Network segmentation Cheat Sheet / 网络分段速查表

Introduction / 介绍

Network segmentation is the core of multi-layer defense in depth for modern services. Segmentation slow down an attacker if he cannot implement attacks such as:

网络分段是现代服务多层纵深防御的核心。如果攻击者无法实施以下攻击，分段将减缓其攻击速度：

• SQL-injections, see SQL Injection Prevention Cheat Sheet;
  中文：SQL注入，参见SQL注入预防速查表；
• compromise of workstations of employees with elevated privileges;
  中文：高级别权限员工的工作站被入侵；
• compromise of another server in the perimeter of the organization;
  中文：组织外围的其他服务器被入侵；
• compromise of the target service through the compromise of the LDAP directory, DNS server, and other corporate services and sites published on the Internet.
  中文：通过入侵LDAP目录、DNS服务器以及其他在互联网上发布的公司服务和网站，入侵目标服务。

The main goal of this cheat sheet is to show the basics of network segmentation to effectively counter attacks by building a secure and maximally isolated service network architecture.

本速查表的主要目标是展示网络分段的基础知识，通过构建一个安全且最大程度隔离的服务网络架构，有效地对抗攻击。

Segmentation will avoid the following situations:

分段将避免以下情况：

• executing arbitrary commands on a public web server (NginX, Apache, Internet Information Service) prevents an attacker from gaining direct access to the database;
  中文：在公共Web服务器（NginX、Apache、Internet Information Service）上执行任意命令，防止攻击者直接访问数据库；
• having unauthorized access to the database server, an attacker cannot access CnC on the Internet.
  中文：拥有对数据库服务器的未授权访问，攻击者无法访问互联网上的CnC（命令与控制）；

Content / 内容

• Schematic symbols;
  中文：示意图符号；
• Three-layer network architecture;
  中文：三层网络架构；
• Interservice interaction;
  中文：服务间交互；
• Network security policy;
  中文：网络安全策略；
• Useful links.
  中文：有用链接；

Schematic symbols / 原理图符号

Elements used in network diagrams:

网络图中使用的元素：

Crossing the border of the rectangle means crossing the firewall:

矩形边界之外表示穿越防火墙：

In the image above, traffic passes through two firewalls with the names FW1 and FW2

在上面的图像中，流量通过名为FW1和FW2的两个防火墙

In the image above, traffic passes through one firewall, behind which there are two VLANs

在上面的图像中，流量通过一个防火墙，该防火墙后面有两个VLAN

Further, the schemes do not contain firewall icons so as not to overload the schemes

进一步，方案中不包含防火墙图标，以免方案过载

Three-layer network architecture / 三层网络架构

By default, developed information systems should consist of at least three components (security zones):

默认情况下，开发的信息系统应至少包含三个组件（安全区域）：

1. FRONTEND;
2. MIDDLEWARE) （中间件）;
3. BACKEND) （后端）.

FRONTEND

FRONTEND - A frontend is a set of segments with the following network elements:

FRONTEND - 前端是一组包含以下网络元素的段：

• balancer;
  中文：负载均衡器;
• application layer firewall;
  中文：应用层防火墙;
• web server;
  中文：Web 服务器;
• web cache.
  中文：网页缓存.

MIDDLEWARE / 中间件

MIDDLEWARE - a set of segments to accommodate the following network elements:

中间件 - 一组用于容纳以下网络元素的段：

• web applications that implement the logic of the information system (processing requests from clients, other services of the company and external services; execution of requests);
  中文：实现信息系统逻辑的Web应用程序（处理来自客户端、公司其他服务和外部服务的请求；执行请求）；
• authorization services;
  中文：授权服务；
• analytics services;
  中文：分析服务；
• message queues;
  中文：消息队列；
• stream processing platform.
  中文：流处理平台。

BACKEND / 后端

BACKEND - a set of network segments to accommodate the following network elements:

后端 - 一组网络段，用于容纳以下网络元素：

• SQL database;
  中文：SQL数据库;
• LDAP directory (Domain controller);
  中文：LDAP目录（域控制器);
• storage of cryptographic keys;
  中文：加密密钥存储;
• file server.
  中文：文件服务器.

Example of Three-layer network architecture / 三层网络架构示例

The following example shows an organization's local network. The organization is called "Сontoso".

以下示例展示了一个组织的本地网络。该组织名为 "Сontoso"。

The edge firewall contains 2 VLANs of FRONTEND security zone:

边缘防火墙包含前端安全区域的2个VLAN：

• DMZ Inbound - a segment for hosting services and applications accessible from the Internet, they must be protected by WAF;
  中文：DMZ 入站 - 用于托管可从互联网访问的服务和应用程序的段，它们必须由WAF保护；
• DMZ Outgoing - a segment for hosting services that are inaccessible from the Internet, but have access to external networks (the firewall does not contain any rules for allowing traffic from external networks).
  中文：DMZ 出站 - 用于托管不可从互联网访问但可访问外部网络的服务段（防火墙不包含允许来自外部网络流量的规则）。

The internal firewall contains 4 VLANs:

内部防火墙包含4个VLAN：

• MIDDLEWARE security zone contains only one VLAN with name APPLICATIONS - a segment designed to host information system applications that interact with each other (interservice communication) and interact with other services;
  中文：中间件安全区域仅包含一个名为_APPLICATIONS_的VLAN - 一个设计用于托管相互交互（服务间通信）以及与其他服务交互的信息系统应用程序的段；
• BACKEND security zone contains:
  中文：后端安全区域包含：
  • DATABASES - a segment designed to delimit various databases of an automated system;
    中文：DATABASES - 一个设计用于界定自动化系统各种数据库的段；
  • AD SERVICES - segment designed to host various Active Directory services, in the example only one server with a domain controller Contoso.com is shown;
    中文：AD 服务 - 设计用于托管各种Active Directory服务的段，示例中仅显示了一个具有域控制器Contoso.com的服务器；
  • LOGS - segment, designed to host servers with logs, servers centrally store application logs of an automated system.
    中文：LOGS - 段落，用于托管日志服务器，服务器集中存储自动化系统的应用程序日志。

Interservice interaction / 服务间交互

Usually some information systems of the company interact with each other. It is important to define a firewall policy for such interactions. The base allowed interactions are indicated by the green arrows in the image below: The image above also shows the allowed access from the FRONTEND and MIDDLEWARE segments to external networks (the Internet, for example).

通常，公司的某些信息系统会相互交互。定义此类交互的防火墙策略非常重要。以下图像中的绿色箭头指示了基本允许的交互： 上面的图像还显示了从 FRONTEND 和 MIDDLEWARE 段到外部网络（例如互联网）的允许访问。

From this image follows:

从这张图像可以得出以下结论：

1. Access between FRONTEND and MIDDLEWARE segments of different information systems is prohibited;
   中文：禁止不同信息系统之间的 FRONTEND 和 MIDDLEWARE 段之间的访问；
2. Access from the MIDDLEWARE segment to the BACKEND segment of another service is prohibited (access to a foreign database bypassing the application server is prohibited).
   中文：禁止从 MIDDLEWARE 段到另一个服务的 BACKEND 段的访问（绕过应用程序服务器访问外部数据库是禁止的）。

Forbidden accesses are indicated by red arrows in the image below:

以下图像中的红色箭头指示了禁止的访问：

Many applications on the same network / 同一网络上的许多应用程序

If you prefer to have fewer networks in your organization and host more applications on each network, it is acceptable to host the load balancer on those networks. This balancer will balance traffic to applications on the network. In this case, it will be necessary to open one port to such a network, and balancing will be performed, for example, based on the HTTP request parameters. An example of such segmentation:

如果您希望组织中网络数量较少，并且每个网络托管更多应用程序，那么在这些网络上托管负载均衡器是可以接受的。这个均衡器将平衡网络中应用程序的流量。在这种情况下，需要打开一个端口到这样的网络，并且平衡将基于例如HTTP请求参数进行。这样的分段示例：

As you can see, there is only one incoming access to each network, access is opened up to the balancer in the network. However, in this case, segmentation no longer works, access control between applications from different network segments is performed at the 7th level of the OSI model using a balancer.

如您所见，每个网络只有一个入站访问，访问被打开到网络中的均衡器。然而，在这种情况下，分段不再起作用，来自不同网络分段的应用程序之间的访问控制是在OSI模型的第7层使用均衡器执行的。

Network security policy / 网络安全策略

The organization must define a "paper" policy that describes firewall rules and basic allowed network access. This policy is at least useful for:

组织必须定义一份“纸质”政策，描述防火墙规则和基本允许的网络访问。这份政策至少对以下人员有用：

• network administrators;
  中文：网络管理员；
• security representatives;
  中文：安全代表；
• IT auditors;
  中文：IT审计员；
• architects of information systems and software;
  中文：信息系统和软件开发架构师；
• developers;
  中文：开发者；
• IT administrators.
  中文：IT管理员。

It is convenient when the policy is described by similar images. The information is presented as concisely and simply as possible.

当策略通过类似图像描述时，信息可以尽可能简洁地呈现。

Examples of individual policy provisions / 个别策略条款的示例

Examples in the network policy will help colleagues quickly understand what access is potentially allowed and can be requested.

网络策略中的示例将帮助同事快速了解可能允许的访问权限以及可以请求的内容。

Permissions for CI/CD

The network security policy may define, for example, the basic permissions allowed for the software development system. Let's look at an example of what such a policy might look like:

网络安全策略可能定义，例如，软件开发系统允许的基本权限。让我们看看这样一个策略可能的样子：

Secure logging / 安全日志记录

It is important that in the event of a compromise of any information system, its logs are not subsequently modified by an attacker. To do this, you can do the following: copy the logs to a separate server, for example, using the syslog protocol, which does not allow an attacker to modify the logs, syslog only allows you to add new events to the logs. The network security policy for this activity looks like this:

在信息系统的任何部分被入侵的情况下，其日志不应随后被攻击者修改，这一点非常重要。为此，您可以执行以下操作：将日志复制到单独的服务器，例如，使用syslog协议，该协议不允许攻击者修改日志，syslog只允许您向日志中添加新事件。此活动的网络安全策略如下：

In this example, we are also talking about application logs that may contain security events, as well as potentially important events that may indicate an attack.

在本例中，我们还在讨论可能包含安全事件的 应用程序日志，以及可能表明攻击的重要事件。

Permissions for monitoring systems / 监控系统权限

Suppose a company uses Zabbix as an IT monitoring system. In this case, the policy might look like this:

假设一家公司使用 Zabbix 作为 IT 监控系统。在这种情况下，策略可能如下所示：

Useful links / 有用链接

• Full network segmentation cheat sheet by sergiomarotco: link.
  中文：完整的网络分段速查表由 sergiomarotco：链接。

References / 参考

• NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy) （NIST SP 800-41 Rev. 1：防火墙和防火墙策略指南）
• NIST SP 800-215: Guide to a Secure Enterprise Network Landscape) （NIST SP 800-215：安全企业网络景观指南）