Any type of enterprise environment needs to be set up from the get go as a secure environment, and
putting security at the basis or the foundation of our environment makes a lot more sense than coming
in halfway through the process and then spending an exorbitant amount of monies, uh, as well as time
and manpower and labor, to go back through and reconfigure items or change items to ensure that secure
environment.
Further.
It's never as secure that it could have been if it was designed from the outset as just being secure.
Within this chapter, we're going to talk about different hardware mechanisms, the different configurations,
policies and procedures.
But we're really going to dive into a zero trust environment as well as what that entails.
We're going to discuss secure access, secure edge and how it's intertwined within our enterprise environment.
And then finally software defined networks and how those are utilized to ensure rapid scalability and
security as a modern technology has evolved.
Now, our segmentation is the art of segmenting our networks away from one another, meaning that if
I have one network that's operating on one department.
Say operations, and I have another department say HR operating on another part of our network, I really
don't want the two to intertwine with each other.
There's no reason for HR to have access to our servers or our IT infrastructure or anything that encompasses
technology.
That's not their job.
At the same point, we don't want to have our operations department, i.e. our IT specialists and our
cybersecurity people talking to HR.
That doesn't mean we don't want them talking to HR, but we don't want to have access to HR information.
HR has a lot of compliance regulations and federal mandates in place, and it just doesn't make sense
for having IT guys to have access to that data or that information.
We call that network segmentation, but it provides us a little bit more details as far as security
is concerned as well, by not allowing those two departments to talk to each other through technology.
We're also making more secure environment.
If our HR department accidentally clicks on phishing link, they now do not have access into our, uh,
operations department's infrastructure.
This provides kind of a line in the sand that says, hey, you guys are split, and even if one department
is taken over or has malware, it's not going to affect our entire company.
Network segmentation provides us some security in that.
In that aspect, it also provides us some performance capabilities by having the HR department set up
as their own little subnet within our infrastructure environment, they're going to be able to talk
to one another a lot quicker than if they were combined with other departments, as their different
IP addresses kind of go through the process.
Also, there's different servers that are usually related or reserved for different departments.
And so having HR specific to an HR server, which is in the same segment, allows for better performance
and management, those of those different types of infrastructure.
Finally, there's a compliance point of it, right?
If I'm doing IPS or PCI, DSS or HIPAA or some other form of regulatory requirement for compliance,
I need to make sure that my systems are separated that they're encrypted, and that access is only the
way it's supposed to go, whether you're dealing with PCI, DSS or HIPAA or FERPA or any of those other
requirements that come into play, we need to make sure that compliance is at the forefront of our network
architecture.
Usually, segmentation provides us a lot of movement or a lot of of delineation between those two different
departments.
A zero trust environment is usually what we go for at any type of security infrastructure.
That means that we're going to verify everything that you tell us, right?
Zero trust means I don't trust you as far as I can throw you.
You've probably heard that scene before, right?
But when it comes to it, it's literally what we're going to utilize.
You can come in and say, hi, my name is Chet, and I'm here to teach cybersecurity, but you're going
to ask me, what's your ID?
Can you provide a Pin number for that?
And let's use some multifactor authentication to verify what you just told us.
Verification in a zero trust environment really is authenticating authentication where we're going through.
And we're saying, I need you to provide more than just the Pin number and username that you're associated
with your account, so that we can verify you are who you say you are.
There's the least privileged aspect as well.
If I'm an IT guy or a cyber guy and I work specifically with servers, then I don't need access to,
say, client machines or endpoints.
Maybe my job has nothing to do with firewalls.
By using the principle of least privilege, we're only allowed to have access to things that we need.
And since we talked about HR department, that's an aspect of least privilege.
My IT guys do not need access to air, and air does not need access to it.
That's a principle of least privilege.
Often you'll see in least privileged, uh, within the least privileged environment where somebody gets
promoted or moved out or changed to a different department, or maybe their their roles within that
department has changed.
When I worked for a different company, my primary responsibility was actually at the switch, where
we would control different cellular towers and how those towers interacted with one another.
That was my job.
I was the guy that programmed all those cell towers to talk to one another.
We call that handovers, and there was a lot of programming that went into it.
That was my first job.
Then I moved on to actually cell towers and working on the equipment at the bottom of the towers.
When that occurred, my privileges to the cell infrastructure, to the switch infrastructure was cut
off.
There was no reason for me to have continued access into that switch environment.
And when I went over to cell towers, they then allowed me to work on the equipment at the bottom of
the towers.
I gained permissions to work on that role of it so that least privilege goes both ways.
We want to cut off, and we only want to provide access to the tools that we actually need to do the
job.
We want to continually monitor those users as well.
If I give my HR department access to HR tools, then I need to monitor what they're doing.
We're not just going to say, oh yeah, you work at HR and say you have access to all these tools,
and that's great.
We want to monitor and see what they're doing.
If you see a user that's never used the server that we put in place for them that had PII data on it,
then it may be time to cut off that access point.
However, if they suddenly start accessing it at 2 a.m. in the morning and they never had before, then
that monitoring is going to lead us into a problem, and we need to identify that problem very quickly,
very efficiently and then they cut it off before it starts.
So that continual monitoring, a process not only between roles and job functions, also provides us
a little bit of latitude when it comes to security.
Our Secure Access Secure Edge, or Sassing, is an environment that is software based, providing a
simplified management structure to consolidate items such as firewalls with secure gateways and a zero
trust network access point that unifies our cloud native model into an infrastructure that allows flexibility
and secured methodologies when it comes into that environment.
Fastly enhances an organization's security posture by controlling access and swiftly identifying and
mitigating those threats within a cloud based architecture.
They combine network and security functions and allow for a zero trust, access based environment that
allows us to quickly identify different threats and threat vectors.
A software defined network, or Sdn, provides a centralized point to configure different aspects of
our network.
When you think a software defined network, realize that it is basically just a regular network that
you may see on prem, but it's utilized in sort of configurations.
We're using programmability.
We're using the process of software to identify and manage our software in a seamless environment that
is also on demand.
This means that while we've talked about a virtual environment or containerized environment, to quickly
scale up or scale back different aspects of our enterprise environment within an Sdn, we can actually
do that.
This is the focal point of network architecture.
Within that environment, within a virtual network, we identify different network segmentations zero
trust, SAS and Sdn and went through the different processes and how they interact with one another.
The main points you need to get out of this different chapter was that we need to put network security
at the forefront and bring it from the foundation up.
If you're trying to implement security infrastructure in the middle or even at the end of your network,
you're going to find gaps.
You're not going to get everything.
And so proper planning really does lead to a more effective and more secure network infrastructure utilizing
either SAS or Sdn within our environment.