>> Continuing on with network
>> security architecture Part 2.
>> The learning objectives for this lesson are to
show how network segmentation improves security,
to explain deperimeterization and
how it relates to zero trust,
and to demonstrate the use of
Software Defined Networks in secure architecture.
Let's get started. Network segmentation.
Network segmentation simply means
breaking a network up into smaller parts.
But for security, the reason we might want to do
this is that some parts of our network
may contain data that we don't want
necessarily want everyone on
the network having access to,
so for example, a corporation's,
HR department may need to
be on its own separate segment of
the network so that it's separated from everyone else.
Another reason for security
that you might want to segment
your network is that if
one part of the network would have become compromised,
it wouldn't bring down the rest of the network.
We can accomplish this through a variety of technologies.
The first is subnetting,
simply breaking the network into smaller pieces.
The next is virtual LANs or VLANs.
These are software-defined and they're usually
performed by your managed network switches.
This allows for one device
to separate your network traffic.
We can also use a screened subnet.
This is placing two firewalls on either side of the DMZ.
The firewall that faces the
outside is known as a screening firewall
and the one that faces the
inside is known as a choke firewall.
We can also use environments
to help us segment our network.
A staging environment is where we
create an exact duplicate of
our production environment for
the purposes of testing new software,
security patches, hardware, or setting changes that we
might want to use before
pushing it out to our production environment.
We could also use a guest environment
which is an isolated network,
completely removed from our production network
to allow guest access.
We can use access control lists
to help us with segmentation.
An access control list simply allows data to flow
or to be denied based on
the rules that are set up in the control list itself.
In networking, this is usually handled by
switches and routers who may or
may not allow access to
data based on their own individual ACLs.
We can also use a jump box
to help us segment our network.
A jump box is a hardened and monitored system
that is used to perform administrative functions.
The reason this is a really smart
>> thing to do is that in
>> larger environments you may have many devices
that need to be configured, such as firewalls,
switches, routers,
and you don't want to
perform those from your own workstation,
the one that you're checking email on
or browsing the web or that thing.
A jump box is one that you would log into remotely,
perform all the functions from there,
and then when you're done, you come
back to your regular workstation.
What this does is it allows
one device to have all the credentials,
rather than having it on a workstation that
has a higher chance of being compromised.
We can also air gap,
which is when we physically remove
and disconnect a host from any network.
It's not connected to a network,
it's a lot harder to get to.
We also have a peer-to-peer environment.
These are decentralized networks that provide
services only when you're connected to them.
An example of that today will be
the Tor network, but if you're old school like me,
you might remember Napster.
Cloud-based network segmentation.
The first thing we can use is micro-segmentation,
which is isolating workloads from each other
and then we protect those workloads individually.
We can use virtual private Clouds or virtual networks.
This allows for creating
Cloud resources within a private network.
The last part is Nac lists,
pronounced nackles, but it
stands for network access control.
These are used to control
inbound and outbound traffic between VPCs.
Think of these as just simply ACLs
for your Cloud segmentation.
We can also use security groups.
It's a virtual firewall that limits
inbound and outbound traffic
to a particular Cloud instance.
Regions are the physical location of
our data centers in a globally distributed Cloud.
With Cloud-based network segmentation,
we have data zones.
A data zone simply describes the state and
the location of the data
and how to isolate and protect it.
The first is our raw zone.
This is where data is collected from multiple sources.
Then we go to our structured or curated zone.
In this zone, the data that was collected in
the raw zone is checked for
quality and then it's reformatted
for users to make use of later.
Then we have our analytical zone
and at this zone is where the data is ready
to be used by
the different users for
their particular purposes, such as reporting.
Software defined networking.
The first thing you have to understand with
software defined networking is
to understand what a plane is.
Well, a plane is
just an abstract model that was created to help
us understand software defined networking and in SDN,
we have three different planes.
The first plane is our control plane.
The control plane decides on the traffic priority and
its security and where the data should be switched.
The data plane is the one that handles
the actual switching of the data and routing of traffic,
but it also controls ACLs.
Finally, we have our management plane,
which monitors traffic and
conditions of the overall network.
Think of this as making sure
everything is working well together.
We have three different approaches to SDN.
The first is open SDN,
which makes use of open source and open
standards so that we're not
locked into one particular vendor.
We can also make use of a hybrid SDN,
which uses SDN along
with traditional networks, and they work together.
Finally, we have our SDN overlay.
This uses our existing hardware with the software,
and it allows us to create and
manage new virtual networks.
The overlay is what's responsible for
moving data across physical network infrastructure,
but the SDN is the one managing it all.
The network hardware is moving the data,
but it is controlled by the SDN.
No longer the switches or routers are in control,
the software is the one moving everything
around or controlling the moving.
Deparimeterization.
Up until recently,
you could think of our networks as a castle.
Castles have high walls.
They have towers to watch over everything.
They have gates to control access so
that you can know who's coming in and who's going out.
This is how our networks were.
We had firewalls, intrusion detection systems,
and we were very focused on users and assets.
However, the world is
changing and with that change and that access to data,
we've had to come up with a new system.
Some of the trends that are helping
pushing us towards that,
our remote work, mobile usage in the Cloud adoption.
With mobile usage, now we
have devices that are outside of
our network that need access to our data at all times,
and with Cloud adoption,
it's a similar thing where our data is no longer
behind our closed walls or castle walls,
it is now on a server somewhere else.
Our data being scattered across
the world and then also having need of it
24/7 has changed our approach to controlling
access to our data and that leads us to zero trust.
You can think of zero trust as never trust,
always verify, and always assume breach.
Every connection and request
is individually evaluated, and then validated.
It focuses on resources rather than users and assets,
and if you'd like to read more about zero trust,
you can read the NIST special publication,
800- 207: Zero Trust Architecture.
Network Integration.
There are a lot of different things that
impact how our networks are integrated together,
so for example, with peering,
we're connecting virtual private Clouds
together with a VPC peering connection,
but we also have mergers and
acquisitions to think about when
a company buys out another one
or it merges with another one,
we have to find a way to
integrate those networks together.
We also have directory services.
This is similar to a database that
contains attributes for users,
security groups,
and devices for the purposes of privilege management.
The active airectory for
Microsoft is a directory service.
We also have federation.
This is simply trusting the accounts
created and managed by another organization.
Identity providers and testing.
This is a four-step process.
I'm going to break it down to make
it in its most basic form.
If a user wants to access
a service or data at a service provider,
they will be redirected to an identity provider.
The user authenticates with
the identity provider and they will
receive an attestation of identity.
This is usually in the form of a token.
The user then takes that token
or attestation and presents it
back to the service provider
and then based on that token,
the service provider will allow access to the user.
Let's summarize what we did.
We discussed various ways we can
segment networks, including Cloud networks.
We discussed software-defined networks and their parts.
We went over deperimeterization and how that is
shifting us towards zero trust and finally,
we went over the different types of network integration.
Let's do some example questions.
Example 1, what type
of device would be described as being
a hardened and closely monitored system
for performing administrative tasks?
Jump box. We use these
so we can configure routers, firewalls,
and switches from a hardened system,
rather than doing it from our own workstations.
Number 2. What type of environment
is a mirror of the production environment and is used
to test the changes to hardware and software
before implementing those changes
on the production network?
Staging environment. Example 3.
What process is described as isolating the workloads
themselves from each other
and protecting them individually?
Microsegmentation.
Finally, Question 4.
What type of architecture considers everything to be
external and follows the never trust,
always verify and assume breach?
Zero trust architecture.
I hope this lesson was helpful to you,
and I'll see you in the next one.