Section 16 – Security Infrastructure Section 16

CompTIA Security Infrastructure

Section 16

🧠 TA Primer – Section 16: Security Infrastructure
🧩 1. What This Section Covers
This is a hardware-centric and topology-aware domain. It teaches you to recognise, deploy, and secure key infrastructure components in networks, systems, and facilities.

🏗️ 2. Core Components to Track
🔹 Security Devices & Tools

Be able to define and distinguish:
• Firewalls (network vs host-based, stateless vs stateful)
• Proxies (forward vs reverse)
• VPN Concentrators
• NIDS/NIPS – Network Intrusion Detection/Prevention
• DLP systems – Data Loss Prevention (email/file filters)
• SIEM – Security Information and Event Management (log aggregation, alerting, correlation)

🔍 TA Tip: For each tool, note:
• What problem it solves
• Whether it’s preventive, detective, or corrective
• Whether it operates at network, host, or application layer

🔹 Infrastructure Hardening
• Harden endpoints, servers, routers
• Disable unused services, apply least privilege, patch regularly
• Security baselines (CIS Benchmarks, STIGs)

🔹 Network Segmentation & Isolation
• DMZs, VLANs, jump boxes
• Air-gapping and control system protection
• Trust boundaries – where data or privilege level changes

🔹 Secure Protocols
You must know when and why to use:
• HTTPS, SSH, SFTP, LDAPS, SNMPv3
• Avoid insecure protocols like FTP, Telnet, SNMPv1/v2

🔹 High Availability and Redundancy
• Load balancers
• Failover systems
• Hot/cold/warm sites

Know why these are needed: to maintain confidentiality, integrity, and availability (CIA).

📌 3. What to Focus On
• Categorise each tool or technique: What problem is it solving? How does it secure the environment?
• Watch for layered security references: Where do tools interact?
• Diagram walkthroughs: Pause and sketch out any network topologies shown — they may appear in exam scenarios.

🎯 4. Optional Real-World Lens
As a Linux IT consultant, pay attention to:
• Which tools you’d deploy on a self-hosted VM network (e.g. UFW, fail2ban, Snort)
• What you’d need to audit or configure on remote client infrastructure

 

 

 

Below is a structured, no-nonsense overview of VPN concentrators as they relate to Security Infrastructure.

1. Definition
A VPN concentrator is a specialized network appliance whose sole purpose is to establish, manage and terminate multiple Virtual Private Network (VPN) tunnels. Unlike general-purpose routers or firewalls, it is optimized for high-volume VPN traffic and advanced cryptographic operations.

2. Core Functions
Tunnel Termination

Aggregates incoming VPN connections from remote users or sites.

Terminates the encrypted sessions (e.g. IPsec, SSL/TLS).

Authentication & Authorization

Validates user credentials (RADIUS, LDAP, certificates).

Applies access policies (who may enter which segment of the network).

Key Management

Handles the exchange and rotation of cryptographic keys (IKE, SSL handshakes).

Traffic Routing & Encryption

Directs decrypted traffic into the internal network.

Re-encrypts traffic when acting as an intermediary (site-to-site scenarios).

3. Why Not Just a Firewall or General-Purpose Router?
Performance: Hardware acceleration for encryption/decryption, reducing CPU bottlenecks.

Scalability: Designed for thousands of simultaneous tunnels; general routers may falter under heavy load.

Feature Set: Integrated logging, granular policy controls, and high-availability clustering.

4. Deployment Models
Remote-Access VPN

Employees, contractors, partners connect from arbitrary locations.

Concentrator sits at the datacentre perimeter.

Site-to-Site VPN

Bridges entire branch offices or partner networks.

Often paired with a redundant concentrator for failover.

5. Key Considerations
High Availability: Active/standby or active/active clustering to avoid single points of failure.

Throughput Requirements: Match aggregate encrypted throughput to anticipated load (e.g. 10 Gbps+ in modern enterprises).

Cryptographic Agility: Support for rising standards (e.g. AES-GCM, SHA-2 families, post-quantum readiness).

Integration: Compatibility with existing identity stores and network-access control (NAC) solutions.

Monitoring & Auditing: Centralized logging and real-time alerts for abnormal VPN patterns.

6. Dry Reality Check
“Buying a VPN concentrator and simply turning it on does not magically render your network invulnerable. You still need rigorous configuration, patch management, and ongoing auditing.”

In Summary
A VPN concentrator is your heavyweight champion for terminating and managing VPN sessions at scale—think of it as a bespoke suit: tailored for encryption, authentication and high-availability, rather than the off-the-rack general-purpose router. It must be integrated, maintained and monitored with the same discipline you apply to the rest of your security infrastructure.

 

 

 

what are DLP systems – Data Loss Prevention (email/file filters) ?

ChatGPT said:
Below is a disciplined overview of Data Loss Prevention (DLP) systems, with emphasis on their role in filtering email and file traffic.

1. Definition
A Data Loss Prevention (DLP) system is a security solution designed to detect, prevent and monitor the unauthorized transmission of sensitive information outside an organization’s trusted boundary. It operates by inspecting data in motion (network traffic), data at rest (storage), and data in use (endpoints).

2. Core Components & Functions
Content Discovery

Scans repositories (file shares, databases, cloud storage) to locate sensitive data (e.g., PII, intellectual property).

Content Inspection

Deep-packet inspection of network traffic, including email attachments and file transfers, to identify policy violations.

Techniques: pattern matching (regular expressions), file fingerprinting, contextual analysis.

Policy Enforcement

Block or Quarantine: Prevents emails or file transfers that violate policy from being transmitted.

Encrypt: Automatically applies encryption when sensitive data is detected in transit.

Warn or Educate: Generates user-facing prompts (“Are you sure you want to send this?”) or delivers inline guidance.

Logging & Reporting

Centralized audit trails of all incidents, actions taken, and user overrides.

Dashboards for compliance reporting (e.g., GDPR, HIPAA).

3. Deployment Models
Network-Based DLP

Inline appliances or virtual sensors that inspect email (SMTP, IMAP, Exchange) and file transfer protocols (FTP, HTTP/S, SMB).

Endpoint-Based DLP

Agents installed on laptops/desktops to monitor data copied to USB drives, printed, or shared via local applications.

Cloud-Based DLP

API-integrated solutions for SaaS platforms (Office 365, Google Workspace, Box) that enforce policies in the cloud.

4. Use Cases: Email & File Filters
Email DLP

Scans message body and attachments for credit card numbers, social-security numbers, proprietary signatures.

Prevents accidental or malicious data exfiltration via outbound mail.

File-Transfer DLP

Monitors uploads to web portals, FTP sites or peer-to-peer applications.

Blocks sensitive documents from leaving the network or flags for review.

5. Key Considerations
False Positives vs. False Negatives

Overzealous policies frustrate users; lax policies miss actual risks. Rigorous tuning and periodic review are mandatory.

Performance Impact

Inline inspection can introduce latency; ensure hardware or virtual capacity matches transaction volume.

Encryption Interference

Encrypted tunnels (TLS/SSL, VPN) may blind DLP sensors; consider SSL-decryption or endpoint agents.

Regulatory Alignment

Tailor policies to specific compliance regimes (e.g., PCI DSS requires tracking of PAN usage).

User Experience

Balance security with productivity: leverage step-up authentication or user-education flows rather than outright blocks where feasible.

6. Dry Reality Check
“Installing a DLP appliance and forgetting about it is like locking your vault but leaving the combination taped to the door. Continuous policy maintenance is non-negotiable.”

In Summary
DLP systems act as gatekeepers for your organization’s crown jewels—inspecting, blocking, encrypting or flagging sensitive content as it moves through email and file-transfer channels. Their effectiveness hinges not only on the technology itself but on disciplined policy management, performance planning and user-centric design.

 

 

what are Hot/cold/warm sites ?

ChatGPT said:

Below is a structured, no-nonsense overview of hot, warm and cold recovery sites as they pertain to business continuity and disaster-recovery planning.

1. Definitions
Hot Site

A fully configured, mirror-image facility that can take over operations with minimal to no data loss.

Equipped with live hardware, up-to-date data replication, network connectivity and pre-installed applications.

Warm Site

A partially configured facility with pre-installed hardware and network connectivity but without continuously synchronized data.

Requires loading of recent backups or restoration of data before it becomes fully operational.

Cold Site

A basic facility providing space, power and environmental controls only.

No active hardware or data; equipment must be delivered and configured, and data restored from off-site storage.

2. Key Characteristics
Characteristic Hot Site Warm Site Cold Site
Recovery Time (RTO) Minutes to a few hours Several hours to days Days to weeks
Data Currency (RPO) Near zero (continuous replication) Last nightly/weekly backup Last full backup (days old)
Cost Highest (dedicated, fully mirrored) Moderate Lowest
Maintenance Overhead Continuous sync & testing Periodic testing & backup loading Minimal (facility only)
Ready-to-Use Always online and up to date Requires data load & some setup Requires full installation & setup

3. Pros & Cons
Hot Site

Pros: Minimal downtime, minimal data loss.

Cons: Very high implementation and operational cost; complex maintenance.

Warm Site

Pros: Balance between cost and recovery speed; hardware ready in advance.

Cons: Data lag may exist; still incurs moderate expenses and setup time.

Cold Site

Pros: Lowest cost; simple to maintain.

Cons: Long downtime and significant data loss; extensive setup delays.

4. Selection Considerations
Business Impact Analysis (BIA): Quantify acceptable downtime (RTO) and data loss (RPO) for each application.

Budget Constraints: Align site choice with cost-benefit analysis.

Regulatory Requirements: Some industries mandate specific recovery objectives.

Testing and Validation: Even a cold site demands periodic drills to verify space, power and networking capabilities.

Geographic Diversity: Site isolation from primary location’s risk zone (natural disasters, power grid failures).

5. Dry Reality Check
“Choosing the cheapest option without regard to your actual recovery requirements is like buying a fire extinguisher for show—you’ll regret it when the flames are real.”

In Summary
Hot, warm and cold sites represent tiers of disaster-recovery readiness: from “always on” mirror facilities (hot) through “semi-prepared” environments (warm) down to “space-only” readiness (cold). Your organization’s acceptable downtime, data-loss tolerance and budget must drive the decision—and ongoing testing and maintenance are non-negotiable.

 

 

 

whats the difference between Proxies (forward vs reverse)?

ChatGPT said:
Below is a disciplined comparison of forward and reverse proxies, highlighting their roles, distinctions and typical use cases.

1. Definitions
Forward Proxy

An intermediary that sits between internal clients and the external Internet.

Clients explicitly configure their applications (or network) to send requests to the proxy, which then fetches resources on their behalf.

Reverse Proxy

An intermediary that sits between external clients and one or more internal servers.

External clients connect “blindly” to the proxy’s address; the proxy then routes requests to the appropriate backend server.

2. Core Functions
Aspect Forward Proxy Reverse Proxy
Primary Direction Client → Proxy → Internet Internet → Proxy → Internal Server(s)
Client Awareness Client must be configured to use proxy Client is unaware of backend servers; uses proxy’s address transparently
Use Cases • Bypass geo-blocks or content filters
• Enforce corporate Internet policy
• Caching of external content • Load balancing across servers
• SSL/TLS termination
• Web application firewall (WAF)
• CDN edge caching
Authentication Can enforce user authentication for outbound requests Can authenticate incoming users before forwarding
Anonymity Masks internal client IP from external sites Masks backend server IPs from external clients

3. Typical Deployment Scenarios
Forward Proxy

Corporate Internet Gateway

Controls employee browsing, caches frequently accessed sites, logs traffic.

Privacy/Anonymity Tools

Users route traffic through a forward proxy (e.g., Tor exit node, VPN gateway) to hide their origin IP.

Reverse Proxy

High-Availability Web Services

Distributes HTTP(S) requests among a pool of web servers, ensuring even load and failover.

SSL Offloading

Terminates SSL/TLS at the proxy to reduce cryptographic load on backend servers.

Security Hardening

Applies WAF rules, request filtering and DDoS mitigation before traffic reaches servers.

4. Key Considerations
Configuration Complexity

Forward proxies require client-side configuration or transparent proxying via network routing.

Reverse proxies require DNS changes (point domain to proxy) and backend server definitions.

Performance Impacts

Both can cache content; reverse proxies often yield greater cache hit rates for popular site resources.

Security Implications

A compromised forward proxy can expose client browsing history.

A compromised reverse proxy can expose or disrupt all backend services.

Logging and Monitoring

Forward proxies log outbound requests for compliance.

Reverse proxies log inbound requests for analytics, intrusion detection and forensics.

5. Dry Reality Check
“Slapping a proxy in front of your network or servers without proper access policies, monitoring and tuning is like installing a security camera that nobody watches.”

In Summary
Forward Proxy = gatekeeper for internal clients to reach the outside world, enforcing policy, caching and anonymity.

Reverse Proxy = façade for your internal servers to handle load distribution, SSL offloading, security inspection and high-availability.

Select and configure the appropriate proxy type based on whether you need to control outbound client traffic or manage inbound service requests—with rigorous policy and monitoring to avoid turning your proxy into a single point of failure.

 

 

 

 

 

 

Ports 0-1023 Well Known Ports

eg https 443

ftp 21

telnet 23

ssh 22

1024-49151 Registered Ports – registered with IANA by vendors for their own use ie their software/services

eg

SQL 1433

RDP 3389

49152 to 65535 Dynamic and Private ports

commonly used for gaming, IM and chats

Need to know

Port number, name of service, and what it does, and if its TCP or UDP

exam q: dont use telnet 23 – insecure

 

SMTP simple mail transfer protocol 25

53 DNS – is TCP AND UDP

69 TFTP – UDP!

80 HTTP TCP

88 – Kerberos, network auth protocol uses UDP

110 POP Post office protocol version 3 TCP

119 NNTP newsgroups TCP

135 RPC used TPC and UDP remote procedure call esp used by windows

137/138/139 Network network protocol suite for windows

143 TCP IMAP inet message access protocol for email

161 SNMP network management protocol UDP!!

162 SNMP Traps UDP

389 LDAP TCP

443 HTTPS TCP

445 SMB windows esp TCP

465/487 SMTPS secure SMTP communic for emails TCP

514 UDP for Syslog

636 LDAPS LDAP secure SSL/TLS using TCP

993 TCP for IMAPS secure IMAP using SSL/TLS

995 POP3S secure POP TCP

1433 TCP MS SQL

1645/46 RADIUS TCP for remote auth, and accounting

1812/1813 RADIUS UDP for auth

3389 Remote Desktop Protocol RDP MSwin esp TCP

6514 TCP secure TLS Syslog

 

Firewalling

 

access policy can be

implicit deny

or explicit allow

explicit allow – easier operational, but less safe
implicit deny is safer! but can cause operating problems in practice, more overhead to maintain

PAcket filtering level 4 FW

Stateful inspection level 7 FW

UTM unified threat management many functions but not all like with NGFW

NGFW next gen FW, combines multiple functionality into a single device

WAFW Web Application Firewall just for webserver traffic

FWs use ACLs access control lists

 

Network appliances:

can include

load balancers

proxy servers

sensors

jump servers

Port Security: can link MACs to specific switch ports – can learn by itself

 

 

802.1x used portbased authentication (RADIUS or TACACS+ ) very secure

EAP: is extensible authentication protocol – not one protocol but a whole suite

eg

covers passwords, public key infra, digital certificates

EAP- MD5/TLS/FAST/TTLS/LEAP/PEAP

MD5: simple passwds, challenge/auth method, very simple, requires strong passwords, only one way auth,

TLS: transport layer system: uses a certificate for both server AND client – immune from password attack – both client and server are subject to authentication

TTLS – only server requires a certificate – but less secure than TLS

FAST Flexible Authentication via Fast Tunnelling

PEAP: Protected EAP: supports mutual auth, uses MS Directory DB as well

LEAP: is a cisco, only works with cisco devices, Lightweight EAP

 

 

Full tunnel VPN: maximizes security, all traffic is encrypted – all clients and server/other nodes in the VPN

split tunnel VPN: divides traffic and network requests dep on whether its for your vpn server or other vpn member, but non-VPN traffic will go out unencrypted: but less secure… an intruder could come in via the unencrypted part and then access your VPN section…but it does mean better network traffic performance

 

you should always use full tunnel in public wifi etc

 

there is a third type: clientless VPN

uses a web-browser alone – eg HTTPS!

for video you can use DTLS for protection – datagram TLS

IPSec: Internet Protocol Security

IPSec is better than all the above: it is being used more and more

uses data encryption, integrity using hash digests on sending and receiving, authentication for sender and user, anti-replay checking tcp packet sequence

IPSec goes through an Internet Key Exchange IKE before transferring data, then tunnel termination at the end.

it creates a tunnel within a tunnel!!

with IKE1 and IKE2

 

so, VPNs can use TLS or IPSec – can be transport mode – usually transport mode for client to site, and tunneling mode for site to site,

 

 

Software Defined WAN: SD-WAN:

a virtual wan architecture

a software based wan architecture regardless of underlying hardware.

we can use

MPLS
celluar connection

microwave link

broadband internet

uses a central control function to route the traffic over the SD-WAN

 

 

SASE: Secure Access Service Edge