Computer security project using Virtual Machines -- 3

The network scheme will consist of a DMZ in which there will be, at a minimum, one independent web server. On the other hand, there will be a LAN, composed of at least one NAS server and a Linux machine that will simulate the employees' computers. Our physical equipment will simulate connections from the outside (the WAN network) and it will be through this that all configurations will have to be made. A router/firewall will interconnect the different networks with each other. The firewall must control the following: - From the outside, you can access the DMZ, but not the LAN (except from our physical equipment). - From the LAN, you can access the DMZ and the outside. - From the DMZ, you cannot access the LAN or the outside. An intrusion detection and protection mechanism will have to be configured. That is, it will not only have to detect unwanted connections but also block them. Detection/protection rules will have to be up-to-date. You will have to implement some way to monitor logs to quickly find out if there has been an attack. Likewise, a mechanism must be implemented that prevents the downloading of installation files (exe, msi, rar, zip, bin, iso) and some content filtering mechanism for specific pages. The LAN computer will store the data in a directory called david_datos. Through a script, a copy of this directory will be made every day and sent encrypted to the NAS server. From within the LAN network, you can access the content of the NAS through a shared resource with authentication. From the outside, you can access the NAS files through a VPN. In the LAN (although it should not really be on the same network), there will be a deception mechanism to confuse attackers. Either an automatic update server for Windows or an orchestrator will be set up to update and make changes to multiple servers (web, for example) simultaneously. It will be documented entirely and also the Virtual Machine Files will be requested