2.5 Segmentation and Access Control

Segmenting The Network

Involves dividing the network into smaller, controlled sections to improve security, performance, and manageability.

• Can be done physically, logically, or virtually using devices

• High-bandwidth applications may have their own dedicated subnet to ensure optimal performance, unaffected by other network activity.

Segmentation also improves security by enforcing access rules—like requiring users to go through an application server rather than directly accessing a database server.

• Some segmentation is mandated by policies or compliance standards, such as PCI, which requires isolating credit card data from the rest of the network

• Also simplifies change control by limiting the impact of modifications to only specific segments.

Access Control Lists (ACLs)

Are used to permit or deny traffic through a system based on specific rules.

• Can filter traffic by source or destination IP address, port number, time of day, application, or user identity

• Are commonly used to restrict access to network devices, allowing only authorized IPs or user roles—like administrators—while blocking others.

• Proper planning is essential to avoid unintentionally locking yourself out of critical systems or preventing needed traffic from flowing.

Access Control Lists Example

• A rule might allow Bob to read certain files

• James to access the 192.168.1.0/24 network only on TCP ports 80, 443, and 8088

Application Allow List / Deny List

Control which applications can run on a system.

Allow list

• Blocks everything by default and only permits applications that are explicitly approved

Deny list

• Allows all applications except those specifically blocked

• Antivirus software is a common example of a deny list, allowing everything unless it's known to be malicious (signatures)

Examples of Allow & Deny Lists

• Operating systems often have built-in support for allow and deny lists

• Application hash, which uniquely identifies the app—if the app changes, the hash doesn’t match, and the rule no longer applies

• Digital certificate—apps signed by trusted vendors (like Microsoft or Adobe) can be allowed, while unsigned apps are blocked.

• Restrict execution based on folder location, only permitting apps to run from approved directories.

• Rules can be applied based on the network zone, allowing or blocking apps depending on where you are