Securing networks

Networking plays a fundamental role in securing your infrastructure. A network designed to be open and permissive is what allows attackers to move laterally and penetrate further into systems once they get in. In Chapter 3, Designing the Network, we discussed the concept of zero trust security. The main point to remember is that you should always assume a breach, making design decisions that protect your infrastructure when a breach happens. What that means for networks is that you should always ensure traffic is implicitly denied, while only specific IP addresses and network ports are allowed in the firewall on an as-needed basis. Another way to frame this is to assume each network request in the environment is coming from a compromised server or an open, untrusted public network. What can you do to minimize the impact such requests can have? Isolation and firewalling.

Isolating networks by design

Start by isolating different environments (for example, development...