Network Segregation and DMZ. -- 2
Budget: $30 – $250 CAD
Note: Everything is Ubuntu and on VMware. If you dont know how to work on vmware kindly dont waste my time.
Complete a migration from one network topology 1 to topology 2. To achieve this, you must divide the network into separate security zones using VLANs, routing policies, and stateless firewalls if needed. By grouping these devices together, the security team can better manage and monitor the security posture of the devices within the zone. You must also identify the appropriate security zone for each device based on their security requirements and define how they communicate with other devices within their respective security zones.
In addition, you must implement a DNS solution that separates traffic between private and public DNS servers, allowing only authorized endpoints to query private DNS servers and any endpoint to query public DNS servers. Also, you must switch from static routing to dynamic routing protocol (OSPF) during the migration process (See FRR (frrouting.org/).
Moreover, you must segregate network traffic between security zones using VLANs, routing policies, and stateful L3 firewall. In addition, you will complete implementation of split DNS security pattern. The private DNS resolves queries for company's internal resources and only authorized endpoint allows to query Private DNS. Public DNS resolves queries about any public-facing assets and any endpoint allows to query Public DNS. All host firewalls must be configured using ansible or python script.
Also, you are required to design a DMZ zone. Your DMZ design must meet certain criteria, including inspecting all external connections with IDS sensors and securing web applications using WAF. In addition, network traffic should never flow directly between the external and internal firewalls, as this exposes the internal network to potential threats. Instead, all external connections should be terminated within the DMZ zone. Network firewalls and proxies should be configured using Ansible or Python script to automate the process and avoid manual configuration errors.
During this, you will be responsible for deploying two web vulnerable applications (websploit.org/).
Management has given the go ahead for employees to work from home. When setting up remote access for employees to work from home, it is necessary to take extra precautions to safeguard sensitive company information. Design a remote access solution that will enhance cybersecurity but won't increase the risk. The solution should rely on a Virtual Private Network (VPN)and potentially use a Jump Box, which is a type of network device or virtual machine that sits between a remote device and the target network. It helps to minimize security issues associated with unsecured remote devices. Your task includes deploying a remote access solution, ensuring compliance with DMZ rules, and implementing SSL encryption for all web servers.
Also, it is required that users provide credentials before they are granted access to the LAN. These credentials could include a username and password combination, biometric data, or a smart card. Once authorized, the user's device is granted access to the LAN and can communicate with other devices connected to it. Your aim is to set up 802.1x authentication for all corporate devices and implement a single sign-on solution.
Complete a migration from one network topology 1 to topology 2. To achieve this, you must divide the network into separate security zones using VLANs, routing policies, and stateless firewalls if needed. By grouping these devices together, the security team can better manage and monitor the security posture of the devices within the zone. You must also identify the appropriate security zone for each device based on their security requirements and define how they communicate with other devices within their respective security zones.
In addition, you must implement a DNS solution that separates traffic between private and public DNS servers, allowing only authorized endpoints to query private DNS servers and any endpoint to query public DNS servers. Also, you must switch from static routing to dynamic routing protocol (OSPF) during the migration process (See FRR (frrouting.org/).
Moreover, you must segregate network traffic between security zones using VLANs, routing policies, and stateful L3 firewall. In addition, you will complete implementation of split DNS security pattern. The private DNS resolves queries for company's internal resources and only authorized endpoint allows to query Private DNS. Public DNS resolves queries about any public-facing assets and any endpoint allows to query Public DNS. All host firewalls must be configured using ansible or python script.
Also, you are required to design a DMZ zone. Your DMZ design must meet certain criteria, including inspecting all external connections with IDS sensors and securing web applications using WAF. In addition, network traffic should never flow directly between the external and internal firewalls, as this exposes the internal network to potential threats. Instead, all external connections should be terminated within the DMZ zone. Network firewalls and proxies should be configured using Ansible or Python script to automate the process and avoid manual configuration errors.
During this, you will be responsible for deploying two web vulnerable applications (websploit.org/).
Management has given the go ahead for employees to work from home. When setting up remote access for employees to work from home, it is necessary to take extra precautions to safeguard sensitive company information. Design a remote access solution that will enhance cybersecurity but won't increase the risk. The solution should rely on a Virtual Private Network (VPN)and potentially use a Jump Box, which is a type of network device or virtual machine that sits between a remote device and the target network. It helps to minimize security issues associated with unsecured remote devices. Your task includes deploying a remote access solution, ensuring compliance with DMZ rules, and implementing SSL encryption for all web servers.
Also, it is required that users provide credentials before they are granted access to the LAN. These credentials could include a username and password combination, biometric data, or a smart card. Once authorized, the user's device is granted access to the LAN and can communicate with other devices connected to it. Your aim is to set up 802.1x authentication for all corporate devices and implement a single sign-on solution.
Related categories:
Linux
Computer Security
Network Administration
Network Security
Network Engineering