"Building the Wall" — Network Security, Hardening & AD Deep Dive

Network segmentation divides a flat network into isolated zones so that a compromise in one zone cannot spread to others. The primary tool for segmentation is the VLAN (Virtual Local Area Network) — a logical grouping of switch ports that creates separate broadcast domains.

But here is the critical misconception: VLANs alone do not provide security. VLANs separate broadcast domains, but if the core switch or router performs inter-VLAN routing, traffic can still flow between VLANs unless you explicitly block it with ACLs (Access Control Lists).

Defense in depth means layering controls: VLANs for Layer 2 separation, ACLs for Layer 3 filtering, firewalls for stateful inspection, network monitoring for detection, and endpoint security for the last line of defense. If any one layer fails, the others still protect you.

A firewall examines network traffic and decides whether to allow or deny each packet based on a set of rules. There are two fundamental approaches:

Rule order matters. Firewalls process rules top to bottom and stop at the first match. A common best practice is:

1. Explicit Deny rules first — block known-bad traffic immediately
2. Explicit Allow rules — permit specific traffic you want
3. Implicit Deny All at the bottom — anything not explicitly allowed is blocked (deny by default)

Wireless networks are inherently more exposed than wired — radio signals extend beyond building walls. Securing wireless requires both encryption and authentication.

802.1X is the IEEE standard for port-based Network Access Control. It works for both wired and wireless networks. The components are:

• Supplicant — The client device requesting access
• Authenticator — The switch or access point that controls access
• Authentication Server — The RADIUS server that validates credentials (often integrated with Active Directory)

A VPN (Virtual Private Network) creates an encrypted tunnel over an untrusted network (like the internet) so that remote users can securely access internal resources as if they were on the corporate LAN.

Split tunneling is a configuration where only traffic destined for the corporate network goes through the VPN tunnel; all other traffic (web browsing, streaming, personal email) goes directly to the internet. This saves bandwidth but creates risk:

A DMZ (Demilitarized Zone) is a network segment that sits between the internal (trusted) network and the external (untrusted) internet. It hosts services that must be accessible from the internet — web servers, email gateways, DNS servers — while keeping them isolated from the internal network.

There are two common DMZ architectures:

The key principle: the internal network should NEVER be directly reachable from the internet. External users connect to DMZ services, and DMZ services communicate with the internal network through tightly controlled firewall rules.

Active Directory (AD) is the backbone of Windows enterprise identity management. Understanding its hierarchy is essential for any IT administrator.

AD is organized in a strict hierarchy:

Domain Trusts

Trusts allow users in one domain to access resources in another domain. There are several types:

• Parent-Child Trust — Automatically created when a child domain is added to an existing domain. Two-way transitive trust.
• Forest Trust — Manually created between two separate forests. Can be one-way or two-way. Not transitive beyond the two forests.
• One-Way Trust — Users in the trusted domain can access resources in the trusting domain, but not the reverse.
• Two-Way Trust — Users in either domain can access resources in the other.

AD Sites and Subnets

Sites represent the physical topology of your network. Each site is associated with one or more IP subnets. AD uses sites to optimize replication traffic and direct clients to the nearest domain controller. In a multi-site organization, replication between sites is compressed and scheduled to conserve WAN bandwidth.

AGDLP Nesting Strategy

The recommended approach for assigning permissions in Active Directory is the AGDLP pattern:

Example: User p.sharma (Account) is a member of IT-Admins (Global Group). IT-Admins is a member of ServerAccess-FullControl (Domain Local Group). ServerAccess-FullControl has Full Control permission on the server share (Permission). This separation means you never assign permissions directly to users — always through groups.

Every user account has a lifecycle — from creation to eventual deletion. Failing to manage any stage properly creates security gaps. The four stages are:

LDAP is the protocol used to query and modify Active Directory. Every object in AD has a Distinguished Name (DN) that uniquely identifies its location in the directory hierarchy.

A DN is read right to left (most general to most specific):

Breaking this down:

• DC=meridian,DC=local — Domain Component: the domain (meridian.local)
• OU=Meridian — Organizational Unit: top-level OU for the company
• OU=IT — Organizational Unit: the IT department
• CN=Trent Manning — Common Name: the specific user object

LDAP queries use a filter syntax to search for objects. Common examples:

• (&(objectClass=user)(sAMAccountName=t.manning)) — Find the user with logon name t.manning
• (&(objectClass=user)(memberOf=CN=IT-Admins,OU=Groups,OU=Meridian,DC=meridian,DC=local)) — Find all members of IT-Admins
• (&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) — Find all enabled user accounts

The ActiveDirectory PowerShell module is the primary tool for managing AD from the command line. Here are the commands you will use in the lab: