Pocket Guide: Network Segmentation

Idea

Network segmentation, also known as subnetting, aligns well with the concept of separate IT environments. In a typical network design, production (where applications run live), non-production (testing and development), management, web server, application server, and database environments reside on separate subnets.

Segmentation isolates the environments and thus reduces the “blast radius”. Network communications are typically unrestricted within the subnet, so we assume that if an element (machine or container) within subnet is compromised, then the entire subnet is compromised.

The primary goal of network security is to maintain this isolation and control communications between segments.

Security Architect love the art of designing the network with sufficiently isolated, yet interconnected segments. The typical design is 3-tier architecture, with web, application, and database environments segregated. As a rule of thumb – environments with different “trust level” should be segregated. Segregation of production and non-production environments is a must.

Intra-segment communication should be denied by default. To connect authorized devices and services between environments, a security gateway, often a firewall, is introduced. Firewalls filter traffic based on various criteria like protocol type, source and destination IP addresses, ports, and direction of traffic. There are two main types of firewalls:

• Stateful firewalls: Stateful firewalls keep track of established connections, allowing for more robust security and easier configuration. By monitoring connection tracking tables, they can identify and block suspicious traffic not related to an existing connection, preventing attacks like port scanning.
• Stateless firewalls: Stateless firewalls make decisions based solely on individual packets without considering connection context.

Web Application Firewalls (WAFs) are another type of specialized firewall, operating at the HTTP(s) layer. By understanding the protocol used by web applications, WAFs can prevent common web attacks like SQL injection (SQLi), cross-site scripting (XSS), and cross-site request forgery (CSRF).

Application examples

Corporate local area networks are typically considered medium-trust environments, while database networks are considered high-trust environments. Therefore, they are usually segregated.

Risks

It is speculative to assume that the breach would be contained within a subnet, as various scenarios are possible. We do need to assume the blast radius to calculate the risk, though.

Cloud tenant segregation is often overlooked. Cloud providers commonly host multiple tenants on the same hardware. This can lead to performance issues from a “noisy neighbour” consuming resources, but more importantly, it creates vulnerabilities. Attacks like Spectre and Meltdown may exploit hardware flaws to steal data from co-located processes, become a risk in shared environments. While dedicated resources might come at a higher cost, segregating your most security-sensitive workloads on isolated hardware offers significant security benefits.

Quirks

Zero Trust is an interesting framework, which is based on the principle of “never trust, always verify.” It assumes no user or machine, whether inside or outside the traditional subnet, should be implicitly trusted. You can think of it as extreme micro-segmentation, where the network segment is reduced to a single resource or workload.

In container environments, multiple workloads can share the same underlying machine (node). Because the node’s subnet doesn’t provide sufficient isolation for individual container workloads, namespaces are used to create a separate layer of isolation at the operating system level.

Further reading

Pocket Guide: Integration Security

Pocket Guide: Machine and Container Security

Please check out the map of cyber security controls below. It is simple yet awesome.