DOCSEARCHbyAlgolia
Submit Docs

Network Segmentation Cheat Sheet

repository·main·Indexed 25 days ago

https://github.com/sergiomarotco/network-segmentation-cheat-sheet

A guide providing best-practice frameworks for corporate network segmentation, ranging from Level 1 (Basic Segmentation) to Level 4 (Advanced Deployment at Scale using air-gap approaches). It includes implementation considerations for isolating production environments, integrating security services like SIEM and PAM, and adhering to DevSecOps standards such as DSOMM and SLSA.

Tokens
853
Snippets
0
Records
6
Agent score
36%

What's inside network-segmentation-cheat-sheet

  1. Implement Level 3: High Adoption of Security Practices

    main

    Level 3 is suitable for organizations where information security risk is treated as a core operational risk, typically requiring a dedicated security unit (e.g., 15-20 employees).

    Key Security Services to Implement:

    • Security Operation Center (SIEM, IRP, SOAR, SGRC)
    • Data Leak Prevention (DLP)
    • Phishing protection
    • Sandbox
    • Intrusion Prevention System (IPS)
    • Vulnerability scanner
    • Endpoint and ATP protection
    • Web Application Firewall (WAF)
    • Backup server

    Disadvantages: High costs for security tools and specialized personnel.

  2. Implement Level 2: Adoption of Basic Security Practices

    main

    Level 2 increases security by adding more network segments within the corporate network and duplicating main supporting infrastructure (e.g., mail relays, time servers) for the production network.

    Key Considerations:

    • DevSecOps: Recommended for safer software development. Implement at least Level 1 of DSOMM, requiring separate storage for secrets (passwords, tokens, keys) and dedicated servers for SAST, DAST, fuzzing, and SCA.
    • SLSA: Alternatively, implement at least Level 2 of SLSA.
    • Advantages: Infrastructure problems in the corporate segment do not affect production, and it is harder for attackers to compromise production.
    • Disadvantages: Increased cost of ownership and high maintenance complexity.

  3. Implement Level 1: Basic Segmentation

    main

    Level 1 provides basic segmentation to protect against targeted attacks and isolates the productive environment from the corporate one.

    Key Considerations:

    • Risk: The corporate network is considered potentially compromised. Workstations (including administrator workstations) have basic/administrative access to the production network.
    • Attack Vector: An attacker compromising a corporate workstation can potentially elevate privileges to attack the production network.
    • Mitigation: To compensate for Level 1, you must install maximum information protection tools, perform real-time monitoring of suspicious events, and ensure immediate response capabilities, OR upgrade to Level 2 requirements.

  4. Implement Level 4: Advanced Deployment at Scale

    main

    Level 4 utilizes an 'air gap' approach where production and corporate services are highly isolated. Each service has its own networks (Tier I, Tier II, Tier III).

    Key Features:

    • Isolated Computers: Production is accessed via isolated computers that have no incoming access except via remote corporate laptops via VPN, and no outgoing access to the corporate network (no mail service, no internal sites/services).
    • Security Services: Implement Privileged Access Management (PAM), internal phishing training servers, and compliance servers (configuration assessment).

    Key Considerations:

    • Advantages: Strong protection against spear phishing; a compromised corporate workstation cannot reach the production network.
    • Disadvantages/Requirements: Users may require two separate computers (one for corporate, one for production). Requires separate LDAP/Domain Controllers for production, and specialized analyzers (firewall, network equipment, netflow).