In this lesson,
we will learn about security boundaries.
Security boundaries are defined by strict access controls
and continuous verification rather than
physical or network perimeters.
The implementation of security boundaries
enables the monitoring and validation
of every cross-network interaction.
Security boundary concepts include system components,
data perimeters, and secure zones.
Let's learn more about these security boundary concepts.
First, we have system components.
System components are the individual elements
that make up an organization's IT infrastructure.
These include servers, workstations, applications,
routers, and databases.
Each of these components needs to be secured
separately to prevent unauthorized access
and keep the system safe.
In a zero-trust model,
no component is trusted automatically,
so every device and application
operates within strict security boundaries.
For example, a web server that handles public requests
should not have direct access
to a sensitive database.
Access to a sensitive database should be controlled
through role-based access controls,
multi-factor authentication, and network segmentation.
System components can be segmented into different zones
based on their role, like handling
credit card transactions or user authentication.
This allows administrators to apply specific
security policies for each component.
For example, credit card systems need encryption
and strict access controls,
while user authentication systems
require strong password management.
Breaking the network into zones means security policies
can be tailored to each system's needs.
It also lets administrators focus
on the security requirements of their assigned zone.
This makes managing the network simpler
because it is divided into smaller,
more manageable sections.
Second, we have data perimeters.
Data perimeters define the boundaries that protect
sensitive information.
They ensure that only authorized users can access data,
whether it's stored on-premise or in the cloud.
These boundaries use encryption, Access Control Lists,
and monitoring to control access.
Sensitive data, like customer records
or employee information,
is protected even as it moves
between different environments.
This type of protection is done with data encryption
and data loss prevention tools
to secure the data in transit and at rest.
In this way, data perimeters ensure that only
specific users can access data.
As more companies move to the cloud,
traditional network perimeters are no longer enough.
Continuous validation of data access requests
is required to protect sensitive information.
For example, organizations can create subzones
within their networks to store sensitive data,
using encryption and monitoring to add extra protection.
Third and last, we have secure zones.
Secure zones are tightly controlled areas within
a network designed to protect critical systems and data.
The most common secure zones are the trusted
internal zone, the untrusted external zone,
and the demilitarized zone, which is also called
a screened subnet.
A screened subnet acts as a buffer
between the internal and external networks.
Inside secure zones, access controls are strict,
allowing only authorized users with verified credentials
to access sensitive resources.
For example, web servers inside the screened subnet
might be accessible from the internet,
while the internal network is shielded
from external threats.
Firewalls enforce strict access rules between
these secure zones, preventing unauthorized traffic
from moving between them.
Organizations often create subzones within secure zones
using subnetting, firewall rules,
and network access control.
For example, an internal zone might be divided
into subzones for workstations, data centers,
or credit card processing systems.
This limits access to sensitive systems to only
those authorized users.
Other secure zone tools include bastion hosts,
which are hardened servers or devices
that are specifically designed
to withstand external attacks.
Bastion hosts are placed in vulnerable areas,
such as outside the internal network
and inside a screened subnet.
This allows control and management of external access
to these more secure systems.
To do this, bastion hosts have minimal services
running on them, and they are configured
with strict security policies to reduce
the risk of compromise.
Next, a jump box is similar to a bastion host,
but a jump box is specifically used to provide
secure administrative access to a system.
So unlike a bastion host, which tightly controls
external access, a jump box acts as a gateway
for administrators to reach systems in secure zones
like a screened subnet.
By requiring administrators to first connect
to a jump box, the exposure of critical systems
is minimized as only authorized users
can pass through those sensitive resources,
such as a jump box, to the server that is being configured.
This setup adds an extra layer of protection
for secure environments.
Some organizations may even use air-gapped networks
for the highest level of isolation.
Air-gapped networks are physically separated
from external connections, preventing any interaction
between internal systems and external threats.
Air-gapped networks are often used in sensitive environments
like nuclear facilities.
However, they require careful management
because data must be physically transferred
to or from them, and strict malware checks are necessary
before devices are connected.
So, proper segmentation through screened subnets,
bastion hosts, or air-gapped systems helps secure
the network while providing manageable zones
to protect sensitive systems and information
from both internal and external threats.
So remember, security boundaries use strict access controls
and constant monitoring
instead of just physical barriers.
These boundaries help track and verify
every interaction within a network.
Key security concepts include system components,
data perimeters, and secure zones.
System components like servers and applications
are secured individually to prevent unauthorized access.
Data perimeters protect sensitive information
by using encryption and monitoring to control access.
Secure zones divide the network into protected areas
where access is tightly controlled and continuously checked
to safeguard critical systems and data.