Unit 02 of 03
Perimeter Defense
How many claims the boundary drawn around the network itself makes provable: the space firewall generations see and prove, the path segmentation closes in the zone graph plus the demilitarized zone, the proxy and jump server as checkpoint, the difference between detection and prevention over the same event set, the early signal a honeypot and a sinkhole produce, the access scope of a virtual private network, and how rule evaluation order changes flow outcomes.
Published Updated
Lessons
- 01 Firewall Generations The forty-eight claims carried by eight flow classes are run across three firewall generations: how many the packet-filtering box sees, how many the stateful one sees, how many the application-aware one proves, how many new items each generation must watch in return, and how much of what is proven encrypted flow takes back. 14 min read
- 02 Network Segmentation and the Demilitarized Zone Four layouts are run over an eight-zone graph: flat network, perimeter control alone, segmentation without a demilitarized zone, and full segmentation; each one counts the open path count, the item reached at the first hop and transitively from the outside zone, the zone reached when one zone falls, and the legitimate flow missed when rules were written. 14 min read
- 03 Proxy Servers and the Jump Server Ten connection classes run across four layouts: once a checkpoint is set up, how many of the period's connections pass through a single point, how many skip the point, how many classes remain once skip paths are closed by a rule change, what the point's own load is and how much path its failure cuts, and which claim becomes provable at the point. 14 min read
- 04 Intrusion Detection and Prevention Systems Fourteen event classes and seven signatures run over the same period: the difference in what network-based and host-based sensors see, caught and missed events, how many alerts are false positives, the legitimate work cut once switching to prevention mode, and the detection that closing a noisy signature loses in the same move. 13 min read
- 05 Honeypots and Sinkholes Four decoy items that legitimate work never visits are run over the same period: how low the interaction false-positive rate stays next to signature-based detection, how many bad event classes never appear under this arrangement, and how many legitimate connections the sinkhole cuts per connection it drops. 14 min read
- 06 Virtual Private Networks The access scope a tunnel opens is run across three placements: how many items the remote endpoint reaches directly when it lands in the internal zone, how many items fall out of scope when it lands in a separate zone and in a zone per role; how many connections a split tunnel leaves outside inspection, and how many connections a single verification is enough to count as proven subject identity. 14 min read
- 07 Access Control Lists Rule evaluation order is run across ten rules and sixteen known flows: the first matching rule is found for each flow, the same list is evaluated in five separate orders, and how many flows' outcomes change when the order changes is counted; how many legitimate flows a hardening move cuts and the path that specific-to-general ordering opens are measured. 14 min read