Would you consider the following to be "basic hardening items" for network equipment and servers?

  • VLANs
  • Access Control (such as NTFS permissions)
  • Patch Management System
  • Host Firewall
  • Anti-Virus

What is the minimal protection needed to segment my internal network from the DMZ and the outside? Is having a WAF, assuming you're dealing with web applications, and default denies, with tightly confined rules, on the firewalls sufficient?

1 Answer 1


The most basic principles for making a network secure are 'defence in depth' - that is, you want to put as many things between your 'crown jewels' and potential attackers as you can - and 'minimal surface area' - that is, you expose as little as possible to attack.

To get there; your list of basics is pretty good at addressing 'defence in depth', though you may want the ability to blacklist/whitelist applications.

You should have a look at minimal surface areas - turn off admin privileges, unused services, blacklist any application running outside of c:\windows, c:\program files, etc., block executables on USB, turn off web access on machines that don't need it, etc.

Finally, the Australian DSD guide at http://www.dsd.gov.au/publications/Top_35_Mitigations_2012.pdf is a very good 'checklist' for this sort of thing - start at the top and work down.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.