CYS406 · Annotated SlidesChapter 11 — Network Segmentation and Firewalls
Chapter 11 · Annotated slides

Network Segmentation and Firewalls

Network segmentation and its types, bastion hosts and where to place them, the DMZ, then firewalls: hardware, software and host-based types, packet filtering, circuit-level and application-level gateways, stateful inspection, proxies, NAT, NGFWs, capabilities, limitations and secure deployment.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: Slide 1
Exam weight Low

    Module Objectives

    Understanding Network Segmentation and its Types Understanding the Different Types of Firewalls and their Roles Understanding the Different Types of IDS/IPS and their Roles Overview of Different Types of Honeypots Understanding the Different Types of Proxy Servers and their Benefits Understanding the Fundamentals of Virtual Private Networks (VPNs) and their Importance in Network Security Overview of Security Incident and Event Management (SIEM) and User Behavior Analytics (UBA) Overview of Various Antivirus/Anti-malware Software

    Module Objectives
    2
    Exam weight Low
      Slide 3: Module Flow
      Exam weight Low
        Slide 4: What is Network Segmentation?
        Exam weight Low
        1. Segmentation splits the network into zones so a breach in one doesn’t expose everything (physical, logical/VLAN, network virtualization).
        Slide 5: Types of Network Segmentation
        Exam weight Low
          Slide 6: Types of Network Segmentation (Cont’d)
          Exam weight Low
            Slide 7: Types of Network Segmentation (Cont’d)
            Exam weight Low
              Slide 8: Introduction to Bastion Host
              Exam weight Low
              1. Bastion host: a hardened system exposed to attack, e.g. in the DMZ, running only essential services.
              Slide 9: Need for Bastion Host
              Exam weight Low
                Slide 10: Positioning the Bastion Host
                Exam weight Low
                  Slide 11: Positioning the Bastion Host (Cont’d)
                  Exam weight Low
                    Slide 12: Types of Bastion Hosts: Single-homed
                    Exam weight Low
                      Slide 13: Types of Bastion Hosts: Multi-homed
                      Exam weight Low
                        Slide 14: Types of Bastion Hosts: Internal Bastion Host
                        Exam weight Low
                          Slide 15: Types of Bastion Hosts (Cont’d)
                          Exam weight Low
                            Slide 16: What is Demilitarized Zone (DMZ)?
                            Exam weight High
                            1. DMZ: a buffer network between the internet and the internal LAN that hosts public servers (web, mail, DNS).
                            🎯 How this can come up · 1 question
                            MCQ

                            A company’s public web server should be placed in the:

                            Slide 17: Different Ways to Create a DMZ
                            Exam weight Low
                              Slide 18: Slide 18
                              Exam weight Low
                                Slide 19: Module Flow
                                Exam weight Low
                                  Slide 20: What is a Firewall?
                                  Exam weight Low
                                  1. Firewall: enforces a policy on traffic between networks; default-deny is best practice.
                                  Slide 21: Types of Firewalls: Hardware Firewalls
                                  Exam weight Low
                                    Slide 22: Types of Firewalls: Software Firewalls
                                    Exam weight Low
                                      Slide 23: Types of Firewalls: Host-based and Network-based Firewalls
                                      Exam weight Low
                                        Slide 24: Firewall Technologies
                                        Exam weight Low
                                          Slide 25: Firewall technologies operating at each OSI layer
                                          Exam weight Low
                                            Slide 26: Packet Filtering Firewall
                                            Exam weight Low
                                            1. Packet filter (layer 3/4): checks IPs, ports, protocol of each packet independently. Fast but stateless.
                                            Slide 27: Circuit-Level Gateway
                                            Exam weight Low
                                            1. Circuit-level gateway (session layer): validates the TCP handshake, not the content.
                                            Slide 28: Application Level Gateways
                                            Exam weight Low
                                            1. Application-level gateway (proxy, layer 7): inspects content for specific applications.
                                            Slide 29: Stateful Multilayer Inspection Firewall
                                            Exam weight High
                                            1. Stateful multilayer inspection: tracks connection state and examines multiple layers.
                                            🎯 How this can come up · 2 questions
                                            MCQ

                                            A firewall that tracks the state of connections in a table is a:

                                            MCQ

                                            Which firewall type can inspect HTTP content?

                                            Slide 30: Application Proxy
                                            Exam weight Low
                                              Slide 31: Slide 31
                                              Exam weight Low
                                              1. NAT hides internal addresses behind one public IP.
                                              Slide 32: Virtual Private Network
                                              Exam weight Low
                                                Slide 33: Next Generation Firewall (NGFW)
                                                Exam weight Low
                                                1. NGFW: stateful firewall + deep packet inspection, application awareness, IPS, user identity.
                                                Slide 34: Firewall Capabilities
                                                Exam weight Low
                                                  Slide 35: Firewall Limitations
                                                  Exam weight High
                                                  1. Limitations: can’t stop insider attacks, malware in allowed traffic, social engineering, encrypted payloads it can’t inspect.
                                                  🎯 How this can come up · 1 question
                                                  True / False

                                                  A firewall protects against attacks from inside the network.

                                                  Slide 36: Firewall Implementation and Deployment Process
                                                  Exam weight Low
                                                    Slide 37: Host-based Firewall Protection with Iptables
                                                    Exam weight Low
                                                      Slide 38: Host- based Firewall Protection with Iptables (Cont’d)
                                                      Exam weight Low
                                                        Slide 39: Secure Firewall Implementation: Best Practices
                                                        Exam weight Low
                                                          Slide 40: Secure Firewall Implementation: Recommendations
                                                          Exam weight Low
                                                            Slide 41: Secure Firewall Implementation: Do’s and Don’ts
                                                            Exam weight Low