如何构建整体安全方案（How to build an overall security solution）.docVIP

如何构建整体安全方案（How to build an overall security solution） How to build an overall security solution The first page: how to build the overall security program, the overall security program is divided into technical solutions, service programs and support programs in three parts. First, technical solutions security products is the foundation of network security, through the installation of safety equipment in the network, making the network structure more clear, safety has been enhanced; at the same time can effectively reduce the difficulty of safety management, improve the effectiveness of safety management. The installation locations of security devices added to LANs and their roles are described below. 1 firewall Installation location: between LAN and router; between WWW server and managed lan; LAN firewall role: (1) to achieve one-way access, allowing LAN users to access INTERNET resources, but strictly limiting access to LAN resources by INTERNET users; (2) through the firewall, the whole LAN will be divided into three logically separated regions, INTERNET, DMZ area and intranet access area, which will be beneficial to the management of the entire network; (3) all LAN workstations and servers in the whole firewall protection, as long as through the firewall settings, you can prevent INTERNET from most limited attacks on applications of network administrators only need to pay attention to DMZ provide services outside the security vulnerabilities; (4) through port filter rules, port level control is implemented to restrict the access of LAN users to INTERNET; (5) flow control, to ensure the flow of important business requirements; (6) limit the application of large capacity network to work hours by filtering rules and taking time as the controlling factor. The role of the firewall in the hosting room: (7) through the firewall filtering rules, INTERNET user access to the WWW server, access control at a minimum, in this case, the network administrator can ignore the sec