Lab 01 Secure an Enterprise Network

Mission Information

Difficulty: Beginner → Intermediate
Estimated Time: 60–90 Minutes
Lab Type: Network Security Assessment
Primary Focus: Network Architecture, Segmentation, Access Control & Hardening
Certification: CompTIA Security+

Mission Objective

You have joined an organization’s security team and have been asked to review its enterprise network.

The organization has grown quickly, but its network was built primarily for connectivity rather than security.

Your mission is to:

• Understand the existing network.

• Identify critical assets.

• Identify network security weaknesses.

• Determine appropriate trust boundaries.

• Design network segmentation.

• Recommend appropriate security controls.

• Reduce unnecessary exposure.

• Apply defense-in-depth principles.

• Introduce Zero Trust concepts.

• Produce an Enterprise Network Security Assessment.

The objective is not penetration testing.

You are approaching the environment as a Security+ security practitioner responsible for protecting enterprise infrastructure.

Scenario

GoHackersCloud Financial Services operates from a corporate office and provides several online services to customers.

The organization has:

• Employee workstations

• Corporate laptops

• Internal servers

• Public web applications

• Databases

• Wireless networks

• Administrative systems

• Cloud services

• Remote employees

• Security monitoring systems

Historically, many systems have been placed within the same trusted network.

Management is concerned that compromise of one device could allow an attacker to reach other important systems.

You have been asked to review the architecture and recommend a more secure design.

Phase 1 — Understand the Business Environment

Before recommending security controls, understand what the network supports.

Identify the major business functions.

Examples include:

Employees

Require access to corporate applications, email, collaboration platforms, and approved internet services.

Customers

Require access to public-facing applications.

Administrators

Require controlled access to infrastructure and security systems.

Applications

May require communication with databases and backend services.

Remote Workers

Require secure access to approved organizational resources.

Your first task is to determine:

Who needs access to what?

This question becomes the foundation of network security architecture.

Phase 2 — Identify Critical Assets

Create an inventory of important systems.

Classify them according to their business importance.

Asset	Purpose	Sensitivity	Priority
Customer Portal	Customer Services	High	Critical
Database	Customer Information	Critical	Critical
Identity Services	Authentication	Critical	Critical
Employee Systems	Business Operations	Medium	High
Security Platform	Monitoring	High	High
Guest Wireless	Visitor Internet	Low	Low

Consider which systems would cause the greatest impact if compromised.

Critical assets normally require stronger isolation and monitoring.

Phase 3 — Identify Network Zones

Instead of treating the entire network as trusted, divide it according to purpose and risk.

Your enterprise architecture should contain logical security zones such as:

Internet Zone

Untrusted external networks.

Public Services Zone

Internet-facing applications and services.

User Zone

Employee laptops and workstations.

Server Zone

Internal business services.

Database Zone

Sensitive data platforms.

Management Zone

Administrative and infrastructure-management systems.

Security Zone

Monitoring and security-management platforms.

Guest Zone

Personally owned and visitor devices.

Cloud Environment

Organizational workloads hosted within cloud platforms.

The important principle is:

Different levels of risk should have different security boundaries.

Phase 4 — Identify Trust Boundaries

Now determine where trust changes within the architecture.

Examples include:

Internet → Public Application

External users interact with organizational systems.

User Network → Server Network

Employees access internal applications.

Application → Database

Applications access sensitive information.

Administrator → Management Network

Privileged users manage infrastructure.

Guest Network → Corporate Network

Untrusted devices exist near trusted systems.

Each boundary should have appropriate controls.

Do not assume that traffic should be trusted simply because it originates inside the organization.

Phase 5 — Review Network Segmentation

Consider what could happen if every system existed within one large network.

If an employee workstation were compromised, an attacker might potentially reach:

• Other workstations

• Internal servers

• Administrative interfaces

• Databases

• Security systems

Segmentation reduces this exposure.

Design logical separation between:

Employee Devices

↓

Business Applications

↓

Sensitive Databases

Administrative infrastructure should have its own restricted path.

Guest devices should remain isolated from corporate resources.

The objective is to reduce unnecessary communication between systems.

Phase 6 — Apply Least-Privilege Networking

Least privilege does not apply only to user accounts.

It also applies to networks.

Ask:

Does this system genuinely need to communicate with that system?

If the answer is no, communication should normally be restricted.

For example:

Employee workstations may need access to an internal application.

They probably do not need direct access to its database.

The preferred model becomes:

Employee

→ Application

→ Database

rather than:

Employee

→ Database

This reduces the potential attack surface.

Phase 7 — Protect Public-Facing Services

Public-facing services deserve special consideration because they interact directly with untrusted networks.

Identify services such as:

• Websites

• Customer portals

• Public APIs

• Remote-access services

These systems should not automatically receive unrestricted access to internal environments.

Consider protections such as:

• Network isolation

• Application security controls

• Traffic filtering

• Monitoring

• Secure configuration

• Restricted backend connectivity

The objective is to ensure that compromise of an internet-facing system does not automatically become compromise of the internal enterprise.

Phase 8 — Review Firewall Architecture

Determine where security boundaries require traffic control.

Firewalls may be positioned between:

• Internet and public services

• Public services and internal systems

• User and server networks

• Application and database networks

• Corporate and guest networks

• On-premises and cloud environments

For each boundary, define:

Source

Who initiates the communication?

Destination

Which system is being accessed?

Purpose

Why is the communication necessary?

Decision

Should it be allowed?

This creates a business-driven approach to firewall policy.

Phase 9 — Review Secure Network Protocols

Identify situations where sensitive information travels across networks.

Examples include:

• User authentication

• Administrative access

• Application communication

• File transfers

• Remote access

• Web applications

Determine whether secure communication should be required.

The Security+ principle is straightforward:

Sensitive information should be protected while traveling across untrusted or potentially exposed networks.

Legacy or insecure communication methods should be replaced wherever practical.

Phase 10 — Secure Administrative Access

Administrative access represents one of the highest-risk areas of the network.

Administrators may control:

• Servers

• Network infrastructure

• Cloud environments

• Security platforms

• Identity systems

Administrative traffic should therefore receive stronger protection than normal user traffic.

Consider:

• Dedicated management networks

• Strong authentication

• MFA

• Privileged accounts

• Restricted administrative devices

• Centralized monitoring

• Least privilege

Avoid allowing administrative interfaces to be broadly accessible.

Phase 11 — Review Wireless Security

Your organization provides:

Corporate Wireless

Used by employees.

Guest Wireless

Used by visitors and personal devices.

These environments should have different trust levels.

Corporate wireless should provide controlled access to organizational resources.

Guest wireless should generally provide internet access while remaining isolated from internal systems.

Evaluate:

• Authentication requirements

• Encryption

• Network separation

• Device trust

• Guest isolation

• Monitoring

Phase 12 — Review Remote Access

Employees may need to access organizational systems from outside the corporate network.

Remote access introduces another trust boundary:

External Device

↓

Remote Access Security

↓

Enterprise Resources

Determine what controls should protect this boundary.

Consider:

• Strong authentication

• MFA

• Device security

• Secure communications

• Access restrictions

• Monitoring

• Session controls

Remote users should receive only the access required for their responsibilities.

Phase 13 — Introduce Network Access Control

Not every device connecting to the network should automatically receive trusted access.

Consider how the organization could evaluate:

• User identity

• Device identity

• Device security status

• Location

• Access request

• Resource sensitivity

Different devices may receive different access levels.

For example:

Managed Corporate Laptop

May receive normal corporate access.

Personal Device

May receive restricted access.

Guest Device

May receive internet-only access.

Non-Compliant Device

May receive limited or remediation access.

Phase 14 — Apply Zero Trust Principles

Traditional network security often assumed:

Inside = Trusted
Outside = Untrusted

Modern environments make this assumption increasingly unreliable.

Zero Trust uses a different principle:

Never trust implicitly. Continuously verify access.

Apply concepts such as:

Verify Explicitly

Validate identities and access requests.

Least Privilege

Provide only necessary access.

Assume Breach

Design security assuming that compromise may eventually occur.

This means segmentation remains important even inside the enterprise.

Phase 15 — Apply Defense in Depth

No single security control should protect the entire organization.

Consider an external user attempting to reach sensitive information.

The request might encounter multiple defensive layers:

Internet

↓

Perimeter Security

↓

Public Application Protection

↓

Application Security

↓

Identity Controls

↓

Network Segmentation

↓

Database Access Controls

↓

Monitoring

This is defense in depth.

If one control fails, another control may still prevent or detect compromise.

Phase 16 — Review Monitoring Requirements

Security architecture should provide visibility.

Determine which areas require monitoring.

Examples include:

• Internet connections

• Authentication systems

• Public applications

• Administrative activity

• Critical servers

• Databases

• Cloud environments

• Security devices

Ask:

If someone attempted unauthorized access, would the security team know?

Security controls that cannot be monitored can create significant visibility gaps.

Phase 17 — Identify Single Points of Failure

Security also includes availability.

Identify services whose failure could disrupt business operations.

Examples include:

• Internet connectivity

• Authentication

• Network infrastructure

• DNS

• Critical applications

• Security services

Consider where redundancy may be necessary.

The goal is to ensure that failure of one component does not unnecessarily interrupt critical services.

Phase 18 — Review Physical Security Considerations

Network security does not exist independently of physical security.

Consider:

• Network equipment

• Server rooms

• Wireless equipment

• Administrative workstations

• Backup systems

Determine whether unauthorized physical access could bypass logical security controls.

Security+ expects learners to understand that enterprise security combines:

Physical + Technical + Administrative Controls

Phase 19 — Identify Security Gaps

Now review the original network architecture.

Create a list of identified weaknesses.

Examples might include:

Finding	Risk	Priority
Flat Internal Network	Lateral Movement	High
Guest and Corporate Access Overlap	Unauthorized Access	High
Broad Administrative Access	Privilege Exposure	Critical
Limited Network Monitoring	Detection Gap	Medium
Weak Remote Access Controls	Account Compromise	High

Do not focus only on whether a control exists.

Ask whether it provides adequate protection for the associated risk.

Phase 20 — Design the Improved Architecture

Create your recommended architecture.

A simplified design could follow:

Internet

↓

Perimeter Security

↓

Public Services Zone

↓

Internal Security Boundary

↓

User Zone

↓

Application / Server Zone

↓

Sensitive Database Zone

Separate from these:

Management Zone

Security Monitoring Zone

Guest Network

Cloud Environment

Each zone should communicate only where legitimate business requirements exist.

Phase 21 — Build the Security Control Matrix

Document the controls protecting each area.

Area	Primary Risk	Recommended Controls
Internet Edge	External Attack	Filtering, Monitoring
Public Applications	Exploitation	Isolation, Application Protection
User Network	Endpoint Compromise	Segmentation, Access Control
Server Network	Unauthorized Access	Restricted Connectivity
Database Network	Data Exposure	Strong Isolation
Management Network	Privileged Compromise	MFA, Restricted Access
Guest Network	Untrusted Devices	Isolation
Remote Access	Account Compromise	MFA, Secure Access

This connects architecture decisions directly to security risks.

Phase 22 — Prioritize Improvements

Not everything can be fixed simultaneously.

Prioritize improvements according to risk.

Priority 1 — Critical

Address:

• Unrestricted privileged access

• Critical system exposure

• Major trust-boundary failures

Priority 2 — High

Address:

• Network segmentation

• Remote access

• Authentication

• Sensitive system isolation

Priority 3 — Medium

Improve:

• Monitoring

• Configuration consistency

• Wireless security

• Network visibility

Priority 4 — Continuous Improvement

Continue improving:

• Zero Trust adoption

• Security architecture

• Automation

• Security monitoring

• Resilience

Final Architecture Challenge

Your final enterprise architecture should demonstrate:

Internet

↓

Protected Public Services

↓

Controlled Internal Access

↓

Segmented Business Systems

↓

Restricted Sensitive Systems

Alongside:

Identity Security

Privileged Access Security

Monitoring

Zero Trust

Defense in Depth

The important point is that compromising one system should not automatically provide access to everything else.

Lab Deliverables

Students should complete:

1. Enterprise Asset Inventory

Identify important network assets and their business purpose.

2. Network Zone Classification

Define appropriate trust zones.

3. Trust Boundary Assessment

Identify where security controls are required.

4. Network Security Findings

Document major architecture weaknesses.

5. Security Control Matrix

Map identified risks to appropriate controls.

6. Improved Network Architecture

Design a more secure enterprise network.

7. Remediation Priorities

Classify improvements as Critical, High, Medium, or Continuous Improvement.

8. Enterprise Network Security Assessment

Combine the complete assessment into the final lab deliverable.

Security+ Exam Perspective

For CompTIA Security+, make sure you understand the reasoning behind the controls.

Segmentation

Limits communication and helps contain compromise.

Least Privilege

Provides only the access required.

Defense in Depth

Uses multiple security layers rather than relying on one control.

Zero Trust

Does not grant trust simply because a user or device is inside the network.

MFA

Adds additional assurance during authentication.

Network Access Control

Determines whether users and devices should receive network access.

Secure Protocols

Protect information while it is transmitted.

Monitoring

Provides visibility into security activity.

Redundancy

Improves availability and resilience.

The exam may give you a scenario and ask for the best security control, rather than asking you to define the technology.

Always ask:

What risk is the organization trying to reduce?

Key Takeaway

A secure enterprise network is not simply:

Internet → Firewall → Internal Network

A stronger security model is:

Identify Assets

→ Separate Trust Zones

→ Control Communication

→ Protect Identities

→ Restrict Privileged Access

→ Monitor Critical Activity

→ Assume Compromise

→ Contain the Impact

The goal is not to create a network where compromise is impossible.

The goal is to build an environment where one compromised user, device, or application cannot easily become an enterprise-wide security incident.

What’s Next?

➡️ Lab 02 — Identity, Access Control and Privileged Account Security

In the next Security+ lab, students move from protecting the network to protecting identities and access, assessing users, groups, roles, privileged accounts, authentication, MFA, least privilege, account lifecycle, and Zero Trust access principles.