Module 11 Exploring Secure Topologies

1. Module 11 Exploring Secure Topologies • MModified by :Ahmad Al Ghoul • PPhiladelphia University • FFaculty Of Administrative & Financial Sciences • BBusiness Networking & System Management Department • RRoom Number 32406 • EE-mail Address: ahmad4_2_69@hotmail.com Ahmad Al-Ghoul 2010-2011

2. Module Objectives • List different types of security zones • Explain the Intranet and its security issues • Explain the Extranet and its security issues • Identify uses for virtual private networks (VPNs) Ahmad Al-Ghoul 2010-2011

3. Security Zones • Organizations often create security zones by placing firewalls between internal and external networks. Multiple firewalls are often used to create multiple layers of protection between the internal and external networks, as previously discussed. Some network designs place a network segment between two firewalls. This network segment between the firewalls is called a perimeter network (also known as a DMZ, demilitarized zone, or screened subnet). The creation of a perimeter network creates a division of the network infrastructure into three separate subordinate network structures called security zones. Security zones help organizations classify, prioritize, and focus on security issues based on the services that are required in each zone. These security zones are as follows: Ahmad Al-Ghoul 2010-2011

4. Intranet & Extranet • Intranet. • The organization's private network; this is used by employees and those internal to the organization (such as contractors and on-site partners). • Perimeter network. • Used to provide services to users on the Internet and sometimes those inside the organization. • Extranet. • Depending on the security devices used and the network layout, the external network might be called a wide area network (WAN), Internet, public network, or untrusted network. For example, some three-pronged firewalls label the external network connection as a WAN, and others as the Internet. Ahmad Al-Ghoul 2010-2011

5. Intranet The security zone closest to the company is called the intranet. This is also known as the internal network, private network, local area network (LAN), trusted network, protected network, and company or organizational network. The intranet is typically the network (or networks) that contains most of the organization's private resources, including computers, users, data, printers, and other network infrastructure equipment. Organizations typically don't expect malicious attacks from their own intranets. This is why this security zone is often considered the trusted network. However, former and current employees and contractors might attack resources on the intranet. Intranet users could wittingly or unwittingly install viruses, and they could also try to access or spy on confidential resources. Additionally, internal users probably have access to some part of or possibly the entire physical network. Physical access could enable users to unplug equipment, destroy equipment, or attach unauthorized devices to the network. Security for the intranet security zone typically includes the following measures: Ahmad Al-Ghoul 2010-2011

6. Intranet • Firewall protection from the external network and the perimeter network • Installing and updating virus-scanning software • Observing and auditing confidential resources • Using host-based firewalls for computers that maintain confidential data • Documenting and auditing the physical infrastructure and critical systems configurations to ensure there are no unauthorized devices or connections • Restricting and monitoring access to critical systems, services, and confidential information • Removing unnecessary services from mission-critical servers Ahmad Al-Ghoul 2010-2011

7. Extranet Another security zone that is optionally created by an organization is known as an extranet. The extranet is typically used for partner access to resources. For example, the United Nations has an extranet that provides secure access to shared resources for the various member nations. Extranets are similar to perimeter networks in that they are semisecure zones. The purpose of an extranet is to share information and technology between members of multiple organizations. Extranets are typically created using VPN connections, which are encrypted connections that can be used on a private or public network. Two VPN servers or a VPN client and a VPN server can create a VPN connection. The two devices utilize an agreed-on encryption method to implement a secure encrypted connection with one another. If two servers implement the VPN, they can encrypt communication between two points. The next Figure shows an example of two partner networks connected by two VPN servers. Ahmad Al-Ghoul 2010-2011

8. Ahmad Al-Ghoul 2010-2011

9. Extranet • Two intranets, two perimeter networks, or one of each can be used to create the extranet. The idea is that the two connected networks are used to share resources between the partner organizations. Some organizations implement multiple perimeter networks to handle such configurations. The first perimeter network is used to provide services to Internet users and the second is used to provide extranet services to partner organizations, as shown in the next Figure . Security for the extranet security zone typically includes the following components: • Firewall protection from the external network • Limiting the services provided and removing all unnecessary services • Auditing of all services • Use of VPN connections Ahmad Al-Ghoul 2010-2011

10. 25070 Ahmad Al-Ghoul 2010-2011