Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Контрмера Network Segmentation
Риски
Каталоги
MITRE ATT&CK
Контрмеры
Network Segmentation
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Network Segmentation

Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, and cloud-based configurations. This mitigation can be implemented through the following measures: Segment Critical Systems: - Identify and group systems based on their function, sensitivity, and risk. Examples include payment systems, HR databases, production systems, and internet-facing servers. - Use VLANs, firewalls, or routers to enforce logical separation. Implement DMZ for Public-Facing Services: - Host web servers, DNS servers, and email servers in a DMZ to limit their access to internal systems. - Apply strict firewall rules to filter traffic between the DMZ and internal networks. Use Cloud-Based Segmentation: - In cloud environments, use VPCs, subnets, and security groups to isolate applications and enforce traffic rules. - Apply AWS Transit Gateway or Azure VNet peering for controlled connectivity between cloud segments. Apply Microsegmentation for Workloads: - Use software-defined networking (SDN) tools to implement workload-level segmentation and prevent lateral movement. Restrict Traffic with ACLs and Firewalls: - Apply Access Control Lists (ACLs) to network devices to enforce "deny by default" policies. - Use firewalls to restrict both north-south (external-internal) and east-west (internal-internal) traffic. Monitor and Audit Segmented Networks: - Regularly review firewall rules, ACLs, and segmentation policies. - Monitor network flows for anomalies to ensure segmentation is effective. Test Segmentation Effectiveness: - Perform periodic penetration tests to verify that unauthorized access is blocked between network segments.
ID: M1030
Version: 1.2
Created: 10 Jun 2019
Last Modified: 02 Apr 2025

Techniques Addressed by Mitigation
Domain ID Name Use
Enterprise T1482 Domain Trust Discovery

Employ network segmentation for sensitive domains.(Citation: Harmj0y Domain Trusts).

Enterprise T1048 Exfiltration Over Alternative Protocol

Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)

T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)

Enterprise T1602 Data from Configuration Repository

Segregate SNMP traffic on a separate management network.(Citation: US-CERT TA17-156A SNMP Abuse 2017)

T1602.001 SNMP (MIB Dump)

Segregate SNMP traffic on a separate management network.(Citation: US-CERT TA17-156A SNMP Abuse 2017)

T1602.002 Network Device Configuration Dump

Segregate SNMP traffic on a separate management network.(Citation: US-CERT TA17-156A SNMP Abuse 2017)

Enterprise T1613 Container and Resource Discovery

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Enterprise T1098 Account Manipulation

Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

T1098.001 Additional Cloud Credentials

Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

Enterprise T1136 Create Account

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

T1136.002 Domain Account

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

T1136.003 Cloud Account

Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

Enterprise T1190 Exploit Public-Facing Application

Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

Enterprise T1489 Service Stop

Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.

Enterprise T1210 Exploitation of Remote Services

Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.

Enterprise T1612 Build Image on Host

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Enterprise T1610 Deploy Container

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Enterprise T1046 Network Service Discovery

Ensure proper network segmentation is followed to protect critical servers and devices.

Enterprise T1563 Remote Service Session Hijacking

Enable firewall rules to block unnecessary traffic between network security zones within a network.

T1563.002 RDP Hijacking

Enable firewall rules to block RDP traffic between network security zones within a network.

Enterprise T1571 Non-Standard Port

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.

Enterprise T1133 External Remote Services

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Enterprise T1072 Software Deployment Tools

Ensure proper system isolation for critical network systems through use of firewalls.

Enterprise T1669 Wi-Fi Networks

Network segmentation can be used to isolate infrastructure components that do not require broad network access. Separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resources.

Enterprise T1557 Adversary-in-the-Middle

Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.

T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay

Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.

Enterprise T1095 Non-Application Layer Protocol

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.

Enterprise T1565 Data Manipulation

Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.

T1565.003 Runtime Data Manipulation

Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.

Enterprise T1040 Network Sniffing

Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as LLMNR/NBT-NS Poisoning and SMB Relay

Enterprise T1199 Trusted Relationship

Network segmentation can be used to isolate infrastructure components that do not require broad network access.

Enterprise T1021 T1021.001 Remote Services: Remote Desktop Protocol

Do not leave RDP accessible from the internet. Enable firewall rules to block RDP traffic between network security zones within a network.
T1021.003 Distributed Component Object Model

Enable Windows firewall, which prevents DCOM instantiation by default.

T1021.006 Windows Remote Management

If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices.(Citation: NSA Spotting)

Enterprise T1552 T1552.007 Unsecured Credentials: Container API

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

References

  1. Schroeder, W. (2017, October 30). A Guide to Attacking Domain Trusts. Retrieved February 14, 2019.
  2. National Security Agency/Central Security Service Information Assurance Directorate. (2015, August 7). Spotting the Adversary with Windows Event Log Monitoring. Retrieved September 6, 2018.
  3. National Security Agency/Central Security Service Information Assurance Directorate. (2015, August 7). Spotting the Adversary with Windows Event Log Monitoring. Retrieved September 6, 2018.
  4. Microsoft. (2004, February 6). Perimeter Firewall Design. Retrieved April 25, 2016.
  5. Microsoft. (2004, February 6). Perimeter Firewall Design. Retrieved April 25, 2016.
  6. Microsoft. (2004, February 6). Perimeter Firewall Design. Retrieved April 25, 2016.
  7. Microsoft. (2004, February 6). Perimeter Firewall Design. Retrieved April 25, 2016.
  8. US-CERT. (2017, June 5). Reducing the Risk of SNMP Abuse. Retrieved October 19, 2020.
  9. US-CERT. (2017, June 5). Reducing the Risk of SNMP Abuse. Retrieved October 19, 2020.
  10. US-CERT. (2017, June 5). Reducing the Risk of SNMP Abuse. Retrieved October 19, 2020.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.