3.1.3 Network Infrastructure

Network infrastructure security focuses on the physical and logical design of environments to isolate critical assets and reduce the attack surface.

Network Segmentation and Isolation Organizations must move away from flat networks to prevent lateral movement by threat actors. - Physical Isolation: The use of separate hardware, cabling, and switches to ensure two networks cannot communicate. - Logical Segmentation (VLANs): Using Virtual Local Area Networks to group devices based on function or security level rather than physical location, controlled via switches. - Air Gaps: The most extreme form of isolation where a system is physically disconnected from all other networks, including the Internet. Data transfer usually requires "sneakernet" (e.g., USB thumb drives), which remains a high-risk attack vector if physical access is compromised. - Screened Subnet (DMZ): A buffer zone between the private network and the untrusted Internet, hosting public-facing services like web or email servers to prevent direct access to internal resources.

Software-Defined Networking (SDN) SDN decouples the system that makes decisions about where traffic is sent from the underlying systems that forward traffic to the selected destination. - Control Plane: The centralized "brain" that manages network-wide policies and routing tables. - Data Plane (Forwarding Plane): The actual hardware or virtual switches that move packets based on the control plane's instructions. - Security Benefit: Allows for dynamic, automated security policy updates across the entire infrastructure, making it easier to isolate compromised segments or IoT devices instantly.

Attack Vectors in Infrastructure Infrastructure must be hardened against various entry points used by modern threat actors. - Direct Access: Exploiting misconfigured routers or firewalls to gain internal entry. - Wireless and Mobile: Using 802.11 (Wi-Fi), Bluetooth, or cellular connections as conduits. Smartphones are high-risk due to always-on connectivity and recording capabilities. - IoT (Internet of Things): Generally lacks robust security and provides a weak entry point for attackers to pivot into more secure network zones. - Removable Media: USB drives are the primary vector for bridging air-gapped systems through social engineering or physical proximity.

Quick Recall - Air Gap: No physical or wireless connection to any other network; protects highly sensitive data. - VLAN: Logical segmentation at Layer 2; requires a router or Layer 3 switch to communicate between segments. - SDN Control Plane: Centralized management; can programmatically "quarantine" a network segment. - IoT Risk: Often lacks patching capabilities; should be isolated on its own VLAN. - Lateral Movement: What segmentation aims to stop once a threat actor gains an initial foothold.