Network Security Fundamentals [Electronic resources] نسخه متنی

Introduction to the SAFE Blueprint

The SAFE blueprint is a flexible, dynamic blueprint for the security of standard networks and virtual private networks (VPNs), enabling organizations to successfully compete in the Internet economy. The SAFE architecture is based on Cisco and its partner products and uses a defense-in-depth approach and modular design for security.

This appendix focuses solely on large enterprise environments. Modifications to the SAFE blueprint for smaller or more specialized environments exist because the SAFE blueprint is designed mainly for large enterprise environments. Table A-1 lists environments and the corresponding documentation that describes how to implement a SAFE blueprint in those environments.

The SAFE blueprint discourages having only one device performing a security function, which means that you mitigate threat throughout the network. Security capabilities can be hosted on dedicated appliances such as firewalls, incorporated in routers and switches, or they can run in the background on end systems. Following the guidelines of the white papers referred to in Table A-1 does not guarantee a 100-percent-secure environment or that you prevent all intrusions. These guidelines help in achieving a reasonably secure network, but the best security possible is obtained by following the white paper guidelines and combining multiple parameters:

• Establishing a good security policy

• Staying current with the latest hacking techniques

• Maintaining and monitoring all systems in the network

The SAFE architecture assumes that a security policy is already in place. As discussed in Chapter 5, "Security Policies," this policy might not exist in your organization. Remember that designing and implementing security can be challenging. Organizations have been known to hold unrealistic expectations regarding security implementations and their results. Take the opportunity to discuss those expectations before beginning a security design project.

Chapter 5, you should develop a security policy with the participation and agreement of the highest levels of your organization's management. This process helps build the required support for the creation, acceptance, and adaptation of the security design. The process of developing a security policy is complex. You must tailor it to the target environment.

The following sections provide more details on the SAFE architecture for enterprise networks.