Chapter 11: Given a scenario, Apply Security Principles to Secure
Enterprise Infrastructure
1. Overview
Securing enterprise infrastructure involves applying security principles to ensure data
protection, secure communication, and resilience against cyber threats. This includes careful
device placement, the creation of security zones, monitoring, and managing attack
surfaces.
2. Infrastructure Considerations
• Align security measures with the organization’s risk profile and business needs.
• Use a defense-in-depth strategy with layered protections.
• Ensure adaptability to emerging trends like cloud computing, remote work, and IoT.
3. Device Placement
• Network divided into zones: LAN (trusted), DMZ (screened subnet), and WAN
(untrusted).
• Place devices based on their security role:
o WAN: Routers, ACLs – connected to the internet.
o DMZ: Proxy servers, load balancers – accessible by both internal and external
networks.
o LAN: Internal resources like databases and application servers – protected zone.
• Use firewalls between zones for double-layer traffic inspection.
4. Security Zones
Security zones are segmented areas within a network, each with defined security policies,
access controls, and trust levels. They help protect sensitive data and isolate potential threats.
Key Features:
• Segmentation: Divides the network based on user roles, data sensitivity, or device
types to limit access and exposure.
• Access Control: Each zone enforces specific policies. For example:
o DMZ (Demilitarized Zone): Allows limited external access (e.g., to web
servers).
o LAN (Local Area Network): Trusted internal zone, accessible only by
authorized employees.
• Data Protection: Critical data is encrypted, stored centrally (not on end devices), and
protected using tools like Full Disk Encryption (FDE) and Data Loss Prevention
(DLP).
• Monitoring: Uses tools like SIEM (Security Information and Event Management)
and SOAR (Security Orchestration, Automation, and Response) for real-time
monitoring, logging, and automated responses.
• Isolation: Prevents lateral movement of threats within the network, containing
incidents quickly.
1
• Compliance: Meets regulatory requirements (e.g., HIPAA, PCI DSS) by protecting
sensitive data.
• Operational Efficiency: Simplifies security management by organizing the network
into manageable segments.
• Defense-in-Depth: Forms part of a layered security approach to enhance protection.
Security zones enhance overall network security by creating boundaries that control traffic,
limit risk, and support effective incident response.
5. Attack Surface
The attack surface refers to all the possible points where an unauthorized user (attacker) could
try to enter or extract data from a system. A larger attack surface increases the risk of security
breaches.
Key Components of the Attack Surface:
• Endpoints: Devices like computers, smartphones, and IoT devices can be exploited
through vulnerabilities in OS or applications.
• Network Services: Exposed services (e.g., web, email, VPN) can be entry points if
poorly configured or unpatched.
• Ports and Protocols: Open or unnecessary ports can be exploited for unauthorized
access.
• User Accounts and Credentials: Weak passwords or stolen credentials allow attackers
easy access.
• Third-party Integrations: External apps and services may introduce vulnerabilities.
• Cloud Services: Misconfigured cloud resources can expose sensitive data.
• Human Factor: Untrained employees may unintentionally create vulnerabilities (e.g.,
phishing attacks).
Attack Surface Minimization Strategies:
• Vulnerability Assessment: Regularly scan and patch vulnerabilities.
• Access Control: Use least privilege principle; restrict permissions to necessary access
only.
• Network Segmentation: Divide the network into isolated segments to prevent lateral
movement.
• Redundancy & Resilience: Avoid single points of failure; ensure alternative
paths/devices.
• Security Updates: Keep all software and devices patched and disable unused services.
• Strong Authentication: Enforce strong passwords and use Multi-Factor
Authentication (MFA).
• Auditing & Monitoring: Perform regular audits, penetration tests, and monitor for
anomalies.
• Security Awareness Training: Educate employees to recognize threats and follow best
practices.
Minimizing the attack surface significantly enhances the security posture of an organization by
reducing the number of exploitable vulnerabilities.
2
6. Connectivity
• Ensure secure, scalable, and resilient connectivity across all network areas.
• Account for remote access, redundancy, and security in network design.
• Address increasing complexity with centralized management.
7. Failure Modes
• Fail-Closed: Default to secure (closed) state during failure (e.g., locked door) – more
secure.
• Fail-Open: Default to open state – risk of unauthorized access.
• Choosing the right failure mode is critical to maintaining security even during outages.