1 1 00:00:00,300 --> 00:00:01,949 Segmentation. 2 2 00:00:01,949 --> 00:00:03,900 In this lesson, we're going to talk about 3 3 00:00:03,900 --> 00:00:07,260 one major architectural design strategy that you can use. 4 4 00:00:07,260 --> 00:00:09,210 It's called segmentation. 5 5 00:00:09,210 --> 00:00:11,220 Now, segmentation involves taking 6 6 00:00:11,220 --> 00:00:12,810 all of your different parts of your network 7 7 00:00:12,810 --> 00:00:15,090 and then separating them up into different zones 8 8 00:00:15,090 --> 00:00:17,490 or different networks or sub-networks. 9 9 00:00:17,490 --> 00:00:19,440 For instance, here I have multiple people 10 10 00:00:19,440 --> 00:00:21,270 and I want to take all the green people over here 11 11 00:00:21,270 --> 00:00:24,210 and the blue people over here, and the red people over here. 12 12 00:00:24,210 --> 00:00:26,070 By keeping things isolated like this, 13 13 00:00:26,070 --> 00:00:28,290 I can group them based on similar functions 14 14 00:00:28,290 --> 00:00:29,940 and apply different security measures 15 15 00:00:29,940 --> 00:00:31,380 into those different groups. 16 16 00:00:31,380 --> 00:00:33,990 And this is something that segmentation allows us to do. 17 17 00:00:33,990 --> 00:00:34,830 Now, there's lots of 18 18 00:00:34,830 --> 00:00:36,870 different types of segmentation, though. 19 19 00:00:36,870 --> 00:00:38,280 We have segmentation that involves 20 20 00:00:38,280 --> 00:00:40,320 system isolation or air gaps. 21 21 00:00:40,320 --> 00:00:41,310 We have other segmentation 22 22 00:00:41,310 --> 00:00:43,080 that involves physical segmentation, 23 23 00:00:43,080 --> 00:00:45,120 some that involves virtual segmentation, 24 24 00:00:45,120 --> 00:00:48,240 and some that involve zones and access control lists. 25 25 00:00:48,240 --> 00:00:51,090 In this lesson, we're going to review each of these four types. 26 26 00:00:51,090 --> 00:00:53,250 Now, when we talk about system isolation 27 27 00:00:53,250 --> 00:00:56,220 or an air gap, this is a type of network isolation 28 28 00:00:56,220 --> 00:00:59,640 that physically separates a network from all other networks. 29 29 00:00:59,640 --> 00:01:01,800 Now, essentially what you're trying to do here 30 30 00:01:01,800 --> 00:01:04,200 is provide an air gap, a gap of air, 31 31 00:01:04,200 --> 00:01:06,780 meaning there's space between these different networks. 32 32 00:01:06,780 --> 00:01:07,890 So if I wanted to take something 33 33 00:01:07,890 --> 00:01:09,510 from one network to another, 34 34 00:01:09,510 --> 00:01:11,520 I'd have to physically take some data, 35 35 00:01:11,520 --> 00:01:14,310 burn it to a CD, put it on a USB drive, 36 36 00:01:14,310 --> 00:01:15,870 put it on a hard drive, and then carry that 37 37 00:01:15,870 --> 00:01:17,880 over to the other network and plug it in. 38 38 00:01:17,880 --> 00:01:19,680 That's the idea of an air gap. 39 39 00:01:19,680 --> 00:01:21,180 Now, the problem with air gaps is 40 40 00:01:21,180 --> 00:01:23,130 they can create management issues for you 41 41 00:01:23,130 --> 00:01:25,740 because you have to do this cross network transfer 42 42 00:01:25,740 --> 00:01:27,420 when you want to bring things over. 43 43 00:01:27,420 --> 00:01:28,650 For instance, if I want to work 44 44 00:01:28,650 --> 00:01:29,970 on this network that's air gapped, 45 45 00:01:29,970 --> 00:01:31,890 I have to physically walk over to that, 46 46 00:01:31,890 --> 00:01:34,470 plug in a laptop, and then start configuring it. 47 47 00:01:34,470 --> 00:01:36,480 That's not as easy as sitting behind my desk 48 48 00:01:36,480 --> 00:01:38,670 and reaching out to it over the network. 49 49 00:01:38,670 --> 00:01:40,677 Now, why would you want to use an air gap network 50 50 00:01:40,677 --> 00:01:43,380 or use this form of system isolation? 51 51 00:01:43,380 --> 00:01:45,757 Well, let's say you worked for a nuclear power plant. 52 52 00:01:45,757 --> 00:01:47,790 Do you think you'd want to have your 53 53 00:01:47,790 --> 00:01:49,620 nuclear reactor control systems 54 54 00:01:49,620 --> 00:01:52,140 on the internet that anybody can touch? 55 55 00:01:52,140 --> 00:01:53,490 Obviously not, right? 56 56 00:01:53,490 --> 00:01:56,100 This is a great case for having system isolation. 57 57 00:01:56,100 --> 00:01:58,590 So if we can have an air gap between our corporate networks 58 58 00:01:58,590 --> 00:01:59,760 that are connected to the internet 59 59 00:01:59,760 --> 00:02:01,770 and this reactor control network, 60 60 00:02:01,770 --> 00:02:04,350 we can keep that reactor control plant safer. 61 61 00:02:04,350 --> 00:02:06,480 That's the idea here when we deal with air gaps. 62 62 00:02:06,480 --> 00:02:08,670 But again, it does become a management concern 63 63 00:02:08,670 --> 00:02:10,380 'cause every time I do a software update 64 64 00:02:10,380 --> 00:02:12,300 or a firmware update or something like that, 65 65 00:02:12,300 --> 00:02:14,310 I have to physically bring devices 66 66 00:02:14,310 --> 00:02:15,750 and connect it to this network 67 67 00:02:15,750 --> 00:02:17,130 to bring those things with it. 68 68 00:02:17,130 --> 00:02:19,050 And that brings its own vulnerabilities 69 69 00:02:19,050 --> 00:02:21,570 because if I connect that laptop to this network, 70 70 00:02:21,570 --> 00:02:23,310 it now can bring any malware with it 71 71 00:02:23,310 --> 00:02:25,620 from that laptop onto that network. 72 72 00:02:25,620 --> 00:02:26,910 If you look at Stuxnet 73 73 00:02:26,910 --> 00:02:30,270 from back in the early 2010, 2012 timeframe, 74 74 00:02:30,270 --> 00:02:31,470 there was a nuclear reactor plant 75 75 00:02:31,470 --> 00:02:32,917 that got infected with viruses. 76 76 00:02:32,917 --> 00:02:36,180 The way that happened was because of this air gap 77 77 00:02:36,180 --> 00:02:38,790 and somebody carried information from the internet 78 78 00:02:38,790 --> 00:02:40,560 and plugged it into their reactor plant 79 79 00:02:40,560 --> 00:02:42,090 and that caused the infection. 80 80 00:02:42,090 --> 00:02:43,950 So this is the idea when you're dealing with air gaps, 81 81 00:02:43,950 --> 00:02:45,990 you need to make sure you maintain that isolation 82 82 00:02:45,990 --> 00:02:47,280 and anything you're going to plug in, 83 83 00:02:47,280 --> 00:02:49,380 you have to check it twice, three times, 84 84 00:02:49,380 --> 00:02:51,960 and make sure it is absolutely clean. 85 85 00:02:51,960 --> 00:02:54,840 The next type we have is known as physical segmentation. 86 86 00:02:54,840 --> 00:02:56,550 Now, physical segmentation is where 87 87 00:02:56,550 --> 00:02:58,860 each network segment has its own switch 88 88 00:02:58,860 --> 00:03:00,960 and only the devices connected to that switch 89 89 00:03:00,960 --> 00:03:02,430 can communicate with each other. 90 90 00:03:02,430 --> 00:03:04,920 So for instance, if you look at this network diagram, 91 91 00:03:04,920 --> 00:03:07,920 I have an internet, a firewall, and a router, 92 92 00:03:07,920 --> 00:03:09,840 but there's no connection between that router 93 93 00:03:09,840 --> 00:03:12,390 and the wifi or that router and the hub. 94 94 00:03:12,390 --> 00:03:16,320 So all the devices connected to the wifi are in one area 95 95 00:03:16,320 --> 00:03:18,990 and they are physically segmented from everything else. 96 96 00:03:18,990 --> 00:03:20,160 Everything connected to the hub 97 97 00:03:20,160 --> 00:03:22,800 is physically segmented from everything else. 98 98 00:03:22,800 --> 00:03:24,720 And so these are two physical segments. 99 99 00:03:24,720 --> 00:03:26,370 Now, if I want them to talk together, 100 100 00:03:26,370 --> 00:03:28,140 I would connect the router to the wifi 101 101 00:03:28,140 --> 00:03:29,880 and the hub to the router, 102 102 00:03:29,880 --> 00:03:31,950 and now there's a connection path 103 103 00:03:31,950 --> 00:03:34,050 that takes all those devices from the wifi, 104 104 00:03:34,050 --> 00:03:35,580 they can go up through the router, 105 105 00:03:35,580 --> 00:03:37,890 down to the hub, and then over to those devices. 106 106 00:03:37,890 --> 00:03:39,960 Now there's a connectivity between them. 107 107 00:03:39,960 --> 00:03:41,670 So when we deal with physical segmentation, 108 108 00:03:41,670 --> 00:03:43,140 there is a physical segmentation 109 109 00:03:43,140 --> 00:03:45,420 by having those hubs and wifi, 110 110 00:03:45,420 --> 00:03:46,800 even in this configuration 111 111 00:03:46,800 --> 00:03:48,240 where they're connected to the router. 112 112 00:03:48,240 --> 00:03:49,530 Because at the router, 113 113 00:03:49,530 --> 00:03:51,690 we're only routing traffic to those segments 114 114 00:03:51,690 --> 00:03:54,540 based on rules and ACLs, which we'll talk about later. 115 115 00:03:54,540 --> 00:03:56,490 But the physical segmentation part 116 116 00:03:56,490 --> 00:03:58,440 is everything connected to one device. 117 117 00:03:58,440 --> 00:04:00,840 They're all on wifi or they're all on the hub 118 118 00:04:00,840 --> 00:04:03,780 and that way we can physically segment those things down 119 119 00:04:03,780 --> 00:04:05,610 based on that physical equipment. 120 120 00:04:05,610 --> 00:04:07,890 Now, the problem with that is it can get really expensive 121 121 00:04:07,890 --> 00:04:09,630 because if I wanted to have a lot of segments, 122 122 00:04:09,630 --> 00:04:11,490 I have to have a lot of switches. 123 123 00:04:11,490 --> 00:04:14,100 So there's this thing called virtual segmentation 124 124 00:04:14,100 --> 00:04:17,130 and this is where network segmentation relies on VLANs 125 125 00:04:17,130 --> 00:04:19,020 to create the equivalent segmentation 126 126 00:04:19,020 --> 00:04:21,600 that would occur if you use physical switches. 127 127 00:04:21,600 --> 00:04:24,570 So instead of having a whole bunch of switches, 128 128 00:04:24,570 --> 00:04:25,800 I can have one switch 129 129 00:04:25,800 --> 00:04:28,320 and use virtual segmentation using VLANs 130 130 00:04:28,320 --> 00:04:31,320 to create what looks like many other similar switches. 131 131 00:04:31,320 --> 00:04:33,240 You could see here all of these different VLANs 132 132 00:04:33,240 --> 00:04:34,200 have a different purpose. 133 133 00:04:34,200 --> 00:04:36,780 I have one for the wireless, one for the guest wireless, 134 134 00:04:36,780 --> 00:04:39,480 one for the intranet, one for the application servers, 135 135 00:04:39,480 --> 00:04:41,310 one for the department LANs, 136 136 00:04:41,310 --> 00:04:42,690 and all of those type of things. 137 137 00:04:42,690 --> 00:04:45,450 But they all might sit on one 96 port switch 138 138 00:04:45,450 --> 00:04:48,180 one physical switch that is virtually segmented 139 139 00:04:48,180 --> 00:04:50,070 based on those VLANs. 140 140 00:04:50,070 --> 00:04:52,350 Now the next thing we need to talk about is zones. 141 141 00:04:52,350 --> 00:04:54,000 Now zones are the main unit 142 142 00:04:54,000 --> 00:04:55,950 of a logically segmented network 143 143 00:04:55,950 --> 00:04:57,660 where the security configuration is the same 144 144 00:04:57,660 --> 00:04:59,340 for all the hosts within it. 145 145 00:04:59,340 --> 00:05:03,090 So I might create one zone that is my screen subnet. 146 146 00:05:03,090 --> 00:05:04,770 You probably heard that term before. 147 147 00:05:04,770 --> 00:05:05,730 And in that zone, 148 148 00:05:05,730 --> 00:05:08,070 we could put all of our forward facing servers. 149 149 00:05:08,070 --> 00:05:10,320 We'll talk more about that as we go through this lesson. 150 150 00:05:10,320 --> 00:05:11,820 Now, the way we create these zones 151 151 00:05:11,820 --> 00:05:14,010 is by using access control lists. 152 152 00:05:14,010 --> 00:05:15,870 An access control list, or ACL, 153 153 00:05:15,870 --> 00:05:17,910 is a list of IP addresses and ports 154 154 00:05:17,910 --> 00:05:19,470 that are allowed or denied access 155 155 00:05:19,470 --> 00:05:22,020 to a particular network segment or zone. 156 156 00:05:22,020 --> 00:05:23,880 So for instance, here I have a diagram 157 157 00:05:23,880 --> 00:05:25,320 and I have an inside zone, 158 158 00:05:25,320 --> 00:05:27,540 an outside zone, and a screen subnet. 159 159 00:05:27,540 --> 00:05:30,630 So in this diagram, I have things from the outside 160 160 00:05:30,630 --> 00:05:33,540 being allowed to and from the screen subnet 161 161 00:05:33,540 --> 00:05:37,110 but the inside zone can't get traffic from the outside 162 162 00:05:37,110 --> 00:05:39,000 unless they've requested it first. 163 163 00:05:39,000 --> 00:05:42,240 So if I'm on PC two and I go to facebook.com, 164 164 00:05:42,240 --> 00:05:44,490 then Facebook can come in through the firewall 165 165 00:05:44,490 --> 00:05:46,350 and back into the inside zone. 166 166 00:05:46,350 --> 00:05:47,910 That's the way these ACLs were set up 167 167 00:05:47,910 --> 00:05:49,906 to create these three different zones. 168 168 00:05:49,906 --> 00:05:52,920 Now, this is the basics of how a screen subnet works 169 169 00:05:52,920 --> 00:05:54,900 and how you're going to use zones and ACLs. 170 170 00:05:54,900 --> 00:05:56,430 We are going to go more in depth in it 171 171 00:05:56,430 --> 00:05:57,930 as we go through this section.