=============================================================================== NETWORK TOPOLOGY — GLOBEX CORPORATION Last updated: 2026-03-01 | Classification: INTERNAL USE ONLY Network team contact: netops@globex.com =============================================================================== INTERNET | | ISP Link: 1 Gbps | Public IP Range: 203.0.113.0/28 | +--------+--------+ | FW-EDGE-01 | Palo Alto PA-3260 | (Edge Firewall)| PAN-OS 11.1 +--------+--------+ | +--------------+--------------+ | | +-------+-------+ +--------+--------+ | DMZ ZONE | | VPN GATEWAY | | VLAN 10 | | 10.10.20.1/24 | | 10.10.10.0/24 | | GlobalProtect | +-------+-------+ +------------------+ | +--------+--------+--------+ | | | | +--+--+ +--+--+ +--+--+ +--+--+ | WEB | | MAIL| | DNS | | WAF | | 01 | | 01 | | 01 | | 01 | +-----+ +-----+ +-----+ +-----+ .11 .12 .13 .14 nginx Exchange BIND9 ModSec 1.25.4 2019 CU12 9.18.18 3.0.12 | | DMZ-to-Internal link | +---------+---------+ | FW-INTERNAL-01 | Palo Alto PA-850 | (Internal FW) | PAN-OS 11.1 +---------+---------+ | +----------+----------+----------+ | | | | | | | | +--+---+ +---+----+ +---+----+ +---+----+ |CORP | |SERVER | |MGMT | |DATABASE| |LAN | |VLAN | |VLAN | |ZONE | |VLAN20| |VLAN 30 | |VLAN 40 | |VLAN 50 | +--+---+ +---+----+ +---+----+ +---+----+ | | | | | | | | ============================== VLAN DETAILS ================================ VLAN 10 — DMZ (10.10.10.0/24) Purpose: Public-facing services Hosts: 10.10.10.11 DMZ-WEB01 nginx 1.25.4 reverse proxy + app server 10.10.10.12 DMZ-MAIL01 Exchange 2019 CU12, inbound/outbound email 10.10.10.13 DMZ-DNS01 BIND 9.18.18, authoritative external DNS 10.10.10.14 DMZ-WAF01 ModSecurity 3.0.12, WAF for WEB01 Security Controls: - IDS/IPS: Suricata sensor (span port on FW-EDGE-01) - Logging: All hosts forward to SIEM via rsyslog - AV: ClamAV on MAIL01 for attachment scanning - Patching: Monthly cycle, 72-hour SLA for critical CVEs VLAN 20 — Corporate LAN (10.20.30.0/24) Purpose: Employee workstations Hosts (partial list): 10.20.30.10 SRV-FILE01 Windows Server 2022, department file shares 10.20.30.15 SRV-PRINT01 Windows Server 2019 (*** SMBv1 ENABLED ***) 10.20.30.40 WKS-JPARK Windows 11 Pro, Help Desk 10.20.30.45 WKS-MCHEN Windows 11 Pro, Finance Analyst 10.20.30.50 WKS-JMARTINEZ Windows 11 Pro, IT Support 10.20.30.55 WKS-TNGUYEN Windows 11 Pro, Operations 10.20.30.60 WKS-DKIM Windows 11 Pro, Marketing 10.20.30.65 WKS-RPATEL Windows 11 Pro, Engineering 10.20.30.70 WKS-LRODRIGUEZ Windows 11 Pro, Legal Security Controls: - EDR: CrowdStrike Falcon on all endpoints - AV: Microsoft Defender (managed via Intune) - Logging: Sysmon + Windows Event Forwarding to SIEM - Patching: WSUS, monthly cycle - NOTE: SRV-PRINT01 has deferred patching (legacy driver dependency) VLAN 30 — Server VLAN (10.20.40.0/24) Purpose: Internal application and infrastructure servers Hosts: 10.20.40.10 SRV-DC01 Windows Server 2022, Primary Domain Controller 10.20.40.11 SRV-DC02 Windows Server 2022, Secondary Domain Controller 10.20.40.20 SRV-APP01 Ubuntu 22.04, internal web applications 10.20.40.30 SRV-SIEM01 Ubuntu 22.04, Splunk Enterprise 9.2 10.20.40.35 SRV-BACKUP01 Windows Server 2022, Veeam Backup Security Controls: - EDR: CrowdStrike Falcon on Windows, OSSEC on Linux - Logging: All servers forward to SRV-SIEM01 - Patching: Monthly with 48-hour SLA for critical - Access: RDP/SSH restricted to VLAN 40 (MGMT) only VLAN 40 — Management VLAN (10.20.50.0/24) Purpose: IT admin jump boxes, network management Hosts: 10.20.50.10 JUMP-WIN01 Windows Server 2022, RDP jump box 10.20.50.11 JUMP-LIN01 Ubuntu 22.04, SSH jump box 10.20.50.20 NMS-01 LibreNMS, network monitoring Security Controls: - Access: MFA required for all logins - Logging: Session recording enabled - Network: Only VLAN with access to server and database VLANs mgmt ports VLAN 50 — Database Zone (10.20.60.0/24) Purpose: Production databases Hosts: 10.20.60.10 DB-SQL01 SQL Server 2022, primary business data 10.20.60.11 DB-SQL02 SQL Server 2022, reporting replica 10.20.60.20 DB-PG01 PostgreSQL 16, application database Security Controls: - Access: Only SRV-APP01 and JUMP boxes can reach DB ports - Encryption: TLS 1.3 enforced for all DB connections - Logging: Database audit logging enabled, forwarded to SIEM - Backups: Daily to SRV-BACKUP01, encrypted at rest ============================ FIREWALL RULES ================================ --- FW-EDGE-01 (Edge Firewall) — Simplified Rule Set --- RULE SRC DST PORT/PROTO ACTION LOG NOTES ---- ---------------- ---------------- ----------- ------ --- ----- E01 Any (Internet) 10.10.10.11 TCP/80,443 ALLOW Yes Web traffic to DMZ-WEB01 via WAF E02 Any (Internet) 10.10.10.12 TCP/25,587 ALLOW Yes SMTP inbound to DMZ-MAIL01 E03 Any (Internet) 10.10.10.13 TCP/53,UDP/53 ALLOW Yes DNS queries to DMZ-DNS01 E04 VPN-Pool 10.20.30.0/24 TCP/3389 ALLOW Yes Remote Desktop for VPN users E05 VPN-Pool 10.20.30.0/24 TCP/445 ALLOW Yes File share access for VPN users E06 10.10.10.0/24 Any (Internet) TCP/80,443 ALLOW Yes DMZ outbound HTTP/S (updates) E07 10.10.10.0/24 Any (Internet) TCP/25 ALLOW Yes SMTP outbound from MAIL01 E08 Any Any Any DENY Yes Default deny all --- FW-INTERNAL-01 (Internal Firewall) — Simplified Rule Set --- RULE SRC DST PORT/PROTO ACTION LOG NOTES ---- ---------------- ---------------- ----------- ------ --- ----- I01 10.10.10.12 10.20.40.10 TCP/389,636 ALLOW Yes MAIL01 -> DC01 LDAP for auth I02 10.20.30.0/24 10.20.30.0/24 TCP/445 ALLOW No ** Intra-VLAN SMB (overly broad) I03 10.20.30.0/24 10.20.30.0/24 TCP/3389 ALLOW No ** Intra-VLAN RDP (overly broad) I04 10.20.30.0/24 10.20.40.10-11 TCP/389,636 ALLOW Yes Workstations -> DCs for AD I05 10.20.30.0/24 10.20.40.20 TCP/8080 ALLOW Yes Workstations -> APP01 web app I06 10.20.30.0/24 Any (Internet) TCP/80,443 ALLOW Yes Workstations outbound web I07 10.20.50.0/24 10.20.40.0/24 TCP/3389,22 ALLOW Yes MGMT -> Servers (RDP/SSH) I08 10.20.50.0/24 10.20.60.0/24 TCP/1433,5432 ALLOW Yes MGMT -> Databases I09 10.20.40.20 10.20.60.0/24 TCP/1433,5432 ALLOW Yes APP01 -> Databases I10 10.20.30.0/24 10.20.40.0/24 Any DENY Yes Block workstations -> servers (except above) I11 10.20.30.0/24 10.20.60.0/24 Any DENY Yes Block workstations -> databases I12 Any Any Any DENY Yes Default deny all ** SECURITY FINDINGS: - Rule I02: Allows unrestricted SMB between ALL hosts in VLAN 20. This enabled lateral movement from WKS-MCHEN to SRV-PRINT01 via EternalBlue. Recommendation: Restrict SMB to file server (SRV-FILE01) only. - Rule I03: Allows unrestricted RDP within VLAN 20. Workstation-to- workstation RDP is rarely needed. Recommendation: Remove or restrict to IT admin workstations only. - Rule I06: No outbound content filtering or SSL inspection. Allows C2 callbacks and data exfiltration over HTTPS. Recommendation: Enable SSL decryption, category-based URL filtering, and block uncategorized destinations from servers. - Rule E06: DMZ servers can reach any internet destination. SRV-FILE01 used this path for exfiltration (though SRV-FILE01 is on VLAN 20, rule I06 applied). Recommendation: Restrict DMZ outbound to known update repositories only. - Missing Rule: No rule blocks servers (VLAN 30) from outbound internet. SRV-DC01 DNS tunneling exfiltration was not blocked. Recommendation: Servers should only reach internet via explicit proxy. ========================== SECURITY CONTROLS SUMMARY ======================= LAYER CONTROL STATUS GAPS ------------------ ------------------------- ------------- ---------------- Edge Perimeter Palo Alto PA-3260 Operational No SSL decrypt DMZ Suricata IDS Operational Signature-only DMZ WAF (ModSecurity) Operational OWASP CRS 4.0 Email Gateway Exchange transport rules Operational No sandbox/detonation VPN GlobalProtect + MFA Operational None known Corp LAN CrowdStrike Falcon EDR Operational SRV-PRINT01 outdated agent Corp LAN Sysmon + WEF Operational Not on DMZ hosts Corp LAN Microsoft Defender AV Operational Policy allows user disable Internal FW Palo Alto PA-850 Operational Rules too broad (see above) Servers CrowdStrike / OSSEC Operational OSSEC alerting delayed Database Zone TLS + audit logging Operational No DLP on DB queries SIEM Splunk Enterprise Operational 14-day hot retention only Backup Veeam Operational No immutable backup copies Vulnerability Mgmt Tenable Nessus Operational Monthly scan only Patch Management WSUS Partial SRV-PRINT01 deferred DLP Forcepoint DLP Partial Covers email only, not endpoints =============================================================================== Student Task: 1. Identify at least 5 security architecture weaknesses 2. Propose firewall rule changes to prevent the observed attack 3. Recommend network segmentation improvements 4. Design monitoring improvements for each identified gap ===============================================================================