Linux mandatory access control — labels + policy; modes: enforcing / permissive / disabled
Secure baselines / hardening	see 4.1

Breakdown 4 — Secure protocols (class port list)

Instead of	Use	Ports
Telnet 23	SSH	22 (SCP/SFTP too)
FTP 20/21	SFTP (SSH) / FTPS	22 / 989–990
HTTP 80	HTTPS (TLS)	443
SMTP 25 (relay)	SMTPS / STARTTLS	465 / 587
POP3 110	POP3S	995
IMAP 143	IMAPS	993
LDAP 389	LDAPS (or StartTLS)	636
SNMP v1/v2c	SNMPv3	161/162
DNS 53 (TCP/UDP)	DNSSEC (signed), DoH/DoT	443 / 853
NTP 123	(keep, but authenticate/limit) — "Kerberos and forensics need synced clocks" (class)	123
SMB 445 (NFS 2049)	SMB3 signing/encryption; restrict to LAN
RTP	SRTP
Time

Selection: protocol (encrypted one), port (standard secure port), transport method (TLS vs. IPsec vs. SSH tunnel). DHCP relay agent (UDP 67/68) lets one DHCP server serve other subnets (class).

Breakdown 5 — Email security

Control	What it does
SPF	DNS TXT record listing servers allowed to send for the domain
DKIM	Cryptographic signature on outgoing mail; public key in DNS
DMARC	Policy for what receivers do when SPF/DKIM fail (none/quarantine/reject) + reporting
Gateway	Mail security appliance/service: spam/malware filtering, attachment sandboxing, block double extensions / dangerous types (class)
S/MIME	Signs and encrypts individual messages with certificates

From class — DNS records: A (IPv4), AAAA (IPv6), MX (mail server), NS (name server), SOA (zone authority), TXT (SPF/DKIM/DMARC live here), CNAME (alias), SRV (service), PTR (reverse). "SPF/DKIM/DMARC can prevent spear phishing/spoofing."

Breakdown 6 — Other capabilities

Capability	Purpose
File integrity monitoring	Alert on changed system files/configs (hash comparison)
DLP	Stop sensitive data leaving
NAC	Health-check devices before granting network access; quarantine VLAN for failures (802.1X-based)
EDR / XDR	Endpoint detection & response; XDR extends across network/cloud/email
User behavior analytics (UBA/UEBA)	Baseline each user; flag anomalies (impossible travel, mass downloads)

Exam tip: "Emails spoofing our domain reach customers" → SPF + DKIM + DMARC reject. "Users bypass the proxy when off-network" → agent-based web filter. "Policy on OU conflicts with domain policy" → OU wins (applied last). "Only allow devices with current AV onto the LAN" → NAC. "Stop hosts from resolving C2 domains" → DNS filtering/sinkhole.

Quick self-check

• GPO order? (Local, Site, Domain, OU.)
• Which record type holds SPF? (TXT.)
• LDAP secure port? (636.)