Download Reasons for segmentation.

The Importance of Network Segmentation
Lesson overview.
In this lesson, we will cover:
●
●
The OSI model and segmentation.
Reasons for segmentation.
The OSI model and segmentation.
What is segmentation? It is taking a single network or system and breaking it into smaller
discrete units. This can be achieved either physically or logically. There are many reasons why
an organization might want to segment a network. Some reasons include easing administrative
tasks, achieving performance gains, increasing security, or complying with regulations.
Highlights:
●
●
Segmentation is taking a single network or system and breaking it into smaller discrete
units. It can be achieved physically or logically.
There are many reasons to segment a network, including to ease administrative tasks, to
achieve performance gains, to increase security, or to comply with regulations.
Segmenting a network at different OSI model levels.
Segmenting a network can be achieved either physically or logically. Either way, the
segmentation involves different levels of the OSI (Open Systems Interconnection) reference
model. Segmentation can be achieved physically at Layer 1, the physical layer. This involves
taking a single network and making it into more than one network through the use of cable runs
and equipment. This is the most extreme example of network segmentation.
You can also segment a network logically at the data link layer, which is Layer 2, or at the
network layer, which is Layer 3, of the OSI model. This involves taking a single network and
making it into more than one network by logically dividing it. The logical segmentation of a
network requires the least amount of physical resources to achieve.
Highlights:
●
●
●
Networks can be segmented at various levels of the OSI model.
Physical layer (Layer 1) segmentation: taking a single network and making it into more
than one through the use of new cable runs and equipment.
Data link (Layer 2) and network (Layer 3) segmentation: taking a single network and
making it into more than one by logically dividing the network.
Reasons for segmentation.
There are many reasons to segment a network. Some excellent reasons may be to comply with
regulations, to increase network performance, or to improve security. These as well as other
reasons are outlined below.
Compliance.
Certain rules and regulations, such as the Payment Card Industry Data Security Standard (PCIDSS), require that certain data be kept separate and secure. This requires that customer
information is kept separate and secure from normal business information. Segmentation allows
for the regulated data to flow across its own network, keeping it more secure.
Highlights:
●
●
Some rules and regulations require that certain data be kept separate and secure.
Segmentation allows for regulated data to flow across its own network.
Network performance optimization.
Another reason for segmentation is network performance optimization. As a network increases
in size, the amount of data that flows through it usually increases. This can slow down the
performance of any network. Segmentation breaks a larger network into smaller units, which
can lead to an increase in performance on those segments.
Related to network performance optimization is the creation of high performance networks.
Some applications require more bandwidth in order to perform at a desired higher level. Voice
over IP (VoIP), video teleconferencing (VTC), and media nets—which are examples of
streaming services—all perform better when they are on their own network segments.
Highlights:
●
●
Segmentation breaks a larger network into smaller units, which can lead to an increase
in performance on those new segments.
Some applications require more bandwidth in order to perform at the desired higher
level; for example, VoIP, VTC, and media nets all perform better on their own segments.
Separate private from public networks.
Another major reason for network segmentation is to separate private networks from public
networks. Organizations often offer free Wi-Fi, allowing the public to access the Internet from
their locations. Network segmentation allows this public traffic to be kept separate from private
corporate traffic.
Highlights:
●
●
Segmentation allows public traffic to be kept separate from private corporate traffic.
This type of segmentation keeps private traffic more secure.
Legacy systems.
Many organizations use systems that are considered critical to their operation, but are not
capable of residing on modern networks. Segmentation allows such legacy systems to reside on
their own subnet and network without compromising their performance or the performance of
the rest of the network.
Highlights:
●
●
Segmentation allows legacy systems to reside on their own subnets.
This type of segmentation increases both performance and security.
Testing labs.
Testing labs are used to test new applications, operating systems, update patches, and other
applications. If these tests occur on the main network, it is possible that this testing could inject
a problem into the main system. Segmentation allows for such testing to occur in a secure,
easily controllable environment.
Highlights:
●
●
Segmentation allows for testing to occur in a secure, easily controllable environment.
This type of segmentation protects a network’s production environment.
Security.
One of the primary reasons for performing network segmentation is to increase security.
Segmentation allows network and system administrators to more easily control the flow of data
between systems. Segmentation also allows network and system administrators to more easily
control access to network resources, therefore creating more security.
Highlights:
●
●
Security is one of the main reasons to perform network segmentation.
It allows network and systems administrators to more easily control the flow of data
between systems and to control access to network resources.
Honeynets.
An example of segmentation for security is using honeynets. Honeynets are network segments
that are created with the sole purpose of attracting any network attacks through the
implementation of multiple honeypots.
Honeypots are systems that are configured to be attractive to network attackers, helping to draw
attackers away from the main network systems and into the honey net. The network segment of
honeypots allows the main network to remain secure and gives network administrators an
opportunity to study an attack, including the methods of entry, so that countermeasures can be
developed to prevent future breaches.
Highlights:
●
●
Honeynets are network segments created for the sole purpose of attracting any network
attacks through the use of multiple honeypots.
A network segment of honeypots allows the main network to remain secure, and gives
network administrators the opportunity to study attacks and develop countermeasures to
prevent future breaches.
SCADA (Supervisory Control and Data Acquisition) systems.
A system that should definitely be segmented is a SCADA (supervisory control and data
acquisition) system. A SCADA system is the most widely used industrial control system (ICS).
An industrial control system uses coded signals over communication channels to provide control
over remote equipment. The systems are commonly used in industrial applications to monitor
and control systems.
Utility companies often use SCADA systems to control their operations through the use of DCS
(distributed control system) networks. The DCS allows for the control of multiple SCADA
systems from a single location. The Stuxnet virus was originally designed to attack SCADA
systems and can spread through the DCS, leading to more damage from the virus.
Segmentation of the DCS will limit the amount of damage caused by such a virus attack on
industrial processes.
Highlights:
●
●
●
●
SCADA represents the most widely used ICS.
Utility companies often use SCADA systems to control their operations through the use
of a DCS network.
The Stuxnet virus attacks SCADA systems and can spread through the DCS, leading to
more damage from the virus.
Segmentation of a DCS will limit the amount of damage caused by such an attack on
industrial processes.
What was covered.
The OSI model and segmentation.
Segmentation is taking a single system or network and breaking it into smaller discrete units.
Network segmentation can occur at various levels of the OSI model. At Layer 1, the
segmentation is physical (completely separate cable runs and network hardware). At layers 2
and 3, the segmentation is logical (the segmentation occurs through programmable
configurations).
Reasons for segmentation.
There are many reasons for segmenting networks and systems, including compliance with
regulations, optimizing network performance, creating high performance networks, improving
security, creating honeynets, and securing and isolating SCADA systems.