In this section of the course,
we are going to discuss Resilient System Design.
The Resilient System Design section of the course
focuses on Domain 2: Security Architecture,
specifically objective 2.1,
which states that given a scenario,
you must be able to analyze requirements
to design resilient systems.
Designing resilient systems requires the deployment
and integration of advanced security measures,
proactive threat detection,
and efficient traffic management
to protect and optimize operation.
By focusing on ensuring application security,
maintaining availability,
and implementing adaptive scaling and recovery techniques,
enterprise network systems can withstand
and quickly recover from disruption.
As we go through this section,
we will cover many topics
related to Resilient System Design,
including Security Devices,
Monitoring and Detection, Network Traffic Management,
Application Layer Security,
Availability and Scaling Considerations,
as well as Deployment and Recovery Strategies.
First, we will look at Security Devices.
Security devices are hardware or software tools
designed to protect networks and data by enforcing policies
while monitoring for malicious activity.
Security devices include Firewalls,
Intrusion Detection Systems, Intrusion Prevention Systems,
Virtual Private Networks,
and Network Access Control systems.
Let's take a moment to further understand each of these.
Firewalls filter incoming and outgoing traffic
based on predefined security rules
called Access Control Lists.
Access Control Lists applied by firewalls
establish a perimeter that controls access to the network.
Intrusion Detection Systems
and Intrusion Prevention Systems
may be employed to complement firewalls
by monitoring traffic for malicious activities.
An Intrusion Detection System
passively detects and alerts on malicious activity,
while an Intrusion Prevention System
detects, alerts, and actively blocks
or mitigates detected malicious activity.
Another security device is a Virtual Private Network.
Virtual Private Networks secure communication
by encrypting data across untrusted networks.
Finally, Network Access Control appliances enforce policies
to ensure devices meet security and health requirements
before they are granted network access.
The combination and implementation of security devices
creates a layered defense that integrates traffic filtering,
threat detection and prevention, encrypted communication,
and controlled access.
Next, we will explore monitoring and detection.
Overall, monitoring and detection
involves continuously observing network activities
to identify and respond
to security incidents, anomalies, and vulnerabilities.
Monitoring and detection devices
include Text Access Points or TAPs,
Collectors, and Vulnerability Scanners.
Test Access Points are hardware or software devices
used to capture all network traffic in real-time
without interfering with operations.
Next, Collectors aggregate and process captured data,
centralizing it for further analysis,
such as the identification of patterns or anomalies
indicative of security threats.
Finally, Vulnerability Scanners
are used to identify technical
and known weaknesses in systems and applications,
enabling an organization
to proactively address security gaps.
After that, we will look at Network Traffic Management.
Network Traffic Management involves the control, direction,
and optimization of data flow across a network.
Network traffic management tools
include Forward and Reverse Proxies,
as well as Content Delivery Networks.
In these lessons, we will discuss each tool in more detail.
In general, a proxy acts as an intermediary
between two devices or networks,
such as a client and a server.
Both forward and reverse proxies can be used
to mediate incoming and outgoing network traffic.
However, a forward proxy sits on the internal gateway
of the local area network,
where it applies control policies
before forwarding internal client requests
to external destination servers.
In contrast, a reverse proxy
is positioned on the public interface of the network.
It receives incoming requests from external clients,
applies control policies,
and then forwards these requests
to the appropriate internal resources.
Neither forward nor reverse proxies
solve the problem of ensuring content
is quickly and efficiently available on a global scale.
This is done by Content Delivery Networks or CDNs.
Content Delivery Networks
utilize globally distributed reverse proxies
to cache content closer to end-users,
reducing latency and improving load times
to optimize the delivery of content over the globe.
Next, we will explore Application Layer Security.
Application layer security
involves protecting applications
and their data from unauthorized access and attacks.
Furthermore, application layer security
occurs at the highest layer of the OSI model,
the application layer.
Application layer security involves the implementation
of both application programming interface gateways,
or API gateways, and web application firewalls or WAFs.
An Application Programming Interface Gateway
manages and secures
application programming interface requests,
handling tasks such as authentication, rate limiting,
and data delivery to network services.
A Web Application Firewall
filters and monitors web application traffic
to protect against common web application attacks
such as SQL injection and cross-site scripting.
Because a Web Application Framework
is implemented at the application itself,
it can use a very specific and detailed rule set.
Together, Application Programming Interface Gateways
and Web Application Firewalls
create a layered defense for application security.
Following that, we will look at Availability Considerations.
Availability considerations
ensure that systems, applications, and services
remain operational and accessible to users
even in the face of failures, high demand,
or other disruption.
Availability considerations result
in the implementation of load balancing,
using persistent and non-persistent affinity,
as well as interoperability.
Affinity is the practice of redirecting client requests
to the same server to maintain session consistency.
In this topic, we will explore
each availability consideration in greater detail.
Load balancing is used to distribute
incoming network traffic across multiple servers,
ensuring no single server becomes a bottleneck.
At the same time,
load balancers also enhance reliability and performance.
Persistence through session affinity
ensures that user sessions
are consistently routed to the same server
to maintain a session state,
while non-persistence
allows sessions to be handled by any server,
promoting better load distribution,
but potentially complicating state management.
Interoperability, in general, refers to the ability
of different systems or components
to work together seamlessly.
In the context of load balancing and session management,
interoperability means that diverse systems and applications
effectively communicate and function together,
maintaining high availability and efficient performance.
Then, we will explore Scaling Considerations.
Scaling considerations ensure systems
can efficiently handle increased loads or real-time demands.
This can be done through vertical scaling
or horizontal scaling.
Vertical scaling, which can be referred to as scaling up,
expands existing resources.
In the context of availability considerations,
vertical scaling involves
increasing the capacity of a machine
by adding more resources,
such as central processing units or CPUs,
random access memory or RAM, or storage.
This addition improves performance
in response to an increase in real-time demand.
Horizontal scaling,
which can also be referred to as scaling out,
entails adding new resources.
In the context of availability considerations,
horizontal scaling involves adding additional machines
to distribute increased real-time load.
After that, we will look at Recovery Strategies.
Recovery strategies involve planning
and implementing methods
to restore systems and services to operational status
after disruptions or failures.
Recoverability methods include backups
and failover mechanisms
to ensure that systems
can be quickly restored after disruption.
For example, regular backups ensure
that data can be restored in case of corruption or loss,
while failover systems
automatically switch operations to a standby device
if the primary device fails.
Finally, we will explore Deployment Strategies.
Deployment strategies involve planning
and carrying out the process of installing, configuring,
and running software and systems.
Geographical considerations play an important role
in the planning of deployment strategies
and involve strategically placing infrastructure
in dispersed physical locations.
Depending upon the company,
this may mean having locations throughout a country
or even throughout the world.
By placing the infrastructure
in a variety of physical locations,
we can optimize performance, reduce latency,
and enhance network redundancy.
However, placing services or servers in different locations
can lead to compliance issues.
The infrastructure will be subject
to local laws and regulations
which dictate how data can be stored and processed,
which may complicate operations.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So, let's get ready to dive into resilient system design
in this section of the course!