Organizations should use macrosegmentation at a minimum to slow lateral movement attempts by adversaries within the enterprise network.
Control Type: Technical
Control Function: Preventive
Description: An organization can never eliminate the possibility of a network intrusion. However, it can deploy controls that limit the impact adversaries can have on the network. There are two network flows that make up regular network operations:
- North-South traffic refers to traffic that enters or leaves the enterprise network from the Internet. When users log into websites, query DNS servers, or download files, they are generating North-South communication.
- East-West traffic, on the other hand, occurs between hosts within the local network itself. When users access local file servers, print to network printers, or log into an internal web portal, the traffic flows laterally within the network—hence, east-to-west.
Adversaries usually start their attacked by gaining an initial foothold into a network from the North to South direction (Internet to the enterprise network). The adversary then starts looking in the East-West direction to find opportunities for lateral movement. Moving laterally allows them to jump from one network asset to another with the hopes of slowly escalating to more valuable assets. If an organization hosts all its network services on one network segment, lateral movement can result in quick compromise. For example, hosting guest devices on the same network as the core company file server would allow adversaries to laterally move from a low value target to a very high value one.
To mitigate lateral movement, every organization should employ some form of network segmentation. There are two approaches to network segmentation: macro and micro. This documentation is focused on macrosegmentation.
Macrosegmentation is the process of dividing network nodes into smaller segments to reduce the attack surface. This not only improves network security but also makes the network more manageable.
The most common way to implement macrosegmentation is using Virtual Local Area Networks (VLANs). VLANs allow network nodes to be grouped logically, regardless of their physical location within a facility, by assigning similar nodes to the same broadcast domain. A broadcast domain is a network segment where all devices can receive the same message. Each port on a standard switch is normally its own broadcast domain, but VLANs can group multiple ports into a single broadcast domain. Devices within the same VLAN can communicate with each other but are isolated from devices in other VLANs unless routing rules are configured. Practically, VLANs are used to group similar devices together. For example, an HR VLAN could contain all HR devices and servers, while a Marketing VLAN contains all Marketing devices and servers. Devices within each VLAN can communicate with others in their domain, but cannot directly reach devices in another VLAN. The name Virtual LAN makes sense because VLANs create small, logical networks within a larger physical network.
This approach greatly improves network security, but it reaches a limitation when devices in different VLANs need to communicate with each other or access the Internet. For traffic to flow between VLANs, Inter-VLAN routing must be configured. Because routing occurs at Layer 3 of the OSI Model, a Layer 3-capable device is required to handle traffic between VLANs. The two standard options are a router or a Layer 3 switch.
Router: Each VLAN is connected to the router via a separate link. The router identifies the VLANs and directs traffic between them accordingly.
Layer 3 switch: Each VLAN is assigned a Switch Virtual Interface (SVI). The SVI acts as the VLAN’s default gateway, and the switch routes any traffic destined for that VLAN through its SVI interface.
Once VLANs have been configured, network segments can be further hardened by deploying Access Control Lists (ACLs), which explicitly accept or deny East-West traffic according to a variety of attributes. Network firewalls are usually placed on the borders of network segments to help restrict the North-South flow of traffic. These controls work together in a defense in depth model; blocking attempts at gaining an initial foothold for the Internet, and then slowing the progress of lateral movement should the firewall fail.