Network Segmentation
Objectives:
● 1.2 - Compare and contrast networking appliances, applications, and functions
● 1.8 - Summarize evolving use cases for modern network environments
● 3.5 - Compare and contrast network access and management methods
● 4.1 - Explain the importance of basic network security concepts
● 4.3 - Given a scenario, apply network security features, defense techniques, and
solutions
● Firewalls
○ Firewall
■ Common network security device that acts as a barrier to networks
■ Uses a set of rules to define permitted or denied traffic
■ Types
● Software/Hardware Based
● Virtual/Physical devices
● Host/Network Based
■ Functions
● Performs Network Address Translation (NAT) or Port Address
Translation (PAT)
● Can use one public IP and many private IPs
285
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Types of Firewalls
■ Packet Filtering Firewall
● Permits or denies traffic based on packet headers
● Uses Access Control Lists (ACLs) for decision-making
● Limited by rules and may not enable two-way communication
effectively
■ Stateful Firewall
● Inspects traffic as part of a session
● Allows incoming traffic that corresponds to outgoing requests
● Can be exploited in phishing attacks due to session-based nature
○ Combine Packet Filtering and Stateful Firewalls for good
security
■ Modern firewalls often support both packet
filtering and stateful capabilities
■ Next-Generation Firewall (NGFW)
● Conducts deep packet inspection (DPI) for detailed traffic analysis
● Operates at layers 5, 6, and 7 of the OSI model
● Can be specific to web servers (web application firewall) or for
entire networks
○ Access Control Lists (ACLs)
■ Sets of rules assigned to routers or firewalls
286
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Permit or deny traffic based on IP/MAC address or port depending on
device
● Switch – MAC address
● Router – IP address
● Firewall – IP address or port
■ Criteria
● Source/destination IP
● Source/destination port
● Source/destination MAC
○ Exam Tip
■ Study how to read ACLs
○ Unified Threat Management (UTM) System
■ Combines firewall, router, intrusion detection/prevention, malware
solutions, and other security devices
■ Generally considered a border device with next-generation firewall
capabilities
■ Available as physical, virtual, or cloud solutions
● Access Control List (ACL)
○ Access Control Lists (ACLs)
■ A list of permissions associated with a given system or network resource
■ Can be applied to routers, layer three switches, or firewalls
287
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Contain rules that are applied based on IP addresses, ports, or
applications
■ Processed from top to bottom
● Specific rules should be at the top
● Generic rules should be at the bottom
○ Blocking Strategies
■ Block incoming requests from internal or private loopback addresses,
multicast IP ranges, and experimental ranges
■ Block incoming requests from protocols that should only be used locally
(e.g., ICMP, DHCP, OSPF, SMB)
■ Configure IPv6 to block all traffic or allow only authorized hosts and ports
○ Explicit Allow
■ Specified in ACLs using "permit" statements
■ Each "permit" statement explicitly allows a specific type of traffic from a
specific source to a specific destination
○ Explicit Deny
■ Statement used to block specific types of traffic
■ Created by changing the "permit" keyword to "deny" in an ACL rule
○ Implicit Deny
■ Statement that is automatically applied at the end of an ACL if no explicit
deny statements are present
■ Blocks all traffic that is not explicitly permitted by "permit" statements
288
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Impact on Security
■ Explicit allow statements ensure that only specified traffic is allowed,
increasing security by minimizing unintended access
■ Explicit deny statements allow for precise control over which traffic is
blocked
■ Implicit deny provides a default block for all traffic not explicitly
permitted, adding an extra layer of security
○ Role-Based Access Control
■ Defines privileges and responsibilities of administrative users
■ Users are grouped based on roles or job functions
■ Permissions are assigned based on roles (e.g., configuring firewalls,
adding/removing users)
○ Exam Tips:
■ CompTIA exams are device-agnostic
● Do not focus on specific brands or models of devices
■ Focus on understanding the concepts and principles behind firewall
configurations, rather than memorizing specific device configurations
■ Practice reading and interpreting firewall configurations from different
vendors to prepare for the exam's broad scope
■ Understand the difference between explicit allow, explicit deny, and
implicit deny, as they are fundamental concepts in ACL configuration and
network security
289
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Segmentation Zones
○ Segmentation Zones
■ Trusted Zone
● Local Area Network (LAN), also known as the Inside Zone
● Represents the corporate intranet
■ Untrusted Zone
● Includes the internet and other external networks
● Traffic from the internet to the trusted zone is typically blocked,
except for responses to specific requests from the inside
■ Screened Subnet
● A semi-trusted zone between the trusted and untrusted zones
● Contains devices like web servers and email servers
● Has restricted access from the untrusted zone and is not fully
trusted by the internal network
● Screened Subnet to Trusted Zone
○ Traffic from internal to the screened subnet is allowed, but
traffic is restricted
○ Return traffic from screened subnet devices is allowed
● Screened Subnet to Untrusted Zone
○ Screened subnet devices can access the internet freely
○ Certain inbound ports need to be open for services like
email and web hosting
290
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Provides a choke point for network security measures, enhancing
protection for hosted servers
○ Firewalls
○ Intrusion detection systems (IDS)
○ Intrusion prevention systems (IPS)
○ Unified threat management (UTM) systems
● Functionality
● Allows hosted servers like email and web servers to be accessible
from both internal and external networks
● Without the screened subnet, servers hosted inside the network
would be inaccessible or less useful to external users
● Jumpbox
○ Internet Facing Hosts
■ Hosts or servers that accept inbound connections from the internet
■ Example
● Web server on a screen subnet
○ Screen Subnet
■ A segment isolated from the private network by firewalls
■ Set up to accept connections from the internet over designated ports
■ Purpose
● Keeps forward-facing servers out of the internal network
291
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Security
● Semi-trusted zone
○ Invisible to the outside network except for forward-facing
servers
○ Content of Screen Subnet
■ Internet facing servers like email, web servers
■ Communication servers, proxy servers, and remote access servers
■ Public services or extranet capabilities
■ Security Measures
● Harden devices in the screen subnet
● Use intrusion detection systems
● Consider all devices in the screen subnet as untrusted
● Protect against pivoting attacks from the screen subnet to the
internal network
■ Bastion Host
● A host or server in the screen subnet that is not configured with
services that run on the local network
● Example
○ Email server
○ Web server
○ Remote access server
292
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Jumpbox
■ A hardened server that provides access to other hosts within the screen
subnet
■ Purpose
● Control access to the screen subnet from the internal network
■ Security
● Should be heavily hardened and protected
■ Management of Jumpbox
● Can be a physical PC or a virtual machine
● Should have only the minimum required software
● Fully hardened and secured to protect against unauthorized
access
● Understanding Firewalls: Demonstration
● Content Filtering
○ Content Filtering
■ A network management practice that involves restricting access to certain
content, websites, or applications based on specific criteria to conserve
network bandwidth, comply with legal or organizational policies, or
prevent exposure to inappropriate or harmful content
293
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Techniques
■ URL Filtering
● Blocks access to specific websites based on their URL
● Common in organizational settings to prevent access to
non-work-related or inappropriate sites
■ Keyword Filtering
● Scans webpages for specific keywords or phrases and blocks them
● Useful for blocking specific content without blocking entire
websites
● Can lead to over-blocking if not configured carefully
■ Protocol or Port Filtering
● Blocks certain types of network traffic based on the protocol or
port they use
● Example
○ Blocking specific ports can prevent the use of certain file
sharing applications or services
○ Proxy Servers
■ Act as intermediaries between a user's device and the internet
■ Manage internet traffic and can be used for various purposes, including
content filtering
294
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Types
● Web Proxy
○ Retrieves web pages from the internet and can be used to
bypass content filters
● Reverse Proxy
○ Manages incoming internet traffic to an organization, load
balancing, improving security, and performance
● Transparent Proxy
○ Monitors and filters internet traffic, blocking access to
specific websites or content types, and enforcing company
policies
■ Benefits
● Filter out malicious traffic and prevent unauthorized access,
improving cybersecurity
● Hide user's IP address, preserving anonymity and privacy
● Block access to specific websites or content types, enforcing
company policies
● Cache frequently accessed resources, improving performance
295
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Internet of Things (IoT)
○ Internet of Things (IoT)
■ refers to a global network of appliances and personal devices equipped
with sensors, software, and network connectivity to report state and
configuration data
○ Types of IoT Devices
■ Building and Home Automation Systems
● Manage lighting, HVAC, water, and security systems
■ IP Video Systems
● Provide remote collaboration using video teleconference suites
■ Audio Visual Systems
● Stream live video productions and control multiple displays
■ Physical Access Control Systems
● Determine access into secure areas
○ Proximity readers
○ Access control systems
○ Biometric readers
■ Scientific and Industrial Equipment
● Found in hospitals, factories, and laboratories
● Allows centralized monitoring and management
296
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Best Practices
■ Segregation
● Place IoT devices on their own network, physically or logically
separated from the business network
■ Security
● Ensure devices are properly security enabled and receive security
patches
■ Power
● Provide power using Power over Ethernet (PoE) or battery power
supply
○ Categories of IoT Components
■ Hub and Control System
● Central point of communication for automation and control.
■ Smart Devices
● Endpoints that connect to the hub for automation
■ Wearables
● IoT devices that are designed as accessories that can be worn,
such as smart watches and fitness trackers
■ Sensors
● Measure various parameters like temperature, sound, motion, etc.
297
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Security Considerations
■ Understand endpoints
● Each new device brings new vulnerabilities, so understand and
secure them
■ Track and manage devices
● Carefully manage device connections and configurations
■ Patch vulnerabilities
● Apply patches when available, and manage residual risks
■ Conduct tests and evaluations
● Evaluate devices using penetration testing techniques
■ Change default credentials
● Change default usernames and passwords before deployment
■ Use encryption
● Encrypt data sent and received by IoT devices
■ Segment IoT devices
● Place IoT devices in their own VLAN and subnet to prevent
interference
● SCADA and ICS
○ Information Technology (IT)
■ Focuses on standard computers, servers, networks, and cloud platforms
298
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Operational Technology (OT)
■ A communications network that is designed to implement an industrial
control system, rather than traditional business and data networking
systems
■ Deals with controlling machinery and processes in the physical world
○ Industrial Control System (ICS)
■ Provides workflow and process automation by controlling machinery
using embedded devices
■ Heavily used to control real world devices
■ Interconnected ICSs can form a Distributed Control System (DCS)
■ Prioritizes availability and integrity over confidentiality (CIA triad in OT)
● Unlike the CIA triad in IT where confidentiality is often more
emphasized
■ Fieldbus
● A communication technology used in OT to link Programmable
Logic Controllers (PLCs) together
■ Programmable Logic Controllers (PLCs)
● Digital computers used in industrial settings for automation and
are programmed using Human Machine Interfaces (HMIs)
299
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Human Machine Interfaces (HMIs)
● A local control panel or a piece of software running on a regular
computer that will act as the input to the PLCs and the output for
the entire system
○ Supervisory Control and Data Acquisition(SCADA)
■ A type of ICS used to manage large-scale, multi-site devices and
equipment spread over a geographic region
■ Network made up of interconnected ICS/DCS plants using wide area
network (WAN) connections, such as cellular, microwave, satellite, fiber,
or VPN based WAN
■ Often operated with software running on ordinary systems like Windows
or Linux
● Bring Your Own Device (BYOD)
○ Bring Your Own Device (BYOD) Policy
■ Policy allowing employees to use their personal devices (laptops, tablets,
phones) for work purposes
■ Security Issues
● Introducing vulnerabilities from personal devices, potential for
malware transfer to work network
300
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Data Ownership
● Concerns about who owns the data on personal devices,
distinguishing between personal and business data
○ Storage Segmentation
■ Separating personal and company data on the same device
■ Can be achieved technologically or procedurally
○ Mobile Device Management (MDM)
■ Centralized software for remote administration and configuration,
updating devices, enforcing policies
○ Choose Your Own Device (CYOD)
■ Employees choose from a selection of supported devices, organization
provides and manages the device
■ Benefits of CYOD
● Allows for installation of MDM, enforcing technical policies,
preventing data loss, and controlling device features
○ Considerations for Organizations
■ Security Policy
● Organizations must decide on a mobile device security policy that
suits their needs
■ Choose between BYOD and CYOD based on security, cost, and control
considerations
301
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Zero-trust and Architecture
○ Concept of Zero Trust
■ Modern approach to cybersecurity due to sophisticated threats
■ Traditional strategies focused on strong perimeter defense like castle
walls
● Ineffective against modern threats due to de-perimeterization
● De-perimeterization
○ Protect systems and data using encryption, secure
protocols, and host-based protection
○ Allows cost reduction, global business transactions, and
increased agility
○ Resulted from cloud migration, remote work, mobile tech,
wireless networks, outsourcing
○ Zero Trust Principles
■ Trust nothing, verify everything
■ Verify every device, user, and transaction regardless of origin
■ Addresses threats from inside and outside networks
○ Zero Trust Architecture
■ Control Plane
● Defines, manages, and enforces access policies
302
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Elements
○ Adaptive Identity
■ Real-time validation based on behavior, device, and
location
○ Threat Scope Reduction
■ Limiting user access to minimize attack surface
○ Policy-driven Access Control
■ Enforcing access based on roles and responsibilities
○ Secured Zones
■ Isolated environments for sensitive data access
■ Data Plane
● Ensures execution of policies
● Components
○ Subject System
■ Individual or entity seeking access
○ Policy Engine
■ Cross-references access requests with predefined
policies
○ Policy Administrator
■ Establishes and manages access policies
○ Policy Enforcement Point
■ Executes access decisions
303
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Key Takeaways
■ Zero Trust assumes no user or system is trusted by default
■ Requires continuous verification for access regardless of location or origin
■ Complements traditional perimeter-based defenses
■ Offers a roadmap for robust security in remote work, cloud computing,
and diverse device environments
● Virtual Private Network (VPN)
○ Virtual Private Network (VPN)
■ Extends a private network across a public network, allowing users to send
and receive data securely as if their devices were directly connected to
the private network
■ Uses tunneling protocols to establish a secure connection over the public
internet
○ Types of VPNs
■ Site-to-Site VPN
● Connects two offices or sites
● Provides a cost-effective alternative to dedicated lease lines
■ Client-to-Site VPN
● Connects a single remote user to a corporate network, enabling
remote work or telecommuting
304
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Clientless VPN
● Creates a secure remote access VPN tunnel using a web browser,
without requiring software or hardware clients
● Tunneling protocols (HTTPS Connection)
○ Secure Socket Layer (SSL)
■ Provides cryptography and reliability using the
upper layers of the OSI model (Layers 5, 6, and 7)
■ Outdated and less secure
○ Transport Layer Security(TLS)
■ Provides secure web browsing over HTTPS
■ More updated than SSL
○ Both SSL and TLS use TCP
■ Can slow down connection due to more overhead
■ Datagram Transport Layer Security (DTLS)
● UDP version of TLS
● Provides same level of security as TLS
● Operates faster due to less overhead inside
UDP protocol
● An excellent choice for video streaming and
voiceover IP over secure and encrypted
tunnels
305
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ VPN Configuration for Site-to-Site and Client-to-Site
■ Full Tunnel
● Routes and encrypts all traffic through the VPN connection,
making the remote user part of the headquarters network
■ Split Tunnel
● Divides traffic, routing and encrypting traffic bound for
headquarters over the VPN while sending other traffic directly to
the internet
● Offers better performance but may be less secure
■ Use full tunnel when connecting VPN over an untrusted network like wifi
at a hotel or a coffee shop
○ Older VPN Protocols
■ Layer 2 Tunneling Protocol (L2TP)
● A very early VPN invented in the 80s and 90s
● Lacks security features like encryption by default
● Needs to be combined with an extra encryption layer for
protection
■ Layer 2 Forwarding (L2F)
● Originally developed by Cisco
● Provides a tunneling protocol fir the P2P protocol (PPP)
● Lacks native security and encryption features
306
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Point-to-Point Tunneling Protocol (PPTP)
● Supports dial-up networks
● Lacks native security features except when used with Microsoft
Windows
○ Modern VPNs
■ IP Security (IPsec)
● Provides authentication and encryption of packets to create a
secure communication path between two computers
○ Tunneling protocols like SSL/TLS, L2TP, L2F, PPTP, and IPsec can be used to
establish VPN connections
● Using VPN Connections: Demonstration
● Remote Access Management
○ Telnet
■ Operates on port 23
■ Sends text-based commands to remote devices
■ Sends data in plain text, so it is not secure for sensitive information
■ Should never be used for secure devices like routers, switches, or firewalls
○ Secure Shell (SSH)
■ Operates on port 22
■ Encrypts data sent between client and server
307
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Provides better security compared to Telnet
■ Always use SSH for configuring networking devices
○ Remote Desktop Protocol (RDP)
■ Operates on port 3389
■ Developed by Microsoft for graphical interface remote connections
■ Useful for remotely accessing Windows servers or client machines
■ Provides a Graphical User Interface (GUI) for remote control
■ Uses tunneling to secure connections
○ Remote Desktop Gateway (RDG)
■ A Windows server that creates secure connections to servers via RDP
■ Uses SSL or TLS protocols to encrypt data
■ Security features
● Creating encrypted tunnels like a VPN
● Controlling access to network resources based on permissions and
group roles
● Maintaining and enforcing authorization policies
● Monitoring the status of the gateway and any RDP connections
passing through that gateway
■ Recommended for Windows 2008 or newer to protect RDP connections
○ Virtual Network Computing (VNC)
■ Operates on port 5900
308
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Designed for thin client architectures and Virtual Desktop Infrastructure
(VDI)
■ Cross-platformed
● Linux
● OS X
● Windows
■ Allows remote access with a graphical interface
○ Virtual Desktop Infrastructure (VDI)
■ Hosts a desktop environment on a centralized server
■ Runs a desktop image within a virtual machine for end-user access
■ Also known as Desktop as a Service (DAS) in cloud computing
○ In-Band vs. Out-of-Band Management
■ In-Band Management
● Uses Telnet or SSH over the network
■ Out-of-band Management
● Uses a separate network for device configuration
● Provides additional security by separating data networks from
management networks
○ Application Programming Interface (API)
■ Set of protocols and routines for building and interacting with software
applications
■ Acts as an intermediary between different systems for communication
309
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Allows for automated administration, management, and monitoring of
applications and services
■ Typically built using either Representational State Transfer (REST), or
Simple Object Access Protocol (SOAP)
■ Allows for direct integration of different third-party applications