Hey, welcome back. In the last lesson,
we covered network hardware hardening security measures.
Which you should be aware of as an IT support specialist.
Now, we're going to shift to network software hardening techniques.
Just like with network hardware hardening,
it is important for you to know how to implement network software hardening,
which includes things like firewalls, proxies, and VPNs.
These security software solutions will play
an important role in securing networks and their traffic for your organization.
Like we mentioned before,
firewalls are critical to securing a network.
They can be deployed as dedicated network infrastructure devices,
which regulate the flow of traffic for a whole network.
They can also be host-based as software that runs on
a client system providing protection for that one host only.
It's generally recommended to deploy both solutions.
A host-based firewall provides protection for
mobile devices such as a laptop that could be used in an untrusted,
potentially malicious environment like an airport Wi-Fi hotspot.
Host-based firewalls are also useful for protecting other hosts from being compromised,
by corrupt device on the internal network.
That's something a network-based firewall may not be able to help defend against.
You will almost definitely encounter host-based firewalls
since all major operating systems have built in ones today.
It's also very likely that your company will have some kind of network-based firewall.
Your router at home even has a network-based firewall built in.
VPNs are also recommended to provide
secure access to internal resources for mobile or roaming users.
We went over the details of VPNs and how they work in securing network traffic.
If you need a refresher,
feel free to revisit that again.
We won't go back over all the details,
but here's a quick rundown.
VPNs are commonly used to provide secure remote access,
and link two networks securely.
Let's say we have two offices located in buildings that are on opposite sides of town.
We want to create one unified network that would let users in each location,
seamlessly connect to devices and services in either location.
We could use a site to site VPN to link these two offices.
To the people in the offices,
everything would just work.
They'd be able to connect to a service hosted in
the other office without any specific configuration.
Using a VPN tunnel,
all traffic between the two offices can be secured using encryption.
This lets the two remote networks join each other seamlessly.
This way, clients on one network can access devices on the
other without requiring them to individually connect to a VPN service.
Usually, the same infrastructure can be used to allow
remote access VPN services for individual clients
that require access to internal resources while out of the office.
Proxies can be really useful to protect client devices and their traffic.
They also provide secure remote access without using a VPN.
A standard web proxy can be configured for client devices.
This allows web traffic to be proxied through
a proxy server that we control for lots of purposes.
This configuration can be used for logging web requests of client devices.
The devices can be used for logs,
and traffic analysis, and forensic investigation.
The proxy server can be configured to block content that might be malicious,
dangerous, or just against company policy.
A reverse proxy can be configured to allow
secure remote access to web based services without requiring a VPN.
Now, as an IT. support specialist,
you may need to configure or maintain a reverse proxy service as an alternative to VPN.
By configuring a reverse proxy at the edge of your network,
connection requests to services inside the network coming from outside,
are intercepted by the reverse proxy.
They are then forwarded on to
the internal service with the reverse proxy acting as a relay.
This bridges communications between
the remote client outside the network and the internal service.
This proxy setup can be secured even more
by requiring the use of client TLS certificates,
along with username and password authentication.
Specific ACLs can also be configured on the reverse proxy to restrict access even more.
Lots of popular proxy solutions support a reverse proxy configuration like HAProxy,
Nginx, and even the Apache Web Server.
You can read more about these popular proxy solutions in the supplemental readings.
Next up, let's take a practice quiz to
secure the network architecture terms we've just discussed.
Google
