- Now in this lesson 9.2, we're gonna look at
one of the ultimate techniques we use to secure
the enterprise which is segmentation and isolation.
Segmentation or segmenting an enterprise
into discreet security zones is really useful
for creating and enforcing security policies,
controlling information flow,
and for securing network access.
Now, security zones are going to be divisions
of a network based on functional, performance,
and/or security requirements.
Now, our security zones are going to be enforced
by firewall ingress, its incoming,
and egress, outgoing, access control lists
that we refer to as ACLS or rules.
So let's talk about some of the most common security zones.
We have untrusted zones, a screened subnet,
a trusted zone, an enclave zone, an air gapped zone,
a physically isolated zone, a wireless zone,
and a VPN, a virtual private network.
Now these all stand in contrast
to our discussion about zero trust.
Remember, in zero trust we said nothing is trusted, right?
Everything is untrusted, and you know,
we don't trust our devices, we don't trust anything.
But assuming you're not in a zero trust environment
and we're in sort of a more conventional environment,
we will probably segment our network
into these security zones.
So let's talk about what these zones are.
An untrusted network is one which
the organization has no control over.
What's the most common untrusted zone out there?
You know what it is.
It's the internet.
A screened subnet is going to be a zone that has connections
to both untrusted and trusted networks.
Now, we used to refer to that as a DMZ.
A good example is we might have a web server, right,
that has connections to an untrusted network,
to the internet, and to a trusted network
back into our private network.
A trusted network is one over which
the organization does have complete control.
An enclave network is gonna be
this restricted network within a trusted network.
So we have a trusted network and inside it we have
an even more trusted network called an enclave network.
And maybe that's where your database servers live
or your authentication servers are.
An air gapped network is one that does not connect
to any untrusted network or to any network
that connects to an untrusted network
no matter how far down the line we wanna go.
A physically isolated network is one that
doesn't connect to any other network, period, that's it.
A wireless network, well, that's one that
supports wireless transmissions.
And lastly, a VPN or a virtual private network
is designed to facilitate secure communications
over a public circuit.
Another type of segmentation is known as micro-segmentation.
And we tend to see micro-segmentation
either in a data center or up in the cloud infrastructure,
so not apparent to the end user,
but how the cloud is configured and structured.
So I wanna talk about what micro-segmentation is.
I wanna define east-west and north-south traffic,
talk about what a protect surface is,
and then once again, circle back to the idea of zero trust.
So micro-segmentation is a method of creating
these sort of micro zones if you will within a data center
and cloud environments in order to isolate workloads
from one another and to secure them individually.
Now when you hear the term north-south, we're referring to
traffic that flows in and out of a data center.
And when you hear the term east-west,
we're talking about traffic that flows
within the data center or within the cloud environment
and generally through various micro segments.
Now, the protect service is made up
of your network's most critical and valuable data, assets,
applications, and services known as DAAS,
data, assets, applications, and services.
And here's the thing about the protect surface.
It's always knowable.
These are your most valuable and most critical assets.
You will always know what they are
or should at least always know what they are,
which stands in stark contrast to your entire network,
where there may be things that
you have no idea what they are.
They might be things a vendor brought in,
things that user brought in.
The protect surface is your network's most critical
and valuable data, assets, applications, and services.
And bearing in mind it's always knowable.
So what does that mean?
That means that micro-segmentation allows us
for the implementation of what's known
as a zero trust protect surface environment.
Protect surface, that was our most valuable assets, right?
DAAS.
It allows us to take that area, right,
put a boundary around it,
and say this is going to be a zero trust environment.
So assuming we're not zero trust
in our entire enterprise or infrastructure,
we can have a more conventional infrastructure
but we can say in our protect surface area
we're putting a boundary, right, around those assets.
And for those, we're gonna configure as zero trust.
And in zero trust, authentication is always required
and re-authentication, and it enforces
the least privileged access.
So you're only gonna get access
for what you need to do for a limited amount of time.
So that's a really good way of thinking about how do we,
in our more conventional environments, also take advantage
of the power of a zero trust environment.
Now, another way to segment is referred to as isolation.
Isolation is when a zone or a device or a session
or even an individual component needs to be segregated
from others so as not to cause harm or to be harmed.
Now, there are two different types of isolation
I wanna introduce you to.
Virtualization and logical.
The virtualization technology creates multiple environments
from a single physical hardware system.
And I know many of you work in virtual environments.
You work with virtual machines or virtual desktops
or virtual network devices.
So what these virtual devices do really is provide
fault and security isolation at the hardware level
including memory and CPU access.
Another way to do isolation is logical isolation.
And really the best example of logical isolation
would be a VLAN, a virtual local area network,
which divides a single existing network,
a physical network into multiple logical network segments
which then can be restricted.
And our broadcast domains are portioned
and they're isolated at the data link layer.
And that, my friends, brings us
to the end of this particular lesson.
So you ready for a three-second challenge?
Let's do it.
A zone that connects to both trusted and untrusted networks.
What's it called?
One, two, three.
That's gonna be a screened subnet.
Question two, a network that's isolated
from any untrusted network.
One, two, three.
It's gonna be air gapped.
Number three, technology that creates
multiple isolated environments
from a single physical hardware host.
One, two, three.
And that's virtualization.
And if you're thinking, "Yeah, we didn't spend much time
talking about virtualization," no worries.
We're going to be talking about it a little bit later on.
Question four, a method to isolate data center workloads
and secure them individually.
One, two, three.
And that's micro-segmentation.
And lastly, number five, made up of
the network's most critical and valuable
data, assets, applications and services, DAAS.
What is that called?
It's what allows us to implement a zero trust environment.
One, two, three.
And that's gonna be our protect surface.
Right, that brings us to
a security-in-action about segmentation.
So your company is considering moving your infrastructure
to an outsourced data center.
Now the vision is that users would VPN in to the data center
from wherever they happen to be located.
However, there is a concern about critical system exposure.
So you've been tasked with investigating
various data centers in your geographic area.
Now on one of your tours, the guide extols
the virtue of east-west data center micro-segmentation
and air gapped networking.
So here's my question to you.
Are these concepts applicable to your organization?
So you're looking to move, right,
your infrastructure to this outsourced data center.
We do have users who are gonna VPN in
from wherever they are, but we do have a concern
about critical system exposure.
We wanna protect our most critical assets.
So our tour guide says,
"Wow, this is just a great place for you.
We have east-west data center micro-segmentation
and we have air gapped networking."
And I want you to tell me is that gonna work for you.
So go ahead, put me on pause,
jot down some notes, and then come on back,
and we'll talk about the applicability.
So for sure east-west micro-segmentation is worth exploring.
Right, an advantage to that design
is it reduces the surface available
for malicious activity and it allows the implementation
of targeted security policies.
So for your most critical systems,
thinking about this east-west micro-segmentation
really does make a lot of sense.
But the other part, the fact that
it's an air gapped network doesn't work, right?
An air gapped network is isolated
from any wired or wireless untrusted network
or to any computers that connect
to an untrusted network or any network that
connects to an untrusted network.
And that design isn't gonna work specifically, right,
because what we're saying here is your network
needs to be connected to the internet for VPN access.
And what is the internet but really
the ultimate untrusted network.
So being able to kind of dissect, right,
what someone's saying to you, it's like,
"Oh, this is both great things."
I want you to be able to say,
"Well no, they're not necessarily applicable, right?
They don't necessarily meet what my organization needs.
They don't necessarily strategically align
with the needs of my organization."
And being able to do that, my friends,
is without a doubt security-in-action.
There's your word cloud.
There's quite a bit here again.
You know what to do, make sure you really, really understand
all of these terms and concepts before moving on.
But when you're ready, we're gonna do
a five-question quiz together.
I'll see you there.