The shop window and the safe
A shop puts its best goods in the window for anybody to see. The cash is in a safe at the back.
A computer system does the same. The public web server sits in the window. The payroll sits in the safe.
Today you learn three ways to keep the window and the safe apart.
Key words
| Word | What it means |
|---|---|
| Network | Computers and devices linked so they can share data. |
| Firewall | A gate that lets some traffic in or out and blocks the rest. |
| Malware | Software made to harm a computer or steal data. |
| Ransomware | Software that locks your data and demands money to unlock it. |
| DMZ | Demilitarised zone: a separate area between the internet and the inside network, for servers the public must reach. |
| Air gap | A system with no connection to any other network, so data cannot cross by wire or Wi-Fi. |
| SDN | Software defined networking: one central program controls how all the network devices send traffic. |
| Controller | The central program in an SDN that tells the devices what to do. |
| Segregation | Keeping parts of a system apart so a problem in one cannot spread. |
| TLS | The way a browser and a server lock their link, used by banking sites. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain physical separation, a DMZ, an air gap and SDN, and place a server in the right zone.
Starter: the defences
Have a go
Starter: the defences
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: physical separation
The simplest way to keep things apart is to keep them apart in the real world.
- Servers: put them in a locked room or a locked cabinet. Keep a separate management network for admin logins.
- Firewalls: place them between zones, so traffic must pass a rule list to cross.
- Cabling: use separate cables, switches and sockets for separate zones, and label or colour code them.
Cycle 2: the DMZ
Some servers must be reachable from the internet, such as the website and a mail relay. They are the most likely to be attacked.
So they go in a DMZ: a zone with a firewall on each side. The internet may reach only the DMZ servers, on set ports. The inside network is behind a second firewall.
If a DMZ server is taken over, the attacker is still outside the inside network.
Check: the DMZ
Have a go
Check: the DMZ
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.