Device placement & security zones

3.2 Secure enterprise infrastructure

📘CompTIA Security+ SY0-701

---

When we talk about device placement and security zones, we are essentially discussing where different network devices are located in a network and how networks are divided to enhance security. Proper placement and segmentation are critical to preventing unauthorized access, protecting sensitive data, and maintaining network efficiency.

---

1. Device Placement

Device placement is about where you put your network devices—such as firewalls, switches, routers, intrusion detection systems (IDS), intrusion prevention systems (IPS), and servers—in a network to make it secure and efficient. Placement affects both security and network performance.

Key Concepts for Device Placement

1. Edge Devices
   • Definition: Devices placed at the boundary between your internal network and external networks (like the internet).
   • Common Devices: Firewalls, edge routers, proxies, load balancers.
   • Purpose: Protect the internal network from outside threats, control incoming/outgoing traffic.
   • Example: A firewall placed at the edge of the network inspects all traffic coming from the internet before it enters the internal network.
2. Internal Network Devices
   • Definition: Devices placed inside the network to manage internal traffic and provide services.
   • Common Devices: Switches, internal firewalls, wireless access points (WAPs), IDS/IPS.
   • Purpose: Control traffic between departments, monitor for threats, segment the network.
   • Example: A switch in the finance department network segment connects computers and servers while allowing the firewall to enforce security rules.
3. Server Placement
   • Definition: Servers are placed based on their role and the level of protection they require.
   • Common Placement Strategies:
     • DMZ (Demilitarized Zone): For public-facing services like web servers or email servers.
     • Internal Network: For sensitive systems like database servers, ERP, or file servers.
   • Reasoning: Servers accessible from the internet are placed in the DMZ to reduce risk to the internal network if compromised.
4. Wireless Devices
   • Access Points (APs): Should be placed strategically for coverage but separated from sensitive network segments. Often connected through VLANs for security.
5. Network Monitoring Devices
   • IDS/IPS, SIEM sensors: Placed in strategic spots to monitor traffic without blocking it. For example, an IDS sensor might be placed near the edge firewall to analyze incoming traffic.

---

2. Security Zones

A security zone is a network segment that has specific security requirements. Zones allow network administrators to apply different security policies to different areas of the network, making it harder for attackers to move around.

Common Security Zones

1. Untrusted Zone
   • Definition: The area outside your network, typically the internet.
   • Purpose: Anything here is considered unsafe. Traffic from here should be strictly controlled.
   • Devices Used: Edge firewalls, VPN gateways, IDS/IPS.
   • Example: Incoming traffic from users on the internet passes through the firewall before it reaches your servers.
2. DMZ (Demilitarized Zone)
   • Definition: A semi-trusted zone where public-facing services are hosted.
   • Purpose: Allows external users to access certain services (like a website) without giving direct access to the internal network.
   • Devices Used: Firewalls (to separate DMZ from internal network), load balancers, web servers.
   • Example: Your company’s public web server is in the DMZ. If it gets hacked, the attacker can’t directly reach the internal finance database.
3. Internal Zone (Trusted Zone)
   • Definition: The protected internal network where sensitive data resides.
   • Purpose: Only authorized internal users and devices can access resources here.
   • Devices Used: Internal firewalls, switches, authentication servers.
   • Example: Internal HR or accounting servers are only accessible to employees within the internal zone.
4. Management Zone
   • Definition: A special zone for managing network devices.
   • Purpose: Protects administrative access to routers, switches, and servers.
   • Devices Used: Management VLANs, access control lists (ACLs), jump servers.
   • Example: Only network admins can access switches through the management VLAN, isolated from the general employee network.
5. Wireless Zone
   • Definition: A separate zone for wireless devices.
   • Purpose: Adds security for devices connecting over Wi-Fi.
   • Devices Used: Wireless LAN controllers, firewalls, VLANs.
   • Example: Guest Wi-Fi might be isolated from corporate Wi-Fi to protect internal resources.
6. Guest Zone
   • Definition: A network for visitors or temporary users.
   • Purpose: Provides internet access without letting guests access internal network resources.
   • Devices Used: Firewalls, VLANs, captive portals.
   • Example: Conference attendees use guest Wi-Fi, but they can’t see the company’s internal servers.

---

3. Best Practices for Device Placement & Security Zones

1. Place firewalls at the edge of each zone.
   • Every zone boundary should have a firewall or similar security control.
2. Use VLANs to segment internal networks.
   • Example: Finance VLAN, HR VLAN, IT VLAN.
3. Separate sensitive devices.
   • Place servers and critical systems in their own zones.
4. Monitor traffic at zone boundaries.
   • IDS/IPS should watch for suspicious activity at these boundaries.
5. Limit lateral movement.
   • If an attacker breaches one zone, they shouldn’t automatically access other zones.
6. Apply the principle of least privilege.
   • Users or devices should only have access to the zones they need.

---

4. Exam Tips

• Know the purpose of different zones (DMZ, internal, guest, management).
• Understand where devices should be placed (edge, internal, servers, wireless).
• Be familiar with why segmentation improves security (reduces attack surface, contains breaches).
• Remember that firewalls, IDS/IPS, and access control devices are usually placed at zone boundaries.
• Think in terms of trusted vs untrusted zones—the internet is always untrusted, internal network is trusted, and DMZ is semi-trusted.

---

✅ Summary

• Device placement is about where you put devices like firewalls, servers, APs, and IDS/IPS to protect your network.
• Security zones are about dividing the network into segments with different trust levels and security controls.
• DMZ, internal, management, wireless, and guest zones are common types.
• Proper placement and zoning reduce risk, control access, and help contain attacks.

---