Security by Segmentation: The 3-tiered Network Architecture
Introduction
Malware infections are known to spread quickly within networks. This is better known as lateral movement.
To combat this type of spread, security teams employ a variety of measures, one of which is Network Segmentation.
Network Segmentation, on its own, isn't a security measure but rather for easier network management. However, an unintended consequence of network segmentation is security.
This article explains what network segmentation is, how it works, and the 3-tiered network architecture.
What is Network Segmentation
Network Segmentation is a method of dividing a large network into smaller parts, each handling a particular traffic flow.
Network admins often use this to help them find ‘breathing space’ in networks that would otherwise be too congested to manage properly. For instance, in an enterprise organization, a single network can be divided into 4 subnets, with different parts of it managing company-owned devices, employee-owned devices, internal servers, and guest devices, respectively.
This configuration can be robust enough that any device that isn't supposed to be on it would be unable to connect to the network, effectively cutting off potential communication with any device on it.
What is a Network Architecture
Network architecture refers to how a network is designed and built. It comprises everything on the network and how communication flows among its components. In simpler language, a network architecture is the blueprint of the network.
Understanding your network architecture is the first step to having a properly segmented network.
Setting up your organization's architecture depends on a couple of factors, including but not limited to the size of your organization, your end goal, and your security posture. To get a better understanding of network architecture, check this article.
The Three Tiers of Network Segmentation
Placing networks in tiers is an approach to creating robust networks that not only serve as an easy template for designing the architecture of your network for management, but also serve as a way to effectively contain the spread of malware or threat activities, ensuring that the most critical aspects of your business stay safe during an attack.
This idea of network segmentation involves three ‘broad’ tiers: The Outside Network, the Middle Network, and the Internal Network.
The Outside Network
This part of the network handles internet-facing devices and communications and is thus prone to malware and other threats. It is configured to hold devices that hold low-risk data. This is also the part to which guest devices can be connected.
Suppose your organization has a BYOD policy in place, and an employee brings their device to work; ideally, they should be on the outside network, as security measures like Endpoint monitoring won’t be running on the employee's personal computer.
The Middle Network
This part of the network serves as a mediator. It allows employees to access internet-facing channels and services.
It is at this tier of the network that the concept of a DMZ is often found. It is configured to be a filter, which is why services like mail are often used on this network.
In some organizations, remote work is sometimes done from this tier as it is very secure, but untrusted.
The Internal Network
This part of an organization's network is where the most critical network-connected assets are.
Configured to be highly secure and not to have any direct communication with the outside network. Servers, Databases, and company-owned computers operate on this network.
Why Segment Networks?
Effective Management:
Network admins use segmentation to have granular control of networks. With proper network segmentation, it becomes easier to zoom into a network and create custom rules for separate networks using tools like Ansible and Python.
Security:
As we have seen in this article, security is a reason some organizations segment their network.
Even when security isn’t the goal, it is an automatic byproduct of good network segmentation, as communication rigidity between segmented networks ensures that the most important assets are preserved during cyberattacks and that infected devices are contained quickly.
Troubleshooting:
Since a segmented network is granular, troubleshooting takes less time and is more effective.
Less Downtime Intervals:
Suppose you need to make a fix or update as part of your role as a network engineer or admin; you may need to make the network unavailable for the duration of the work. However, with a segmented network that operates independently, taking one part of the network offline won’t affect the others.
How to Segment Networks
Start by identifying your assets:
It may surprise you that many organizations aren’t aware of the devices running on their network. That blindness often leads to easy break-ins for attackers and, in many cases, persistence—something threat actors love so much.
Classify them:
Now that you know your assets, you need to classify them. Classifying your network devices lets you know which ones go where, as critical assets often go to internal networks.
Find a segmentation method:
Depending on your organization's size, goals, and available funding, you can employ different methods for segmenting networks.
While one organization may choose to use firewalls to segment its network, another may use router subnets.
Other ways of segmenting a network include VLANs—a logical means of network segmentation —and Software-Defined Networking (SDN), often employed by organizations that require hybrid networks.
Physical means like Access Control Lists (ACLs) or even using a separate router for different communication needs also work.
Conclusion
We have seen how effective network segmentation can simultaneously serve the purpose of security and management.
Worth noting here is that the 3-tier approach in this article isn't a universal standard but a good template to follow. What you choose to adopt depends on your organization, but the most important lesson here is that a segmented network serves as a layered defense for your cybersecurity posture, and every organization should segment its network.