Improving Network Security Through Segmentation

While segmentation may seem to increase network complexity due to the additional filtering points, a good implementation will improve and simplify security.

Terry Slattery

September 9, 2022

2 Min Read
Improving Network Security Through Segmentation
(Image: Brian Jackson - Alamy Stock Photo)

Good network segmentation is a highly recommended network security practice that requires a firewall policy known as an allow-list or whitelist. How should you go about implementing it?

What is Network Segmentation?

Network segmentation divides the network into security zones that limit the ability for malware to spread within your network. In this security model, firewalls filter traffic between security zones, preventing unauthorized access. This makes it harder for ransomware and data theft to access sensitive data. In contrast, the old network model was based on perimeter firewalls, which made it easy for an intruder to compromise additional systems once internal access was obtained.

Creating zones and building the desired firewall rules are the primary challenge. Let’s say your business uses a typical customer application based on web, application, and database tiers. To protect the database, your network security design could create a network segment for each tier and only allow traffic between the tiers needed for the service to work. In this example, the web tier can only communicate with the application tier. The application tier can only communicate with the web-tier and the database tier using specific protocols. The complication is determining what communications to permit between each tier without consuming a lot of time and without making many mistakes.

Once you’ve identified the security zones, the recommended practice uses a so-called whitelist ruleset, also known as an allow-list, to permit the network communications needed by the applications. The default action of the ruleset is to deny all other traffic. The result is a default deny condition with explicit rules to permit network flows that the applications need.

Use Network Flow Analysis Tools

Now think about all the applications your business uses and the rulesets needed to properly segment the network. Identifying flows for the main applications is generally fairly easy. But don’t overlook communications functions like voice, video (including connection setup, conferencing, and direct calling), chat applications, and SMS. Don’t be surprised by the number of back-office applications like finance, customer management, inventory, manufacturing, and facility management. Finally, you’ll need to identify the protocols used for network utilities like DNS, NTP, and network management. Getting all this right is why one of our clients took over two years to fully implement network segmentation.

Read the rest of this article on NoJitter.

Related articles:

About the Author(s)

Terry Slattery

Principal Architect, NetCraftsmenTerry Slattery is a principal architect at NetCraftsmen, an advanced network consulting firm that specializes in high-profile and challenging network consulting jobs. Terry is currently working on network management, SDN, business strategy consulting, and interesting legal cases. He is the founder of Netcordia, inventor of NetMRI, has been a successful technology innovator in networking during the past 20 years, and is co-inventor on two patents. He has a long history of network consulting and design work, including some of the first Cisco consulting and training. As a consultant to Cisco, he led the development of the current Cisco IOS command line interface. Prior to Netcordia, Terry founded Chesapeake Computer Consultants, which became a Cisco premier training and consulting partner. At Chesapeake, he co-invented and patented the v-LAB system to provide hands-on access to real hardware for the hands-on component of internetwork training classes.Terry co-authored the successful McGraw-Hill text "Advanced IP Routing in Cisco Networks," is the second CCIE (1026) awarded, and is a regular speaker at Enterprise Connect and Interop.

SUBSCRIBE TO OUR NEWSLETTER
Stay informed! Sign up to get expert advice and insight delivered direct to your inbox

You May Also Like


More Insights