IB Computer Science Topic A2.2.4: Concepts and Applications of Network Segmentation Notes

Network Segmentation: Splitting One Network to Contain Traffic and Threats

1. Network segmentation divides one large network into smaller sections so that traffic and access can be controlled at the boundary between them.
2. The syllabus asks for three named things: segmenting, subnetting and VLANs, and they are not synonyms.
3. Segmentation is used for three reasons: network performance, security, and efficient management of network resources.

What Segmentation Actually Changes

1. Performance: Smaller Broadcast Domains
   1. A switch floods a broadcast frame out of every port, so on one unsegmented network every device has to receive and process every broadcast.
   2. A segment boundary stops broadcasts crossing it, so 600 devices split into six segments each see a sixth of the broadcast traffic.
   3. Congestion drops for the same reason: traffic between two devices in one segment never reaches the rest of the network.
2. Security: Limiting Lateral Movement
   1. An attacker who compromises one machine can normally reach anything that machine can reach, which on a flat network is everything.
   2. Segmentation forces that traffic through a router or firewall where rules can block it, so a breach in one segment does not automatically become a breach of the whole organisation.
   3. Segmentation does not prevent the first compromise, so it limits damage rather than stopping the attack.
3. Resource Management: Policy per Segment
   1. Bandwidth limits, monitoring and priority rules can be set for one segment without affecting the others.
   2. Faults are easier to trace, because a problem visible in only one segment tells you where to look.
   3. A new department joins by adding a segment, which leaves the existing configuration untouched.

Segmenting, Subnetting and VLANs: Three Different Levels of the Same Idea

1. Segmenting Is the General Practice
   1. Segmenting is the umbrella term for dividing a network at all, whatever technique is used to do it.
   2. The simplest form is physical segmentation: separate switches, separate cabling and a router or firewall between them.
   3. It gives the strongest isolation and the least flexibility, because moving a device between segments means moving its cable.
2. Subnetting Divides the Address Space
   1. Subnetting works on IP addresses, so it divides the network at the internet layer of the TCP/IP model.
   2. A device works out from the subnet mask whether a destination is inside its own subnet, and if it is not, the packet goes to the router instead.
   3. That router hop is the control point: rules there decide which subnets may talk to which.
3. VLANs Divide the Switch
   1. A VLAN works on frames inside a switch, so it divides the network at the network interface layer instead.
   2. Two devices plugged into the same switch but placed in different VLANs cannot reach each other directly, even though the cable path exists.
   3. Moving a device to another VLAN is a configuration change on the switch port, which is why VLANs give the flexibility physical segmentation lacks.

How Subnetting Divides an Address Range

1. Every IPv4 address is split by the subnet mask into a network portion and a host portion.
2. The network portion identifies which subnet the device belongs to, and every device in that subnet shares it.
3. The host portion identifies the individual device, so the mask decides how many devices a subnet can hold.
4. A mask of 255.255.255.0 keeps 24 bits for the network and 8 for hosts, which allows 254 usable addresses in that subnet.
5. Lengthening the mask creates more subnets with fewer hosts in each, which is the trade-off every subnetting decision is making.

How VLANs Group Devices by Role Rather Than Location

1. Logical Grouping
   1. Devices are grouped by function, department or application, no matter which floor or building they are plugged in on.
   2. A finance laptop stays in the finance VLAN when its user moves desks, because the VLAN follows the port configuration rather than the location.
2. Reduced Broadcast Domains
   1. Each VLAN is its own broadcast domain, so a broadcast from one VLAN never reaches the ports in another.
   2. This gives the performance gain of buying separate switches without actually buying them.
3. Isolation of Sensitive Systems
   1. Payroll machines, security cameras and building controls each sit in their own VLAN so that an ordinary user device cannot reach them.
   2. Any traffic that does need to cross is forced up to a router, where it can be filtered and logged.

Why Subnets and VLANs Are Almost Always Used Together

1. A VLAN groups the devices, but the devices still need addresses that reflect that grouping, which is what a subnet supplies.
2. Network designers therefore map one subnet onto one VLAN, so the finance VLAN and the finance subnet contain exactly the same machines.
3. Traffic between the two groups then has to pass a router, which is where an access control list decides what is allowed through.

Segmentation in Real Organisations

1. A University
   1. Student, staff and administrative traffic sit in separate VLANs, with the student network given the least access and the most bandwidth shaping.
   2. Research clusters get their own subnet so that a large data transfer does not slow down lecture theatres.
2. A Hospital
   1. Medical devices sit on a segment that guest Wi-Fi cannot reach at all, because many of those devices cannot be patched.
   2. Patient records sit on a further segment reachable only from clinical workstations, so a compromised reception PC cannot read them.
3. A Retail Chain
   1. Card payment terminals are kept in a segment of their own, separate from stock systems and from the customer Wi-Fi in the same shop.
   2. Card industry rules require this, because a shared network would put every store's payment data within reach of one compromised till.