5

One of the biggest points of friction I see between networking teams, security teams, and users is around the idea of network segregation. For instance, the network team wants to isolate everyone behind VLANs, such that, for example, users would not even be able to browse the IP address of a security tool. The reasoning is that if everything is segregated, then that limits the potential exposure of that sensitive device to attack. Conversely, users in the security team find this cumbersome, because if they need to VPN in and view events at night, they need to utilize a jump box because they cannot access the interface from the VLAN that they are a part of.

What I want to know is how people typically approach this clash between "security" and usability. To me, I would rather the application perform the authentication, rather than rely on which VLAN someone is located.

2

You are absolutely correct about where access control mechanisms should exist: in-app.

Some OWASP Top Ten verbiage here for you:

Do not rely upon spoofable credentials as the sole form of authentication, such as IP addresses or address range masks, DNS or reverse DNS lookups, referrer headers or similar

However, in some legacy networks where secure-by default is not the norm, segregation can allow for on-going DMZ and iSMS control improvements over time. I am of the opinion that these sorts of networks should just be shut down, shut off, and forgotten -- but replacement costs and business need often dictate otherwise. This is often a clear indicator that business, IT, and service/change management are not in alignment and that the organization should hire a new CIO or replace their current one.

2

To your first point, of course there is such a thing as too much segregation. I disagree with the answers already here that network segregation is obsolete or pointless, however. It's important to segregate disparate networks, and perhaps specific pieces of the larger whole.

Consider that a network firewall is a bastion host. It typically runs a very stripped down operating system and is used for a single function. Few users are typically entrusted with access, and changes are also typically backed up automatically using something like rancid.

This affords two things. One is a papertrail of any changes made to these devices, typically done under controlled conditions. Two, it can make it much harder for an attacker to access the data they are after. If a machine is only able to contact systems in its VLAN, it may not have any direct access to your important data. If everything is in a single bucket, a single compromised host immediately becomes a pivot to use against all of your critical infrastructure. If you have segmentation this can become significantly more difficult.

As to how to approach it, you have to balance usability and implementation costs of network segmentation with the value of the data involved. If you're a large organization which can be caused significant financial harm by a breach, it may well be that network segregation makes sense. I typically recommend a jump host with 2-factor authentication to gate any access into a production environment, and a small list of roles with this access.

0

Using VLAN segregation will only prevent casual hacking. Professional hackers will not be significantly hindered by VLAN segregation. So, the inconvience to employees is probably far greater than any security the VLANs are providing.

Unfortunately, you are dealing with "illusion of security" psychology here, so there is not much to be done.

  • Can you explain why "VLAN segregation will only prevent casual hacking"? Correctly configured VLAN segregation should protect against VLAN hoping for example. – Eloy Roldán Paredes Dec 15 '15 at 15:25
  • If the same computer is used on both VLANs the hacker just needs to compromise that machine. For example, let's say the hacker owns an employee box that is only on one LAN, he can then use that box to gain control of an IT admin's box that is used on all VLANs. Then using the admin's box he can access any machine. The VLAN does not really help since a hacker will usually do these same steps whether a VLAN is present or not. – Tyler Durden Dec 15 '15 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.