Traffic That's Typically Not Allowed

Traffic That's Typically Not Allowed

[View full size image]

Notice which ends of the lines do not have arrows on them; in other words, focus on the IP host that initiates the flows. In this figure, all the IP hosts that initiate the flows are on the Internet. A lot of what Fred wants to prevent is stuff that's initiated by hosts on the Internet, which makes sense if you think of the bad guys on the Internet who are trying to get into your network. For instance, by definition, you do not want to let Internet users open a browser and browse your internal websites. Also, no one should try to initiate a TCP connection to C2. By definition, clients are hosts with users who typically need to initiate flows, not accept them.

Table 18-1 summarizes and characterizes what Fred wants to happen with security.