Basic Network Segmentation

Key Takeaways

Number three, no basic network segmentation. By basic, I mean really basic. Most organizations do have multiple VLANs or subnets, but they're flat. Workstations can talk to servers on every port, and so can servers. Rachel from accounting can VPN in the network while working from home, and the user VPN subnet she lands in allows her to RDP to the domain controller directly. I'm sorry, I'm I'm laughing, I'm making a lot of it, but obviously that is real. Obviously a thousand percent anyone could probably kind of have that. Availability and access. So, what do you think happens when a threat actor manages to get in through the VPN using only a username or password because of number one, multi-factor authentication missing? They can attack the servers right away. We're not even talking about DMZs here, but simple networking. Have your workstations in one subnet, have your servers in another subnet. Your workstation should only be able to access specific services on the server subnet like port 80 or 443 for the web server, port 1433 for the SQL server, etc. That basic network segmentation can go a long way. The less services and systems that you expose, the smaller your attack surface is, and the bigger the chances you have of weeding out threat actors in your network that start lighting up your consoles like a Christmas tree.