-: Segmentation. 2 2
In this lesson, we're going to talk about 3 3
one major architectural design strategy that you can use. 4 4
It's called segmentation. 5 5
Now, segmentation involves taking 6 6
all of your different parts of your network 7 7
and then separating them up into different zones 8 8
or different networks or sub-networks. 9 9
For instance, here I have multiple people 10 10
and I want to take all the green people over here 11 11
and the blue people over here, and the red people over here. 12 12
By keeping things isolated like this, 13 13
I can group them based on similar functions 14 14
and apply different security measures 15 15
into those different groups. 16 16
And this is something that segmentation allows us to do. 17 17
Now, there's lots of 18 18
different types of segmentation, though. 19 19
We have segmentation that involves 20 20
system isolation or air gaps. 21 21
We have other segmentation 22 22
that involves physical segmentation, 23 23
some that involves virtual segmentation, 24 24
and some that involve zones and access control lists. 25 25
In this lesson, we're going to review each of these four types. 26 26
Now, when we talk about system isolation 27 27
or an air gap, this is a type of network isolation 28 28
that physically separates a network from all other networks. 29 29
Now, essentially what you're trying to do here 30 30
is provide an air gap, a gap of air, 31 31
meaning there's space between these different networks. 32 32
So if I wanted to take something 33 33
from one network to another, 34 34
I'd have to physically take some data, 35 35
burn it to a CD, put it on a USB drive, 36 36
put it on a hard drive, and then carry that 37 37
over to the other network and plug it in. 38 38
That's the idea of an air gap. 39 39
Now, the problem with air gaps is 40 40
they can create management issues for you 41 41
because you have to do this cross network transfer 42 42
when you want to bring things over. 43 43
For instance, if I want to work 44 44
on this network that's air gapped, 45 45
I have to physically walk over to that, 46 46
plug in a laptop, and then start configuring it. 47 47
That's not as easy as sitting behind my desk 48 48
and reaching out to it over the network. 49 49
Now, why would you want to use an air gap network 50 50
or use this form of system isolation? 51 51
Well, let's say you worked for a nuclear power plant. 52 52
Do you think you'd want to have your 53 53
nuclear reactor control systems 54 54
on the internet that anybody can touch? 55 55
Obviously not, right? 56 56
This is a great case for having system isolation. 57 57
So if we can have an air gap between our corporate networks 58 58
that are connected to the internet 59 59
and this reactor control network, 60 60
we can keep that reactor control plant safer. 61 61
That's the idea here when we deal with air gaps. 62 62
But again, it does become a management concern 63 63
'cause every time I do a software update 64 64
or a firmware update or something like that, 65 65
I have to physically bring devices 66 66
and connect it to this network 67 67
to bring those things with it. 68 68
And that brings its own vulnerabilities 69 69
because if I connect that laptop to this network, 70 70
it now can bring any malware with it 71 71
from that laptop onto that network. 72 72
If you look at Stuxnet 73 73
from back in the early 2010, 2012 timeframe, 74 74
there was a nuclear reactor plant 75 75
that got infected with viruses. 76 76
The way that happened was because of this air gap 77 77
and somebody carried information from the internet 78 78
and plugged it into their reactor plant 79 79
and that caused the infection. 80 80
So this is the idea when you're dealing with air gaps, 81 81
you need to make sure you maintain that isolation 82 82
and anything you're going to plug in, 83 83
you have to check it twice, three times, 84 84
and make sure it is absolutely clean. 85 85
The next type we have is known as physical segmentation. 86 86
Now, physical segmentation is where 87 87
each network segment has its own switch 88 88
and only the devices connected to that switch 89 89
can communicate with each other. 90 90
So for instance, if you look at this network diagram, 91 91
I have an internet, a firewall, and a router, 92 92
but there's no connection between that router 93 93
and the wifi or that router and the hub. 94 94
So all the devices connected to the wifi are in one area 95 95
and they are physically segmented from everything else. 96 96
Everything connected to the hub 97 97
is physically segmented from everything else. 98 98
And so these are two physical segments. 99 99
Now, if I want them to talk together, 100 100
I would connect the router to the wifi 101 101
and the hub to the router, 102 102
and now there's a connection path 103 103
that takes all those devices from the wifi, 104 104
they can go up through the router, 105 105
down to the hub, and then over to those devices. 106 106
Now there's a connectivity between them. 107 107
So when we deal with physical segmentation, 108 108
there is a physical segmentation 109 109
by having those hubs and wifi, 110 110
even in this configuration 111 111
where they're connected to the router. 112 112
Because at the router, 113 113
we're only routing traffic to those segments 114 114
based on rules and ACLs, which we'll talk about later. 115 115
But the physical segmentation part 116 116
is everything connected to one device. 117 117
They're all on wifi or they're all on the hub 118 118
and that way we can physically segment those things down 119 119
based on that physical equipment. 120 120
Now, the problem with that is it can get really expensive 121 121
because if I wanted to have a lot of segments, 122 122
I have to have a lot of switches. 123 123
So there's this thing called virtual segmentation 124 124
and this is where network segmentation relies on VLANs 125 125
to create the equivalent segmentation 126 126
that would occur if you use physical switches. 127 127
So instead of having a whole bunch of switches, 128 128
I can have one switch 129 129
and use virtual segmentation using VLANs 130 130
to create what looks like many other similar switches. 131 131
You could see here all of these different VLANs 132 132
have a different purpose. 133 133
I have one for the wireless, one for the guest wireless, 134 134
one for the intranet, one for the application servers, 135 135
one for the department LANs, 136 136
and all of those type of things. 137 137
But they all might sit on one 96 port switch 138 138
one physical switch that is virtually segmented 139 139
based on those VLANs. 140 140
Now the next thing we need to talk about is zones. 141 141
Now zones are the main unit 142 142
of a logically segmented network 143 143
where the security configuration is the same 144 144
for all the hosts within it. 145 145
So I might create one zone that is my screen subnet. 146 146
You probably heard that term before. 147 147
And in that zone, 148 148
we could put all of our forward facing servers. 149 149
We'll talk more about that as we go through this lesson. 150 150
Now, the way we create these zones 151 151
is by using access control lists. 152 152
An access control list, or ACL, 153 153
is a list of IP addresses and ports 154 154
that are allowed or denied access 155 155
to a particular network segment or zone. 156 156
So for instance, here I have a diagram 157 157
and I have an inside zone, 158 158
an outside zone, and a screen subnet. 159 159
So in this diagram, I have things from the outside 160 160
being allowed to and from the screen subnet 161 161
but the inside zone can't get traffic from the outside 162 162
unless they've requested it first. 163 163
So if I'm on PC two and I go to facebook.com, 164 164
then Facebook can come in through the firewall 165 165
and back into the inside zone. 166 166
That's the way these ACLs were set up 167 167
to create these three different zones. 168 168
Now, this is the basics of how a screen subnet works 169 169
and how you're going to use zones and ACLs. 170 170
We are going to go more in depth in it 171 171
as we go through this section.