Capítulo 4 de 514% del examen
Network Security
Security protects the network's confidentiality, integrity, and availability. This chapter covers access control, common attacks and defenses, secure network design, and authentication. It stresses layered defenses and least-privilege principles that limit the impact of any single failure.
Access Control and Authentication
Access control determines who can use resources and to what extent. Authentication verifies identity, ideally with multiple factors, before granting access. Port-based control and central authentication servers enforce policy at the network edge.
Apply least privilege
Grant only the minimum access needed to limit damage from compromise.
Use role-based access control
RBAC assigns permissions by job function to simplify administration.
Enforce 802.1X at the edge
Port-based access control authenticates devices, often against RADIUS, before granting access.
Combine authentication factors
Mix something you know, have, and are for stronger multifactor authentication.
Common Attacks and Defenses
Attackers exploit weaknesses at every layer, from ARP poisoning to phishing. Recognizing attack patterns enables the right countermeasures. Switch features and user awareness reduce exposure significantly.
Mitigate MAC flooding with port security
Limiting MACs per port stops attackers from overflowing the CAM table.
Defend against ARP poisoning
Dynamic ARP Inspection and DHCP snooping prevent on-path interception.
Train users against phishing
Awareness reduces successful credential theft from deceptive emails.
Secure Network Design
Design choices shape a network's security posture before any attack occurs. Segmentation, isolation zones, and firewalls contain threats and limit lateral movement. A default-deny stance underlies sound firewall policy.
Isolate public services in a DMZ
A screened subnet protects the internal LAN if a public server is compromised.
Enforce default-deny firewall rules
Block all traffic not explicitly permitted to follow least privilege.
Segment with VLANs
Separating traffic limits broadcast scope and contains breaches.
Secure Remote Access and Trust
Remote access and evolving trust models extend security beyond the perimeter. VPNs encrypt traffic across untrusted networks, and zero trust verifies every request. These approaches address a workforce that is increasingly distributed.
Encrypt remote access with VPNs
IPsec or SSL/TLS tunnels protect confidentiality and integrity in transit.
Adopt zero trust principles
Verify every request continuously regardless of network location.
Use secure management protocols
Prefer SSH and SNMPv3 over clear-text Telnet and older SNMP versions.
Pon a prueba tus conocimientos
Preguntas de práctica sobre Network Security