Segmentation and filtering
Trust zones, least privilege applied to flows, the three ways to segment (subnets, VLANs, filtering between zones), the flow matrix and lateral movement.
- 20 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Network segmentation: what is it?
Show the answer
Splitting a network into separate zones whose exchanges are filtered, so that a compromised machine does not reach all the others.
It does not remove the intrusion, it limits its extent. A flat network turns one compromised machine into a starting point for everything else.
A company puts accounting in a separate VLAN, but the router forwards everything between VLANs with no rule. What does this segmentation protect?
- Very little: broadcast domains are separated, but everything remains reachable through the router
- All of accounting, since a workstation in another VLAN can no longer communicate with it
- Accounting's exchanges, which are encrypted end to end by the VLAN tag
- Only attacks coming from the Internet, which the VLAN filters at the network entry
Show the answer
Very little: broadcast domains are separated, but everything remains reachable through the router
A VLAN separates at layer 2, it filters nothing. Without an access control list or firewall between VLANs, the router lets flows through and an attacker pivots as fast as before.
Three ways to segment: split into IP …, separate broadcast domains with …, and … the flows between zones with a firewall.
Show the answer
Three ways to segment: split into IP subnets, separate broadcast domains with VLANs, and filter the flows between zones with a firewall.
The first two organise the network; only the third really forbids anything. Subnets and VLANs without filtering between them protect nothing.
Trust zone: what is it?
Show the answer
A set of machines with the same level of exposure and sensitivity, and therefore the same rules towards other sets.
Machines are grouped by exposure (visible from the Internet or not) and sensitivity (what a compromise would cost), not by department or office.
Ransomware that came in through a reception workstation encrypts the workshop controllers. What is the probable cause of the spread and which solution prevents it?
- A single network for everything; splitting office and workshop into filtered zones
- A badly configured antivirus on the workstation; replacing it with a newer model
- Too weak a password on the controllers; imposing a longer password policy
- A network cable plugged in the wrong place; reviewing the workshop's cabling diagram
Show the answer
A single network for everything; splitting office and workshop into filtered zones
The reception workstation should never have reached the workshop. On a flat network lateral movement is free; with two zones and a matrix that allows only useful flows, the workshop stays out of reach.