Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Network Segmentation

Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.

ID: M1030

Version: 1.1

Created: 10 Jun 2019

Last Modified: 14 May 2020

Domain	ID		Name	Use
Techniques Addressed by Mitigation
Enterprise	T1098		Account Manipulation	Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
		T1098.001	Additional Cloud Credentials	Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
Enterprise	T1557		Adversary-in-the-Middle	Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
		T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
Enterprise	T1612		Build Image on Host	Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
Enterprise	T1613		Container and Resource Discovery	Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
Enterprise	T1136		Create Account	Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
		T1136.002	Domain Account	Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
		T1136.003	Cloud Account	Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
Enterprise	T1565		Data Manipulation	Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.
		T1565.003	Runtime Data Manipulation	Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.
Enterprise	T1602		Data from Configuration Repository	Segregate SNMP traffic on a separate management network.(Citation: US-CERT TA17-156A SNMP Abuse 2017)
		T1602.001	SNMP (MIB Dump)	Segregate SNMP traffic on a separate management network.(Citation: US-CERT TA17-156A SNMP Abuse 2017)
		T1602.002	Network Device Configuration Dump	Segregate SNMP traffic on a separate management network.(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Enterprise	T1610		Deploy Container	Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
Enterprise	T1482		Domain Trust Discovery	Employ network segmentation for sensitive domains.(Citation: Harmj0y Domain Trusts).
Enterprise	T1048		Exfiltration Over Alternative Protocol	Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)
		T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)
		T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)
		T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)
Enterprise	T1190		Exploit Public-Facing Application	Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
Enterprise	T1210		Exploitation of Remote Services	Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.
Enterprise	T1133		External Remote Services	Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
Enterprise	T1046		Network Service Discovery	Ensure proper network segmentation is followed to protect critical servers and devices.
Enterprise	T1040		Network Sniffing	Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as LLMNR/NBT-NS Poisoning and SMB Relay
Enterprise	T1095		Non-Application Layer Protocol	Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.
Enterprise	T1571		Non-Standard Port	Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.
Enterprise	T1563		Remote Service Session Hijacking	Enable firewall rules to block unnecessary traffic between network security zones within a network.
		T1563.002	RDP Hijacking	Enable firewall rules to block RDP traffic between network security zones within a network.
Enterprise	T1021	T1021.001	Remote Services: Remote Desktop Protocol	Do not leave RDP accessible from the internet. Enable firewall rules to block RDP traffic between network security zones within a network.
		T1021.003	Distributed Component Object Model	Enable Windows firewall, which prevents DCOM instantiation by default.
		T1021.006	Windows Remote Management	If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices.(Citation: NSA Spotting)
Enterprise	T1489		Service Stop	Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.
Enterprise	T1072		Software Deployment Tools	Ensure proper system isolation for critical network systems through use of firewalls.
Enterprise	T1199		Trusted Relationship	Network segmentation can be used to isolate infrastructure components that do not require broad network access.
Enterprise	T1552	T1552.007	Unsecured Credentials: Container API	Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Network Segmentation

Techniques Addressed by Mitigation

References