-: Network segmentation.
So, the second way we can secure our network
and build a more secure network
is through segmenting our network.
We don't want it to be wide open,
so network segmentation is gonna separate that network
into different levels of security,
and keep them separate from each other.
So, much like we did in our triple home firewall,
where we had the intranet, the internet, and the DMZ,
we're gonna apply these same principles
to break apart our intranets into more secure enclaves,
and by doing that, we're gonna break things down
either into functional areas
or we're gonna do it based on physical areas.
Now, when I look at a network segmentation,
here is an example of that.
If you look at the far right,
you'll see the internet, the DMZ, and the intranet,
like you saw back when we talked about firewalls.
But now, beyond the intranet, you'll see another firewall,
and we have one that's going between the data center
and the intranet and the internal DMZ and the intranet,
and then you'll see this computer
hanging off the intranet as well.
Now, this is segmenting our network up into
three distinct components, right?
We have one with the data center over on the right,
we have another one with the first DMZ on the left,
excuse me, the data center on the left,
the DMZ on the left, and then the intranet.
That intranet is three pieces.
And then, we have three pieces over on the extranet side
with the internet, the DMZ, and the intranet on that side.
So, you can see how this segmentation
is a much more complex network,
but if someone gets in and breaks into the intranet,
it doesn't mean that they've been able to break into
the data center, or the remote administration server.
Segmentation prevents the spread of a bad guy
from getting throughout the entire network at once.
Instead, he's got more hoops he has to jump through.
So, here's an example.
If I'm on my PC and I want to get
into the intranet to get to the data center,
I can go from my PC, up through the firewall,
down to the remote administration server,
which then has the ability to connect
from the remote administration server
into the data center to get to the SharePoint server, right?
As you can see here, with those red arrows,
as I showed on the screen.
That's an example of how you'd have to do it.
Now, why is that important, instead of just going directly
from my intranet PC straight into the SharePoint server?
Well, because along the way,
that firewall is gonna check my machine,
and when I get to the remote administration machine,
it's gonna check by machine,
and that remote administration machine
is gonna be checked by the firewall
before it goes into the SharePoint server,
and so there's a lot more checks and balances along the way,
as opposed to having free rein,
and this is gonna actually add to our security
of our network by doing increased network segmentation.
(logo buzzes)