Protecting Networks: Segmentation
Introduced| English |
|---|
| network segmentation/ˈnetwɜːk ˌseɡmənˈteɪʃn/ |
| subnets/ˈsʌbnets/ |
| screened subnet/skriːnd ˈsʌbnet/ |
| DMZ/ˌdiː em ˈzed/ |
| VLANs/ˈviːlænz/ |
Divide to contain
- Network segmentation 网络分段 splits one network into isolated subnets 子网.
- If one subnet is breached, the damage is contained.
- It cannot spread to the rest of the network.
The screened subnet (DMZ)
- A screened subnet 屏蔽子网 (a DMZ 隔离区) sits between the internet and the private network.
- It holds public-facing servers in a lower-security zone.
- This keeps public servers away from sensitive internal systems.
Which network zone?
The DMZ holds public-facing servers; the private network holds sensitive systems; the internet is untrusted.
A DMZ (screened subnet) typically holds...
A DMZ holds public-facing servers.
The main security benefit of segmentation is that a breach is...
Segmentation contains a breach.
Dividing a network into smaller isolated pieces creates ____.
Segmentation creates isolated subnets.
Which are ways to segment a network? (Choose all)
Deleting the firewall reduces security.
Ways to segment
- Subnetting divides by IP address.
- VLANs 虚拟局域网 logically separate devices on the same switch.
- Each segment can have its own security policy.
A flat, unsegmented network is dangerous: once an adversary is inside one device, nothing stops them reaching every other device. Segmentation builds internal walls that contain a breach.
VLANs can logically separate devices that share the same physical switch.
VLANs separate devices logically.
A company puts its public web server in a DMZ between two firewalls. If the web server is hacked, the attacker is trapped in the DMZ — the second firewall still stands between them and the private customer database.
Network segmentation divides a network into isolated subnets so a breach stays contained. A screened subnet (DMZ) holds public-facing servers between the internet and the private network. Segment with subnetting or VLANs, each with its own policy.