Network Segmentation

Remember back in elementary school when somebody got in trouble? Maybe they were picking on somebody else, or whatever they were doing, they got separated from the rest of the group. They got in trouble and then they got put in the timeout corner. They got sat at a desk, or they got sat in the corner, or they got sat somewhere where they were separated from everyone else. That's because it's a form of security: when somebody is not there, they can't cause problems. It's the same thing with our networks. By separating things out, we reduce the amount of impact problems can have on our network.

Why segment

Imagine you were assigned to the sales team. You were part of the sales team of a company and you needed access to certain resources to do your job, but not every resource in the company. You wouldn't need access to every single resource in the company. Maybe we have operations and management, and you probably wouldn't need access to those files and folders.

Now, you're a pretty trustworthy person — or at least I hope you are — so it doesn't really matter if you have access to those. You're not going to abuse that. But there are those out there that would abuse this. Not only that, but if your account was ever compromised and you had access to these things, that could be problematic, because now the attacker has access to those things.

So what we want to do is segment things out, separate them out. Maybe it's different file shares, maybe it's different servers, maybe it's different networks, but somehow we need to do segmentation. One of the ways we can do this is through network segmentation, and actually have a separate network for each one of these devices. This makes it much more difficult, if one device were to be infected or have some sort of issue, to carry over into other areas of the company. So network segmentation can add a lot of security.

A great example of this is a separate guest network. If you had a guest machine that was connecting to the rest of your network, then what could happen is they would have access to maybe some resources like machines or servers on your network that you might not want them to have access to. So instead, you give the guests access to a whole other network, something that's separated out and is different than the main network here. So this is a great example of segmenting your networks.

What a local area network is

Before we get too in depth into segmenting the network, let's take a look at what a local area network is. A local area network is a bunch of devices that can communicate with each other, and they are usually connected with something like a switch. So here we have a switch and we have these devices on this network that are interconnected from what we call a layer 2 standpoint. That is, this is a single broadcast domain. So when one device needs to talk to another device on here, they'll start maybe by doing an ARP request, which gets broadcasted out and sent to all devices on this network. And so all devices on this network really have a close communication with each other.

This communication is happening at layer one and two. There are certain protocols that are associated with this that do have some weaknesses, in that there is a lot of open communication that happens at this level. Whereas we don't see as much on layer three. We can do some filtering, and much of the open communication doesn't extend past other networks into other layer 3 networks.

Just a few of the concerns: broadcast and multicast really hit a large number, or all, of the devices on a local area network, so the communication is just happening in the open. It's also very easy to spoof something like a MAC address and pretend to be one of the other devices on the network, and so this is a very easy attack to carry out there. Also, we can't really put firewalls and access lists at a layer three level on this layer 2 network. So there's still a lot of open communication that happens, and there's much greater device-to-device access and communication that happens at this layer 2.

Natural and deliberate segmentation

Sometimes we naturally just create segmentation. For instance, we have a local area network over here and a local area network over here, and then we have a WAN connection in between. This geographically could be separated by many, many, many miles, and so it just naturally lends itself to creating these different segmentations. Communication that happens at layer 2 on this side doesn't get transmitted over to here. That all happens through layer three. And so what happens is we end up with a more secure aspect when we break it apart this way.

But we could be all sitting in one central location, one office, one headquarters, and from there we can still do segmentation. It doesn't need to have WAN connectivity in between. So maybe we separate it out and we have operations, sales, and a guest network. Even though it's all at the same location, we separate it out. That way we don't have as much of this layer 2 communication that's happening between these networks, and what communication there is, we can control better.

Ways to break it apart

In this example, we have operations, sales, and a separate guest network. But there are a lot of different ways that we could break this apart. We could do administration, faculty, and students — this is a common setup that I've seen in schools.

Or what we can do is do it by the risk level, or how secure the network needs to be. In this case right here we have a management access network that gains us access to only the management interfaces of these devices — maybe switches, routers, servers, that type of thing. Then maybe we have this high-level access area that we really need to safeguard, where resources are at that need a high level of control. And then maybe we have a low level of control, and so that's a separate network. So there's a lot of different ways that we can break out these different segmentations.

Then at the front of each one of these, we put some sort of network security device. In this example right here, we've got a firewall set up, and that will control the access into this local area network. Or in the examples where we have these different networks here, they may be part of the same site, and what's separating those is a firewall that controls the flow of information between these different segments.