2.3Network infrastructure and technologies

To build a network securely, the basic idea is not to rely on one strong wall but to layer mechanisms with different roles. Building on that design philosophy—the security architecture—this section takes up the DMZ that separates public from internal, virtualization and the cloud for flexible use of resources, the honeypot that deliberately lures attackers, the proxy server that relays and inspects traffic, and the IDS responsible for detecting intrusions versus the IPS that goes as far as detection plus blocking. The goal is to identify each by name and role—"what kind of box it is (isolate, detect, block, observe, relay)."

2.3.1Defense in depth, DMZ, virtualization, and cloud

• A security architecture is the overall design that combines perimeter defense, segmentation, access control, and monitoring to build defense in layers (defense in depth). The idea: if one measure is breached, the next layer holds the line.
• A DMZ (demilitarized zone) is a buffer zone where devices exposed to the outside such as web and mail servers are placed, isolated from the internal network. Even if a public server in the DMZ is compromised, it does not directly reach the internal critical systems. It is the classic "place what is public apart from the internal."
• Virtualization creates multiple virtual machines on one physical server, partitioning resources. It can isolate environments, but the underlying hypervisor or misconfiguration also becomes a new attack surface. The cloud is a form of renting servers and storage over the internet, where understanding the shared responsibility model (the provider and the user split what each protects) is key.

2.3.2Observe, relay, detect/block: honeypot, proxy, IDS/IPS

• A honeypot is a decoy system that deliberately lures attackers. Made to look like the real thing, it absorbs attacks and is used to observe techniques and divert attention from production systems. Legitimate users never access it, so traffic to it is a strong sign of suspicion.
• A proxy server stands between client and server and relays traffic on their behalf. It is used for filtering destinations, inspecting content, taking logs, and hiding the source. Its advantage is consolidating the entry/exit into one place for control and visibility.
• An IDS (intrusion detection system) detects and alerts on suspicious traffic but does not stop it (passive—recording and notifying). An IPS (intrusion prevention system) adds to detection by blocking on the spot in the traffic path (inline, active). Remember "IDS watches; IPS watches and blocks."

Consider reviewing a small business's network. This company placed its own website on the same island (segment) as the internal file server. This is dangerous, because a public-facing web server is easily attacked, and if it is taken over the important file server on the same island is instantly endangered too. The correct introductory-level call is to place the public server isolated in a DMZ. In a DMZ, even if the web server is compromised, it is unlikely to directly reach the internal critical systems. Next, you want to add traffic monitoring at the boundary, and here the decision point is whether to choose an IDS or an IPS. If you are at the stage of "first, make visible what is happening and avoid the risk of mistakenly stopping legitimate traffic," it is safe to start with an IDS (passive) that only detects and alerts. If instead you "want known attacks stopped automatically on the spot," choose an IPS (active) that blocks inline. The difference is not one of superior performance but a difference of role: detection only, or detection plus blocking. Further, if you want to observe attack trends, place a decoy honeypot; if you want to control and log employees' web access in one place, route it through a proxy server—you combine boxes of different roles according to purpose. This is a security architecture—defense in depth in practice. At the introductory stage, the goal is to correctly identify which of "isolate, detect, block, observe, relay" each technology handles and to choose the box that fits the situation.

2.3.3Section summary

• A security architecture is layered (defense-in-depth) design; a DMZ is a buffer zone isolating public servers from the internal network
• Virtualization puts multiple environments on one machine, the cloud is shared responsibility, a honeypot observes as a decoy, and a proxy server relays, filters, and logs
• An IDS detects only (passive); an IPS detects and blocks on the spot (active, inline)—distinguish them by "whether it stops traffic"