Network segmentation best practices can be the difference between ransomware taking out one laptop and ransomware taking out your whole company. Prasanna, my co-author Dr. Mike Saylor, and I talk about how to stop running a flat network, what VLANs and microsegmentation actually do, and where you should start.
Mike and I wrote Learning Ransomware Response and Recovery around one basic idea: assume breach. You’re probably going to get hit, so the real question is how big the blast radius will be. Is it a plop, or does it take out the whole building?
We start with the old hard, crunchy exterior and soft, chewy interior model, and why so many billion-dollar organizations still run flat networks. Spoiler: laziness, budget, and management decisions all play a part. Mike explains VLANs with a hotel key card analogy that will make sense to those who aren’t network people. Then we take it a step further into microsegmentation, where access is based on what you’re there to do instead of where you’re plugged in.
Then we talk about:
• Get buy-in from on high.
• Inventory everything.
• Tag your workloads and build policy around those tags.
• Start with your crown jewels and work your way out. That means the stuff with tight RTOs and RPOs, plus the stuff you really don’t want ending up on the internet.
• Roll it out in phases instead of trying to rebuild everything in a day.
• Document every single rule, or the next guy will tear it all down and go flat again.
We also talk about why IT shouldn’t be the one deciding what’s critical (that’s what a business impact analysis is for) and how to wall off your backup network. You’ll also hear about the night before Y2K when the security team blocked my NetBackup ports one too many times and I lost it. And Mike explains how he used network segmentation to win an argument with a teenager.
If you’re a backup person who’s never had to think much about the network, this one’s for you.
Chapters:
00:00 – Intro
01:26 – Welcome, Prasanna and Dr. Mike Saylor
02:41 – My first client with firewalls on the inside
04:43 – Assume breach and the blast radius
06:24 – Grenades, house locks, and panic rooms
08:41 – What a flat network looks like
09:42 – Why so many companies still run flat networks
10:18 – VLANs explained with a hotel analogy
13:22 – Going further with microsegmentation
14:51 – The management overhead problem
15:15 – Why undocumented segmentation falls apart
18:45 – Leadership buy-in and starting with inventory
20:07 – Rolling it out in phases
21:16 – Tags, policy, and allow rules
22:56 – Default deny (and Mike says “it depends”)
24:00 – Start with your crown jewels
28:18 – Why IT shouldn’t decide what’s critical
30:38 – The night I lost my mind over segmentation
33:00 – Monitor traffic and wall off your backup network
34:35 – Final thoughts, home networks, and the chicken coop
36:04 – Mike’s teenager gets her own segment
