Security zones

It is important to separate out network assets and services to provide the required levels of security. There will be regulatory requirements for critical infrastructure and SCADA networks. BUs may need to be on separate networks, while internet-facing servers must be placed in perimeter-based networks. Segmentation of networks makes it difficult for an attacker to gain a foothold on one compromised system and use lateral movement through the network.

Consider the following points when segmenting networks:

• Keep critical systems separate from general systems and each other if non-related.
• Limit and monitor access to assets.
• Keep an up-to-date list of personnel authorized to access critical assets.
• Train staff to err on the side of caution when dealing with access to critical assets.
• Consider air gaps when dealing with equipment supporting critical infrastructure (nuclear plant/petrochemical plant).

DMZ

A DMZ is like a border area between two nations where we do not trust our neighbor 100%. You are stopped at a checkpoint and if you are deemed to be a security risk, you are turned away. In the world of networking, we must use a combination of security techniques to implement this untrusted zone. Typically, an enterprise will create a zone using back-to-back firewalls. The assets in the zone will be accessed by users who cannot all be fully vetted or trusted.

The assets in the DMZ must be best prepared for hostile activity, and we may need to place SMTP gateways, DNS servers, and web and FTP servers into this network. It is imperative that these systems are hardened and do not run any unnecessary services.

Figure 1.33 provides an overview of a DMZ:

Figure 1.33 – DMZ network zone

A DMZ network can also be referred to as a screened subnet.