Network segmentation best practices decide whether ransomware takes out one laptop or your whole company. Here’s how to shrink your blast radius.
You’re probably going to get ransomware. That’s the premise of the book Dr. Mike Saylor and I wrote, Learning Ransomware Response and Recovery. Assume breach. Once you accept that, the real question is how far it can spread after it gets in.
In this episode of The Backup Wrap-Up, Prasanna, Mike, and I talk about the old “hard, crunchy exterior, soft, chewy interior” network design, and why so many billion-dollar companies still run completely flat networks.
Mike explains VLANs with a hotel key card analogy that finally makes sense for those of us who aren’t network people. Then we go further into microsegmentation, where access is based on what you’re there to do, not where you’re plugged in.
We get practical, too. Get buy-in from leadership. Inventory everything. Tag your workloads and build policy around those tags. Start with your crown jewels and work your way out. Roll it out in phases. And document every single rule, or the next guy will flatten your network so he can start over.
We also cover why IT shouldn’t be the one deciding what’s business critical, how a business impact analysis points you to your crown jewels, and how to wall off your backup system from everything else.
Plus, you’ll hear about the night before Y2K when segmentation broke my NetBackup jobs one too many times and I lost my mind. And Mike shares how he used network segmentation to win an argument with his teenage daughter.
If you’re a backup or cyber person who doesn’t live in the network world, this one’s for you.
📖 Get the book: https://www.oreilly.com/library/view/learning-ransomware-response/9781098169572/
🎧 Listen to the podcast: https://www.backupwrapup.com/network-segmentation-best-practices-ransomware-blast-radius/
🌐 Backup and DR consulting: https://www.backupcentral.com
⏱️ Chapters:
00:00 Intro
01:26 Welcome, Prasanna and Dr. Mike Saylor
02:41 My first client with firewalls on the inside
04:43 Assume breach and the blast radius
06:24 Grenades, house locks, and panic rooms
08:41 What a flat network looks like
09:42 Why so many companies still run flat networks
10:18 VLANs explained with a hotel analogy
13:22 Going further with microsegmentation
14:51 The management overhead problem
15:15 Why undocumented segmentation falls apart
18:45 Leadership buy-in and starting with inventory
20:07 Rolling it out in phases
21:16 Tags, policy, and allow rules
22:56 Default deny (and Mike says “it depends”)
24:00 Start with your crown jewels
28:18 Why IT shouldn’t decide what’s critical
30:38 The night I lost my mind over segmentation
33:00 Monitor traffic and wall off your backup network
34:35 Final thoughts, home networks, and the chicken coop
36:04 Mike’s teenager gets her own segment
