Secure architectures
Defence in depth, the dual-firewall DMZ, the bastion, sensors, the SIEM, the SOC that watches, the CERT that responds, and the six stages of incident response.
- 25 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- Scenarios
A few cards from the deck
Defence in depth: what is it?
Show the answer
Stacking independent protections, so that the failure of one does not open up the whole system.
Firewall, segmentation, patches, minimal rights, detection and backups complement each other. The same failure or configuration mistake must not bypass them all.
What is the difference between an IDS and an IPS?
- The IDS alerts without acting, the IPS sits inline and blocks suspicious traffic
- The IDS monitors workstations whereas the IPS only monitors the network
- The IDS detects known attacks, the IPS only detects unusual behaviour
- The IDS is a hardware appliance and the IPS software installed on each server
Show the answer
The IDS alerts without acting, the IPS sits inline and blocks suspicious traffic
The difference is the ability to act. An IPS may wrongly block legitimate traffic (false positive) and interrupt production, hence an IDS when you only want to observe.
The six stages of incident response: preparation, …, …, eradication, …, lessons learned.
Show the answer
The six stages of incident response: preparation, detection, containment, eradication, recovery, lessons learned.
Containment comes before eradication: cutting the attacker's access prevents spread, before finding and removing everything left behind.
DMZ: what is it?
Show the answer
An intermediate zone between the Internet and the internal network, which hosts the servers reachable from outside.
With two firewalls, a compromised DMZ server does not open the internal network: the inner firewall refuses almost everything coming from the DMZ, and ideally comes from a different product than the first.