Enterprise infrastructure

This objective is highly technical and practical. CompTIA will put you in the shoes of a network security engineer tasked with placing devices, configuring ports, securing communications, and determining how infrastructure should behave when things fail.

Let’s look at how to apply these enterprise infrastructure principles.

1. Infrastructure Considerations & Device Placement

Where you place a device on a network and how it handles traffic determine its defensive capability.

Security Zones & Attack Surface

• Demilitarized Zone (DMZ): A physical or logical subnetwork that contains and exposes an organization’s external-facing services (like web servers) to the untrusted internet. It acts as a buffer zone, preventing external users from gaining direct access to the internal private network.
• Attack Surface: By grouping resources into distinct zones based on risk (Internal LAN, DMZ, Guest Wi-Fi, Management Network), you significantly reduce the attack surface and prevent lateral movement if a single zone is breached.

Failure Modes: Fail-Open vs. Fail-Closed

When a security device encounters a critical error, loses power, or is overwhelmed by traffic, it must fail in one of two ways:

• Fail-Open: The device drops its security restrictions and allows all traffic to pass through uninspected. This prioritizes Availability over security.
  • Example: A physical access-control vestibule or a fire-exit door losing power. It must unlock automatically (fail-open) so people aren’t trapped inside a burning building.
• Fail-Closed: The device stops all traffic and blocks all access. This prioritizes Confidentiality and Integrity over availability.
  • Example: A corporate firewall crashing. It prevents traffic from flowing entirely, ensuring that no uninspected packets slip into the internal network during the outage.

Device Attributes

• Active vs. Passive: Active devices interact with, alter, or block data streams (like an IPS or Firewall). Passive devices merely listen to, log, or copy data without interfering with the live traffic flow (such as an IDS or a network sniffer).
• Inline vs. Tap/Monitor:
  • Inline: The device sits physically in the middle of the network cable path. All traffic must pass through it, allowing it to block attacks in real time.
  • TAP/Monitor: A network TAP (Test Access Point) or a switch port mirror (SPAN port) copies the live traffic stream and forwards it to a sidecar monitoring device. The monitoring device is completely out of band and cannot stop an attack in real time.

2. Network Appliances

These are the dedicated workhorses deployed across security zones.

• Jump Server (Bastion Host): A hardened, highly secure server that administrators log into before accessing sensitive internal network zones (such as production server environments). An admin cannot SSH or RDP directly to a database server from home; they must first authenticate to the Jump Server and use it as a controlled pivot point.
• Proxy Server: Sits between an internal client and the internet.
  • Forward Proxy: Used to shield internal clients, filter outbound web requests, and cache web pages to reduce bandwidth usage.
  • Reverse Proxy: Sits in front of internal web servers, shielding them from external internet traffic, handling load balancing, and managing TLS decryption.
• IDS vs. IPS:
  • Intrusion Detection System (IDS): Out-of-band (TAP/Monitor). Inspects traffic copies and generates alerts on malicious patterns. Passive.
  • Intrusion Prevention System (IPS): In-line. Inspects live traffic and can immediately drop packets or reset connections to stop an active attack. Active.
• Load Balancer: Distributes incoming network traffic across a cluster of backend servers. This provides high availability and prevents any single server from becoming overwhelmed.
• Sensors: Network- or host-based collectors that gather raw data, traffic metadata, or logs and forward them to a central SIEM or monitoring engine.

3. Port Security & Authentication

Securing the physical or wireless connection points before assigning a device an IP address.

• 802.1X: An IEEE standard for port-based network access control. When a device plugs into an Ethernet wall jack or connects to enterprise Wi-Fi, 802.1X opens a virtual port that only allows authentication traffic. The port remains blocked until a central server validates the device’s identity.
• Extensible Authentication Protocol (EAP): The underlying authentication framework used by 802.1X to securely exchange credentials, tokens, or digital certificates between the client device and the authentication server (such as a RADIUS or TACACS+ server).

4. Firewall Types & Layers

Firewalls filter traffic, but different types inspect data at different layers of the OSI model.

• Layer 4 vs. Layer 7 Firewalls:
  • Layer 4 Firewall: Traditional packet filtering. It only inspects basic network transport headers: Source/Destination IP and Source/Destination Port numbers (e.g., Block traffic coming from 192.168.1.50 trying to use Port 21). It cannot see inside the actual payload.
  • Layer 7 Firewall: Deep Packet Inspection (DPI). It looks at the actual application-level payload data (e.g., distinguishing a legitimate file upload over HTTP from a database command masked as web traffic).
• Next-Generation Firewall (NGFW): Combines a traditional Layer 4 firewall with Layer 7 application awareness, integrated inline IPS capabilities, and real-time threat intelligence feeds into a single appliance.
• Web Application Firewall (WAF): A specialized Layer 7 firewall placed specifically in front of web servers. It is uniquely tuned to look for and block web-based application attacks, such as SQL Injection (SQLi) and Cross-Site Scripting (XSS).
• Unified Threat Management (UTM): An all-in-one security appliance typically designed for small to medium businesses. It packs a firewall, antivirus, content filtering, spam blocking, and VPN capabilities into one cost-effective box.

5. Secure Communication & Access

Protecting traffic as it transits untrusted wide-area networks or remote employee connections.

• Virtual Private Network (VPN): Encapsulates and encrypts network traffic to create a secure, private tunnel over an insecure public network (like the internet).
• Tunneling Protocols:
  • Transport Layer Security (TLS): Used to secure specific application sessions. (e.g., regular HTTPS web traffic or client-to-gateway VPN tunnels such as OpenVPN).
  • Internet Protocol Security (IPsec): A robust suite of protocols for securing IP communications at the network layer. It is widely used to establish permanent, encrypted Site-to-Site VPN tunnels between two physical corporate offices over the internet.
• SD-WAN (Software-Defined Wide Area Network): Uses software-defined networking principles to dynamically route traffic across multiple WAN connections (such as broadband internet, MPLS, or cellular circuits) based on real-time performance and cost. It simplifies corporate branch-office connectivity but requires centralized management of cryptographic policies.
• SASE (Secure Access Service Edge): A cloud-focused architecture that combines SD-WAN networking capabilities with cloud-native security services (such as cloud firewalls, secure web gateways, and Zero Trust Network Access) into a single, unified cloud service. Instead of routing all remote employee traffic back to a physical corporate data center for security checking, SASE inspects traffic right at the cloud edge closest to the user.

6. Selection of Effective Controls

When analyzing a scenario on the exam, you must choose a control that cleanly matches the specific problem statement:

• To stop SQLi or XSS attacks against a web server ➡️ Deploy a WAF.
• To prevent unauthorized physical devices from getting an IP address on an office network ➡️ Configure 802.1X port security.
• To safely inspect incoming web traffic and cache common pages ➡️ Deploy a Forward Proxy.
• To allow external administrative access to a secure network zone ➡️ Establish a Jump Server.