My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec.

My first assignment is to draw a layout of a network that will be used later in a CTF-wargame between the participants of the course.

The network must count

  • a mail server

  • a web server

  • an 'old' Windows XP-box (supposed to run a legacy web app, and i as sysadmin have no root access to this box)

All of the above must be publicly reachable. Furthermore we must also include the following:

  • two user PC's (they do not have to accept incoming traffic, but must be able to acces the internet)

  • a MySQL-server (to store the data of the legacy web app on the XP box, so at least accesible by that box)

  • a CISCO Catalyst switch

This network will be 'under attack' during the various stages of the training, and we are asked to 'harden' it by use of firewalls, routing rules, monitoring & protection devices, ...

I have zero experience in designing such a network, but decided to give it my best shot, so i kindly ask the Stackexchange-panel for help :)

I was thinking of separating the email/web server and the XP-box (+ MySQL ?) on 3 separate VLAN's and putting the user PC's behind a well-configured firewall.

EDIT: question was too broad, so narrowed it down:

Everything would run on Linux (was thinking of virtualizing the XP on Linux as well), so what would be a good Linux/Apache/MySQL setup ?

A lot to ask, I know, but I hope to get some answers to ge me on the right track. All help (answers, links to best practices, hints & tips,...) more than welcome !! Thanks in advance :)

closed as too broad by TildalWave, Ohnana, Anti-weakpasswords, Matthew, Deer Hunter Feb 12 '16 at 12:59

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What's your background then? Sounds like you are an admin? – AdHominem Feb 11 '16 at 21:08
  • 1
    I appreciate that you revisited your question. But "what is a secure architecture" is an even more broad question! A good question has three degrees of specificity -- for example, I could say, "What is a good Linux setup for CTF?" -> "What is a good Linux/Apache setup for CTF? -> "What is a good Linux/Apache Web App setup for CTF?" and now I've reached the start of a good question that someone can answer without blathering for hours on :) – Ohnana Feb 12 '16 at 18:59
  • Thanks for your patience, Ohnana, I'm new here. I tried to narrow down even more. Will this be OK ? :) – SpindizZzy Feb 13 '16 at 14:13

To avoid stating the obvious and you even mentioned it in your post, I would take your chart editor of choice. I use lucid chart for myself and clients. Then I would make the diagram. Have all of the systems you described group together and behind a router and firewall. Then have the router leading to a internet / attacker.

Now you have your chart your boss asked for, after this write down each program and OS each machine has to have according to your parameters. For example, beside the machine for XP write:
XP service pack #
legacy web app name
and so on for each machine.

After this you should have a detailed network diagram of how the systems see each other. Remember if you are giving any of these machines internet access and they are intentionally compromised than you may open yourself up for real attacks. I would suggest having a regularly "secured" computer off the network to allow for internet access, and leave all of the other systems on a private network with no outside access.

And as part of the network team does this mean you are defending or attacking? Or are you a neutral party that facilitates the red and blue teams?

  • Hi and thanks for a speedy answer :) I looked into chart editors already and discovered 'Dia Diagram Editor' (i'm on Linux) but i will have a look at Lucid as well. I will be both attacking and defending, if I understood correctly. How can I keep those email and webservers on a private network ? They have to be able to be reached form the outside, and the XP-box as well. – SpindizZzy Feb 11 '16 at 21:56
  • No problem at all! And when I say private network I mean having a router with no Internet cable and having its non Internet ports going to a few switches that go to each of your boxes (attackers and defenders). This way nothing is able to make its way to the Internet and open your entire existing network to attacks – RB4 Feb 11 '16 at 22:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.