-: Network Zones.
When considering the architecture of your internal network,
it's important to consider breaking your network
up into multiple security zones.
These can be further broken up into sub-zones
through the use of subnetting, ACLs, firewall rules,
and other isolation methods that will help us prevent
or shape the flow of data between the
different portions of our network.
Most networks are segmented into
at least three different zones:
the LAN, the WAN, and the DMZ.
LANs can be secured using private IPs,
using anti-malware programs,
and by placing your clients behind
a router and its associated ACLs.
WAN connections, on the other hand,
should be monitored and firewalled
to secure your networks against the
threats that those contain.
The Internet is the world's largest WAN.
And traffic crossing across the Internet
should be tunneled through a virtual private network
when you want to keep it safe from prying eyes.
This will increase your confidentiality.
In fact, the TLS tunnels that are used in
HTTPS connections are a type of VPN.
So, any time you're going to a website
and you see that secure lock,
there's actually a VPN being used
between your web browser and the web server you're visiting.
In addition to our LAN and our WAN,
the most most common security zone that we use
is what's known as a DMZ, or a De-Militarized Zone.
This zone is focused on providing controlled access
to publicly-available servers that are
hosted within your organizational network.
For example, if you're self-hosting your web server
and email servers inside your organization,
it's a best practice to place them within your DMZ,
and this is a tightly controlled zone
with proper access control rules.
This allows you to maintain precise control
of the traffic that's going to be allowed between
the inside, your LAN, the outside, the WAN,
and the DMZ portions of the network.
To create a DMZ, multiple interfaces are used on
your organization's firewall.
You'll have a strict set of access
control list rules that are going to be
applied to those interfaces,
and a public IP address is required for each
server hosted within your DMZ.
The purpose of creating security zones
like a DMZ is to create this separation
of critical assets.
Not all devices in your network require
the same level of protection.
Some resources, such as file servers,
are going to contain confidential information,
like employee data, and this is going to
require additional security being placed there.
Instead of protecting every device to the same high level,
we can create sub-zones inside of our networks
based on the level of protection required.
In addition to these internal sub-zones,
there may be also be additional external zones
that you need to create, such as an Extranet.
Now, an Extranet is a specialized type of DMZ
that's created for your partner organizations
to access over a wide area network.
It acts much like a DMZ, but it's not publicly accessible.
This Extranet is also placed under additional
network monitoring and scrutiny.
For example, I access an Extranet every time
I need to go to Axelos to order exam vouchers
for my students in my ITIL and PRINCE2 courses.
It's a part of their network that only their external
partners, training partners like us,
can have access to, and not the general public.
Conversely, on the other side,
we have what's known as an Intranet.
An Intranet is something that allows you
to expand your internal network within
your organization across multiple areas.
This is usually done using VPN tunnels.
So, for example here, I have a couple of employees
who work on the other side of the world.
If they need to get access to our file servers,
they can do that by logging in to our Intranet
and get access to it through that secure connection.