Dated: 12-11-2024
Ch02. Security Overlay of an Enterprise Architecture - 3 (general Security design)
General Security Design Principles
- Block unauthorized traffic at edge (direct public www traffic to DMZ web server)
- Edge malware protection & DMZ
- Web & email are important vectors to secure against malware and attacks
- NGN-FW (may be found in a UTM as well)
- Web security GW and email anti-spam GW solutions
- Granular access list filtering in edge and data center FWs (source, destination, and traffic type/port)
- A good AV solution, and keep virus definitions updated
- Monthly VM scans
More Advanced Security
- APT & zero-day attack prevention
- SIEM solution
- Network DLP and system DLP
- Network admission control (NAC)
- Server HIPS
- Web application FW (WAF)
Even More Advanced Security
- Network forensics
- Host-based APT / IoC solution
- Identity & access management (IAM)
- Privileged identity management (PIM)
- Database security solution
Guidelines for Strong Security Controls
- CIS 20 critical security controls
