Any type of enterprise environment needs to be set
up from the get go as a secure environment,
including security at the basis or the
foundation of our environment makes a lot more
sense than coming in halfway through the
process and then spending exorbitant amount of money
as well as time and manpower and labor to go back through
and reconfigure items or change items to ensure that secure environment further.
It's never as secure that it could have been if
it was designed from the outset as just being secure
within this chapter, we're going to talk about different hardware mechanisms,
curations, policies and procedures,
but we're really going to dive into a zero
trust environment as well as what that entails.
We're going to discuss secure access, secure edge and how it's inter
within our enterprise environment.
And then finally, software defined networks,
how those are utilized to ensure rapid Scalability and security.
As a modern technology has evolved,
network segmentation is the art of segmenting our networks away from one another.
Meaning that if I have one network
that's operating on one department say operations
and I have another department say hr operating on another part of our network.
I really don't want the two to intertwine with each other.
There's no reason for hr, to have access to our servers or it,
infrastructure or anything that encompasses technology that's not their job.
At the same point, we don't want to have our operation department.
I er, it specialists and our cybersecurity people talking to.
Hr, that doesn't mean we don't want to talk to hr,
but we don't want to have access to hr information.
Hr has a lot of
bias regulations and federal mandates in place and it just doesn't make sense
for having it guys to have access to that data or that information,
we call that network segmentation,
but it provides us a little bit more details as far as security is
concerned as well by not allowing those two arms to talk to another through.
We're also making a more secure environment.
If our hr department accidentally clicks on a fishing lake,
they now do not have access into our operations department's infrastructure.
This provides kind of a line in the sand that says, hey,
you guys are split and even if one department is taken over or has malware,
it's not going to affect our entire company.
Network segmentation provides us with security.
In that, in that aspect, it also provides us some performance capabilities
by having the HR departments set up as their own little subnet
within our infrastructure environment.
They're going to be able to talk to another a lot quicker than if they were
combined with other departments as their different IP
addresses trying to go through the process.
Also, there's different servers that are usually related or,
or reserved for different departments.
And so having hr specific to an hr server which
is in the same segment allows for better performance management.
Uh those of those different types of infrastructure.
Finally, there's a compliance point of it, right? If I'm doing IP S or C
PCI, DS S or HPA or some other form of regulatory requirement for compliance,
I need to make sure that my systems are separated,
that they're encrypted and that access is only the way it's
whether you're dealing with PCI DS S or HPA or Fer
RPA or any of those other requirements that come into play,
we need to make sure that compliance is
at the forefront of our network architecture.
Usually segmentation
provides us a lot of movement or a lot of, of
uh elation between those two different or
a zero trust environment is usually what we
go for at any type of security infrastructure
that means that we're going to verify everything that you tell us. Right?
Zero trust means I don't trust you as far as I can throw you.
You've probably heard that scene before, right?
But when it comes to it, it's literally what we're going to utilize.
You can come in and say hi. My name is Chet and I'm here to teach cybersecurity.
But you're only to ask me, what's your ID? Can you provide a pin number for that?
Let's use some Multifactor authentication to verify what you just told us,
verification in a zero trust environment really
is authenticating authentication where we're going through.
And we're saying I need you to provide more than
just the number and username that you're associated with your
account so that we can verify you are who you say you are.
There's a least privileged aspect as well.
If I'm an it guy or a cyber guy, and I work specifically with servers,
then I don't need access to say, client machines or endpoints.
Maybe my job has nothing to do with
firewalls by using the principle of least privilege.
We're only allowed to have access to things that we need.
And since we talked about hr Department, that's an aspect of least privilege.
Why it guys do not need access to? Hr And hr does not need access to it.
That's a principle of least privilege.
Often you'll see at least privilege uh
uh within a least privileged environment where somebody
gets promoted or moved out or changed to a different department or maybe they,
their roles within the department has changed.
When I worked for a different company.
My primary responsibility was actually at the switch where we would control
different cellular towers and how those towers interacted with one another.
That was my job. I was the guy that programmed all those cell towers,
we
talk to another, we call that handovers.
And there was a lot of programming that went into it. That was my first job.
Then I moved on to actually sell towers and working on
equipment at the bottom of the towers.
When that occurred,
my privileges to the cell infrastructure to the switch infrastructure was cut off.
There was no reason for me to have continued access into that switch environment.
And when I went over to cell towers,
they then allowed me to work on the equipment at the bottom of the towers,
I gave permissions to work on that role of it.
So that least privilege goes both ways.
We want to cut off and we only want to provide access to the
tools that we actually need to do the job.
We want to continually monitor those users as well.
If I give my hr department access to HR tools,
then I need to monitor what they're doing.
We're not just going to say, oh yeah,
you work at HR and so you have access to all these tools and that's great.
We want to monitor and see what they're doing.
If you see a user that's never used the server that we
put in place for them that had PI I data on it,
then it may be time to cut off that access point.
However, if they suddenly start accessing it at 2 a.m. in the morning
and they never had before then, that monitoring is going to lead us into a problem.
And we need to identify that problem very quickly,
very efficiently and then cut it off before it starts.
So that continual monitoring,
a process not only between roles and job
functions also provides us a little bit of latitude
security.
Our secure access, secure edge or
Sassi is an environment that is software based,
providing a simplified management structure to
consolidate items such as firewalls,
web, secure gateways,
and a zero trust network access point that unifies our cloud
native model into an infrastructure that
allows flexibility and secured methodology.
When it comes into that environment
fasi enhances an organization's security posture by controlling
access and swiftly identifying and mitigating those threats.
Within a cloud based architecture.
They can buy network and security functions and
allow for a zero trust access based environment
that allows us to quickly identify different threats and threat vectors.
A software defined network or Sdn provides a centralized
point to configure different aspects of our network.
When you take a software defined network,
realize that it is basically just a regular network that you may see on prev
but it's utilized in
configurations.
We're using programmability,
we're using the process of software to identify
and manage our software in a seamless environment.
That is also on
this means that while we've talked about
a virtual environment or containerized environment to quickly
scale up or scale back different aspects
of our enterprise environment within an Sdn.
We can actually do that.
This is the focal point of network architecture within that environment.
Within a virtual network.
We identify different network segmentations, zero, trust,
Sassy and Sdn and went through the different processes and how they
interact with one another.
The main points you need to get out of this
chapter was that we need to put network security at the or fraud
and bring it from the foundation up.
If you're trying to implement security infrastructure in
the middle or even end of your network,
you're going to find gaps, you're not going to get everything.
And so proper planning really does lead to a more effective and more secure network
intru
utilizing either
Sasi or Sdn with our.