Home → Cyber Security → Unit IV

Network & System Security

Defensive layers for infrastructure

Network Security

  • Firewalls: packet filters, stateful, NGFW with app-layer controls and IPS.
  • Segmentation: DMZ, internal tiers, VLANs; deny-by-default ACLs between segments.
  • Zero Trust: verify explicitly, least privilege, assume breach; strong identity + device posture.
  • Remote access: VPN or ZTNA; restrict lateral movement with microsegmentation.

Reference Segmentation

[Internet] --FW--> [DMZ: WAF/Proxy]
                  --FW--> [App Tier] --FW--> [DB Tier]
                        ^                         |
                  Admin VPN                  Backup Net

IDS/IPS & Monitoring

  • Detection types: signature (known patterns) vs anomaly/behavior (baselines/ML).
  • Where: NIDS at chokepoints (SPAN/TAP), HIDS/EDR on endpoints/servers.
  • Tools: Suricata/Snort (IDS/IPS), Zeek (network metadata), EDR agents.
  • Respond: block (IPS), rate-limit, isolate host, ticket to IR.

System Hardening

  • Patch OS/apps/firmware; automate with WSUS/SCCM/MDM or config mgmt.
  • Baseline: CIS Benchmarks; disable unnecessary services/ports; secure defaults.
  • Accounts: least privilege, MFA for admins, PAM for secrets, rotate credentials.
  • Protect: Secure Boot, disk encryption (BitLocker/LUKS), EDR, application allow-listing.
  • Audit: enable event auditing (Sysmon/auditd), centralize logs.

Logging & SIEM

Centralize and retain logs; correlate events to detect threats and meet compliance.

  • Sources: auth (AD/LDAP), endpoint (EDR/Sysmon), network (firewall/IDS), DNS, proxy, cloud audit.
  • Practices: time sync (NTP), parse/normalize, use detection rules/playbooks, alert triage (sev 1–3).
  • KPIs: MTTD, MTTR, false positive rate; regular tuning and threat hunting.

Quick Revision

  • Deny by default between network segments; allow only what’s needed.
  • Patch + least privilege + MFA = biggest risk reduction.
  • Collect core logs: auth, DNS, proxy, firewall, EDR; send to SIEM.
  • Place IDS at chokepoints; use EDR for endpoints.