Enterprise security

This objective focuses on taking action. CompTIA will place you in a scenario in which an active threat, a compliance gap, or an architectural weakness is identified, and you must select or configure the appropriate technical control to remediate the issue.

1. Network Boundary Controls

Modifying perimeter and internal traffic filters to block or inspect malicious payloads.

Firewalls & Screened Subnets

• Firewall Rules & Access Lists (ACLs): Rules are processed from the top down on an implicit deny basis (if traffic doesn’t explicitly match a permit rule, it is dropped).
  • Scenario Action: If an indicator shows a local database server is beaconing out to a known malicious IP on Port 443, you must immediately inject a specific outbound Deny ACL rule targeting that destination IP at the top of the firewall rule base.
• Screened Subnets (formerly DMZ): A perimeter network segment isolated by firewalls that contains external-facing services. This restricts public internet users to the screened subnet and completely blocks them from directly reaching the internal private network.

IDS/IPS: Signatures vs. Trends

• Signatures: Explicit, predefined digital patterns that match known malware strings or exploit code.
  • Scenario Action: If a new critical exploit is published for a network protocol, you must update the IPS signature database immediately to drop matching packets at the perimeter.
• Trends (Behavioral/Anomaly): Establishing a baseline of normal network behavior and alerting when a pattern deviates sharply from that trend.
  • Scenario Action: An internal system suddenly starts generating 10,000 requests per minute to an internal server. The IPS flags this trend deviation as a potential lateral worm propagation or network scan and throttles the traffic.

2. Content & Web Filtering

Controlling user web traffic to prevent malware downloads and block access to malicious domains.

• Deployment Methods:
  • Centralized Proxy: All enterprise web traffic is explicitly routed through an internal proxy server that decrypts, inspects, and logs web requests at a single, centralized choke point.
  • Agent-Based: Security software installed directly on the endpoint handles web filtering locally. This ensures web policy remains active even when a laptop leaves the office network and connects to public Wi-Fi without a VPN.
• Filtering Mechanisms:
  • URL Scanning & Content Categorization: Dynamically inspecting a requested web address and matching it against classified databases. Administrators enforce block rules on high-risk categories (e.g., Gambling, Torrenting, Adult Content).
  • Reputation: Assigning a real-time risk score to external domains based on historical threat data. If a domain was registered 10 minutes ago, its reputation score will be extremely poor, and the filter will block it automatically.
• DNS Filtering: Intercepting web requests during DNS resolution. If a user clicks a phishing link pointing to malicious-site.com, the DNS filter checks the domain before an IP routing connection is ever established. It redirects the request to a secure corporate landing page stating that access is blocked, completely neutralizing the attack vector.

3. Host-Based Security & Policy Enforcement

Modifying configuration baselines directly within operating systems to resist exploitation.

• Group Policy (GPO): A Microsoft Active Directory feature that allows administrators to centrally enforce security configurations across thousands of Windows endpoints simultaneously.
  • Scenario Action: To mitigate a local password-cracking threat, an administrator uses a GPO to push a mandatory account lockout threshold, disable local USB mass storage execution, or enforce a minimum 14-character password length company-wide.
• SELinux (Security-Enhanced Linux): A kernel-level architecture that enforces Mandatory Access Control (MAC) on Linux operating systems. It confines processes to specific, highly restricted security contexts. Even if an attacker compromises a web server application running as the root user, SELinux prevents that process from reading or writing files outside its explicit application directory.

4. Implementation of Secure Protocols

Replace clear-text, legacy protocols with cryptographically sound alternatives. Secure implementation requires modifying both the transport method and the port selection:

Insecure Protocol (Clear-Text)	Secure Replacement	Port	Transport / Encryption Layer
HTTP (Web)	HTTPS	443	TLS
Telnet (Remote Access)	SSH	22	Asymmetric/Symmetric Hybrid
FTP (File Transfer)	SFTP	22	SSH-based
LDAP (Directory Access)	LDAPS	636	TLS
DNS (Name Resolution)	DoH / DoT	443 / 853	HTTPS Tunnel / TLS Tunnel

5. Email Security Frameworks

Email authentication frameworks are implemented by adding specific text records to your public DNS server. Together, they block phishing and brand spoofing.

• SPF (Sender Policy Framework): A public DNS text record in which an organization publishes an explicit list of authorized IP addresses and servers permitted to send email on behalf of their domain name. Receiving email servers check this record to verify if the sending IP is legitimate.
• DKIM (DomainKeys Identified Mail): Adds a cryptographic digital signature to the header of outbound emails. The sending server signs the email with a private key, and the receiving server validates the signature using the organization’s public key published in their DNS records. This guarantees the email was not tampered with in transit (Integrity).
• DMARC (Domain-Based Message Authentication, Reporting, and Conformance): A comprehensive framework that tells receiving email servers exactly what to do if an incoming message fails either SPF or DKIM checks.
  • DMARC Actions: Administrators can set the policy to none (monitor only), quarantine (send to the spam folder), or reject (completely block the delivery of the spoofed email).
• Email Gateway: A physical or cloud-based appliance that processes all inbound and outbound email traffic. It strips out known malicious attachments, sanitizes tracking links, and runs anti-spam algorithms before messages reach the user’s inbox.

6. Enterprise Detection & Response Platforms

These advanced security layers provide real-time behavioral insights and automated threat isolation capabilities.

• File Integrity Monitoring (FIM): A tool that continuously monitors critical operating system and application configuration files (such as hosts files or boot registries) for unauthorized changes. It computes hashes of the files at rest; if a local process or malware alters a single bit of a monitored file, FIM triggers an immediate high-priority alert.
• DLP (Data Loss Prevention): Deployed to intercept and block the unauthorized transmission of sensitive data. If a local endpoint DLP agent detects an employee attempting to copy thousands of proprietary source code files onto a personal USB drive, it blocks the system execution and quarantines the transaction.
• NAC (Network Access Control): A system that evaluates a device’s health and identity before allowing it to join the network.
  • Scenario Action: When a laptop plugs into an office Ethernet port, the NAC scans it. If it detects that the laptop’s antivirus agent is disabled or has critical patches missing, the NAC restricts it to an isolated Quarantine VLAN with no network access until the issues are remediated.
• EDR vs. XDR:
  • EDR (Endpoint Detection and Response): A continuous monitoring tool installed on hosts that goes far beyond traditional antivirus. It records process executions, memory manipulations, and network connections. If malicious behavior is detected, it allows analysts to instantly isolate the endpoint from the network.
  • XDR (Extended Detection and Response): Takes EDR functionality and expands it across multiple telemetry vectors. It aggregates data seamlessly from endpoints, network firewalls, cloud tenants, and email gateways into a single native correlation plane, providing holistic visibility into advanced, multi-stage attacks.
• User Behavior Analytics (UBA/UEBA): A system that tracks normal data usage and access patterns for each human user account. It creates an identity baseline; if an administrative account that normally accesses 10 files a day suddenly downloads 4,000 files at 2:00 AM from an unusual IP address, UBA flags the anomalous behavior as a potential insider threat or compromised credential.