Introduction
簡介
Imagine you are in a team responsible for deploying a new network for a major marketing firm that has recently expanded to new offices. Your boss, William, has assigned you the task of securing the network against potential cyber threats and unauthorized access.
想像你隸屬於一個團隊，負責為一家最近擴展到新辦公室的大型行銷公司部署新網路。你的主管 William 指派你負責保護網路，使其免於潛在的網路威脅與未授權存取。
Your challenge is clear—without proper security measures, the company's sensitive data could be at risk and daily activities disrupted.
你的挑戰很明確：若缺乏適當的安全措施，公司的敏感資料可能面臨風險，日常營運也可能因此中斷。
You identified the following threats:
你識別出以下威脅：
- Unauthorized physical connection to an unused port on a switch; gives an attacker access to the company network.未經授權實體連接到交換器上未使用的連接埠，讓攻擊者得以存取公司網路。
- The need to secure infrastructure traffic from transit traffic (such as web and email).需要將基礎架構流量與傳輸流量（例如網頁與電子郵件）區隔開來。
- Internal spoofing attacks used to launch denial-of-service (DoS) attacks could exhaust infrastructure and network resources, potentially bringing the business to a halt.內部偽造攻擊被用來發動阻斷服務（DoS）攻擊，可能耗盡基礎架構與網路資源，甚至導致業務中斷。
- Man-in-the-middle attacks for trust exploitation and information theft.利用信任關係進行中間人攻擊，藉此竊取資訊。
- Spanning Tree Protocol (STP) and VLAN attacks that can disrupt the network or allow the attacker to eavesdrop.生成樹協定（STP）與 VLAN 攻擊，可能中斷網路運作或讓攻擊者得以竊聽。
The figure shows part of the network topology, with red stars marking potential exploitation points for attacks, such as unused ports, mixed traffic areas, and compromised computers or devices.
圖中顯示部分網路拓樸，紅色星號標示出可能遭受攻擊的位置，例如未使用的連接埠、混合流量區域，以及遭入侵的電腦或裝置。
In this course, you will learn how to:
在本課程中，你將學到如何：
- Secure unused ports on devices to prevent unauthorized access.保護裝置上未使用的連接埠，以防止未授權存取。
- Enable infrastructure access control lists (iACLs) to secure the network.啟用基礎架構存取控制清單（iACL）以保護網路。
- Disable unnecessary services on devices to lower the risk of security exploits.停用裝置上不必要的服務，以降低遭受安全性漏洞攻擊的風險。
- Mitigate attacks on LAN infrastructure, such as VLAN-based attacks.緩解針對 LAN 基礎架構的攻擊，例如以 VLAN 為基礎的攻擊。
- Implement measures to prevent Address Resolution Protocol (ARP) and DHCP spoofing attacks.實作措施以防止位址解析協定（ARP）與 DHCP 偽造攻擊。
- Protect against STP attacks.防範 STP 攻擊。
Implementing device hardening involves addressing security vulnerabilities by configuring devices at risk of being exploited, which prevents unauthorized access, ensures network security, enhances reliability, and reduces vulnerabilities.
實作裝置強化涉及針對可能遭利用的裝置進行設定，以處理安全性弱點，藉此防止未授權存取、確保網路安全、提升可靠性並降低弱點。