Abstract from http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a008009c8b6.shtml#wp46424
The SAFE Blueprint from Cisco Systems® is a secure blueprint for enterprise networks. Its principle goal is to provide best practices information on designing and implementing secure networks. SAFE takes a defense-in-depth approach to network security design, serving as a guide to network designers considering the security requirements of their networks. This type of design focuses on expected threats and their methods of mitigation, resulting in a layered approach to security where the failure of one security system is not likely to lead to the compromise of the rest of the network. Although this white paper is a product-agnostic document, the SAFE proof-of-concept lab is based on products from Cisco and its partners.
This document begins with an overview of the blueprint's architecture, and then details the specific modules that make up the actual network design. When discussing each module, the first three sections describe the traffic flows, primary devices, and expected threats, with basic mitigation diagrams. Detailed technical analysis of the design follows, along with more detailed threat mitigation techniques and migration strategies. Appendix A details the validation lab for SAFE and includes configuration snapshots. Appendix B is a primer on network security. Readers unfamiliar with basic network security concepts are encouraged to read Appendix B before the rest of the document. Appendix C contains definitions of the technical terms used in this document, and a legend for the included figures.
This document focuses on threats encountered in enterprise environments. Network designers who understand these threats can better decide where and how to deploy mitigation technologies. Without this understanding, deployments tend to be incorrectly configured, too focused on security devices, or lacking in threat response options. By taking the threat mitigation approach, this document provides network designers with information for making sound network security choices.
In addition to this enterprise document, Cisco has published several companion papers that address security issues for specific technologies and smaller-scaled networks (small, midsized, and remote). These detailed documents can be found at the SAFE library on Cisco.com ( http://www.cisco.com/go/safe) and include:
•SAFE: Extending the Security Blueprint to Small, Midsize, and Remote-User Networks
•SAFE: IPSec Virtual Private Networks in Depth
•SAFE: Wireless LAN Security in Depth—Version 2
•SAFE: IP Telephony Security in Depth
•SAFE: IDS Deployment, Tuning, and Logging in Depth
In addition, the SAFE library contains documents that provide a step-by-step analysis for combating specific high-profile network attacks. These are also located at http://www.cisco.com/go/safe and include:
•SAFE: Worm Mitigation
•SAFE: Layer 2 Best Practices
