Would you consider the following to be "basic hardening items" for network equipment and servers?

  • VLANs
  • Access Control (such as NTFS permissions)
  • Patch Management System
  • Host Firewall
  • Anti-Virus

What is the minimal protection needed to segment my internal network from the DMZ and the outside? Is having a WAF, assuming you're dealing with web applications, and default denies, with tightly confined rules, on the firewalls sufficient?

1 Answer 1


The most basic principles for making a network secure are 'defence in depth' - that is, you want to put as many things between your 'crown jewels' and potential attackers as you can - and 'minimal surface area' - that is, you expose as little as possible to attack.

To get there; your list of basics is pretty good at addressing 'defence in depth', though you may want the ability to blacklist/whitelist applications.

You should have a look at minimal surface areas - turn off admin privileges, unused services, blacklist any application running outside of c:\windows, c:\program files, etc., block executables on USB, turn off web access on machines that don't need it, etc.

Finally, the Australian DSD guide at http://www.dsd.gov.au/publications/Top_35_Mitigations_2012.pdf is a very good 'checklist' for this sort of thing - start at the top and work down.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .