-: Layered Network Design.
So we've talked about defense in depth and the network
revolves around a lot of the protections.
So let's dig a little deeper into the network layer
of our defense in depth.
So we talk about Layered Network Design,
we are gonna combine our network architecture,
configuration management practices and policies
altogether to give us a nice secure network.
And that's gonna really depend on three
different ways of doing things.
Network segmentation, adding firewalls
and outsourcing different network segments,
and considering the risk associated with that.
So, let's talk about network segmentation first.
This is the compartmentalization of the network.
It's taking different pieces and putting
them in different buckets, right?
And so the benefits of this is it's gonna reduce
our network's attack surface, it can limit the scope
of regulatory requirements as you've seen previously
with PCIDSS, we take all the credit card stuff
and put it in one sub network out to the side,
that way we only have to follow the
regulations in that area of our network.
We can also increase availability of critical services
and increased network efficiency.
Segmentation is implemented through firewalls,
routers, switches and VLANs, and so network
segmentation is a good thing and we use it
a lot in our networks.
Now, you can do that a couple of different ways.
The first way is a single firewall or router.
And in this case, this is the simplest design
and we can create a DMZ or demilitarized zone
using a firewall.
As you can see here on my display we have an internet
connection going into a router,
we then have that going into a switch which ties in
all three of those servers into a demilitarized zone
and then we have a firewall protecting our intranet
from both the DMZ and the outside world of the internet.
This ensures you have proper protections
in place between your DMZ and your intranet.
This is what is called a single firewall setup
although you could use a router with a good ACL
to take the place of that firewall.
Now the next thing you can look at is what's called
the multiple interface firewalls.
And when you do this, you basically end up creating
three zones with the one firewall.
You have different ACLs on the internal,
the external and the DMZ, and it applies to each interface,
creating those multiple network segments.
So this is also called a service leg DMZ
because it hangs off the firewall off of a service leg.
So you have the internet zone, the intranet zone,
and then the DMZ zone.
Very similar to the one we had last time
except the placement is this firewall can cost
a lot more money than having a standard smaller
firewall and that's why the single firewall
will be used in a smaller network.
Now, if we get to a larger network, we might look at
something that has multi firewalls.
And this is where you have two or more firewalls,
and you put each one at a different control point.
So instead of using a multi interface firewall
like I'd have showed you, we would just put
two different firewalls, one on either side
of the switch blocking off that DMZ,
giving you intranet having it's own zone,
the DMZ having it's own zone and
the internet having it's own zone.
This allows for more stringent controls because
as you go deeper into the network,
it gets tighter and tighter and harder and harder
to get through, based on our ACLs.
Now, why would we use two firewalls instead of just
one firewall like we used in the last example?
Well, with this example you can use
two smaller firewalls like consumer grade
or prosumer grade that are very inexpensive
as opposed to a multi-interface firewall,
which may cost you three, four, five
or six thousand dollars or more.
So, it's more of a cost decision than a security decision
because both of them, you can configure
to give you equal security, both multiple firewalls
or multi interface firewalls.
Now, the next thing I wanna talk about is outsourcing
segments, and a lot of people are always trying to
outsource a lot of their network as a service.
There's things like software as a service and
platform as a service and infrastructure as a service.
Well, when you look at remote services like software
as a service or platform as a service,
you are relying on the service provider
for the security network designs.
You don't get access to those lower layers.
So you really have to trust that outsourcing provider.
Now when you look at directly connecting
your remote network into your network,
this is what we call infrastructure as a service
and you are used to uses with two different
direct VPNs connecting your network
into the provider's network or your virtualized
part of the provider's network.
This is gonna act as an extension of your internet.
And so to your users, it appears that it's all one big
network but really it's your network
and part of your service provider's network.
They have the responsibility for the low level
host protections of those virtual environments
by providing that infrastructure as a service
and they are handled by the third party service provider.
So again, you have a level of trust here if
you are gonna outsource network segments.
Depending on your business model it may or may not
make sense to be outsourcing, depending on the security
you need and the level of trust you have
with that third party provider.