Network Segmentation

Question 1

Segmenting the network

Answer 1

• Physical, logical, or virtual segmentation
  
  • Devices, VLANs, virtual networks

• Performance - High-bandwidth applications

• Security
  
  • Users should not talk directly to database servers
  • The only applications in the core are SQL and SSH
• Compliance
  
  • Mandated segmentation (PCI compliance)
  • Makes change control much easier

Question 2

Physical segmentation

Answer 2

• Devices are physically separate
  
  • Switch A and Switch B
• Must be connected to provide communication
  
  • Direct connect, or another switch or router
• Web servers in one rack
  
  • Database servers on another
• Customer A on one switch, customer B on another
  
  • No opportunity for mixing data
• Separate devices
  
  • Multiple units, separate infrastructure

Question 3

DMZ

Answer 3

• Demilitarized zone
• An additional layer of security between the Internet
and you
• Public access to public resources