4.2.1. Infrastructure Considerations and Device Placement

💡 First Principle: Where you place a security device matters as much as which device you choose. A firewall behind the web server doesn't protect the web server. An IDS monitoring encrypted traffic it can't decrypt is blind.

Device placement determines what traffic a security control can see and act on. Firewalls belong at network boundaries (internet-facing, between segments). IDS/IPS belongs where it can see traffic before and after decryption. Web application firewalls (WAFs) belong in front of web servers.

Sensors and collectors — security monitoring requires placing sensors at strategic points: network taps, SPAN ports, and agent-based collection on endpoints. Sensors must be positioned to see both north-south traffic (in/out of the network) and east-west traffic (between internal systems).

Jump servers / bastion hosts — hardened systems that serve as the sole access point for managing internal infrastructure. Administrators connect to the jump server first, then to the target system. This creates a choke point for auditing and access control. Jump servers should be heavily locked down: no internet access, MFA required, all sessions logged.

Proxies — intermediaries that sit between clients and servers. Forward proxies represent clients to the internet (enabling content filtering, URL filtering, caching). Reverse proxies represent servers to clients (enabling load balancing, SSL termination, application-layer protection).

Load balancers distribute traffic across multiple servers for availability and performance. Placement: between clients and server farms. Security function: they can perform SSL offloading, health checks, and rate limiting.

Sensor and collector placement — IDS/IPS sensors, NetFlow collectors, and packet capture points must be placed strategically to see relevant traffic. A sensor behind the firewall sees only allowed traffic; one in front sees everything including blocked attacks. Placing sensors at network boundaries, between security zones, and near high-value assets ensures comprehensive visibility.

⚠️ Exam Trap: Forward proxy = clients use it to reach the internet (outbound). Reverse proxy = clients reach it to access your servers (inbound). If the question describes filtering employee web access, it's a forward proxy. If it describes protecting web servers, it's a reverse proxy.