Understanding Cybersecurity: Network Segmentation

[@Dalai33]

One of the very most underrated channels here! Oh my God thank you very very much

[@intelligencequest]

Thanks so much for the kind words!

[@MrUnisteez]

Thanks! This was a simple explanation that gave me just enough information to answer a lot of the questions I had about network segmentation using VLANs.

[@Allexz]

You deserve more subs!

[@intelligencequest]

Thanks a lot! I appreciate the encouragement

[@leaftro]

Word of Truth!

[@intelligencequest]

@@leaftro thanks the feedback is much appreciated!

[@theancientvoice9272]

Great content, thank you!

[@daizy8888]

This is great video! would you mind clarifying the use of VRF in a segmented network?

[@intelligencequest]

Absolutely! so in the video above I was addressing L2 segmentation, VRF would effectively allow for segmentation of traffic as it was being routed --> think two sets of clients being routed by the same piece of hardware, but for security, logging, analytics you want each of the client networks have their own routing instances, you can utilize Virtual Routing and Forwarding (VRF) to route this traffic but maintain separation of traffic and routing tables

[@StuckInTheM1ddle]

Appreciate this for for an office environment but just for anyone (like myself) looking for ways to segregate a home network, having a L2 Switch (VLAN capable) is not enough for looking to implement VLAN in this way - you need a router that supports VLAN's and nearly all consumer-level routers don't support this.

[@intelligencequest]

I would look into Ubiquiti, they offer some great consumer grade products that I have installed in a number of homes. Their equipment is great for network segmentation implementations

[@clovisvigneault]

You can always find a consumer router that can be flashed to openwrt or ddwrt to unlock these « enterprise » feature, they have lists of compatible routers with their specs

[@techenthusiast4542]

Good info brother!

[@techlife4599]

In Mr. Burns voice....EXXCEELLENT... Great video. I'm a suscriber & sharing 👍

[@intelligencequest]

Thank you! Let's goooo!

[@zemichaelhailu3893]

Great explanation. Subbed

[@sonnix31]

Nicely explained, Thanks

[@intelligencequest]

thanks for the positive feedback! much apprecaited

[@lasagna3084]

Super helpful!

[@SifuNuhai]

How do you test the VLAN is working accordingly?

[@intelligencequest]

You can do a few things... first would be to ping from devices that should be VLAN separated, you should NOT be able to ping between them until a route is set up between vlans.

[@techenthusiast4542]

What gear do you use to draw? (hardware and software) Wacom?

[@intelligencequest]

Yes wacom intuous tablet and pen

[@techenthusiast4542]

@@intelligencequest I just started using it and long ways to go to make it look natural. Right now I struggle in meetings with new work from home situation. Was so used to whiteboard and markers 🤣

[@intelligencequest]

@@techenthusiast4542 100%.. it just takes time.. but I still don't think there is any replacing in person white boarding.. I think a mix of virtual and live has to be what we use going forward 👍

[@jackdavies7337]

So helpful thank you.

[@amigatommy7]

Thinking of 2 10gbe switches with Asus 89x router which has 2 10gbe ports. Not sure both can be used at the same time.

[@intelligencequest]

TBH I'm not sure either tom

[@macster1457]

Can I still do with if I want to segregate my wireless security cameras? - am I going to need 2 wireless routers then?

[@intelligencequest]

There are a couple of things that you can do, but the most common is to make a second SSID aka IOTnetwork with its own password and IP address range and segment that network from your primary wireless network. By segment I mean either add ACL entries if you want to allow certain traffic or deny all traffic from that IOT network to the rest of your network (the implementation of this will be different on different Network Operating Systems - NOS')

[@macster1457]

@@intelligencequest yes... the other thing I need to accomplish is to completely isolate the wireless cameras from the main router. I need to figure out a way to have a 2nd router just for the cameras so the main router has nothing to do with them.

[@MorgorDre]

So whats the actual threat prevented?

[@intelligencequest]

So the "threat" in this case is that any one of the device on your network is compromised. If this occurs and your network is segmented the likelihood of your entire network being compromised is significantly lower. To give you a specific threat example, you could have your file storage server compromised (in a small/medium environment this might be a single device like a Synology NAS). Even more specifically, an attacker leverages vulnerabilities in the file sharing protocol SMB to upload and run software establishing persistence on this file server. If your network is segmented appropriately the attacker will NOT have the ability to pivot to all the other devices in the network. If your network is not segmented, all of the other devices are now potentially victims as well.

[@rozye3004]

You are super cute ! The Humor makes it enjoyable to watch ❤

[@omarinv7863]

Great video thank u so much

[@31qwoz]

Great information

[@wendy_113]

"Thank you very much!"

[@loganborowski]

Great content thank you.

[@intelligencequest]

Thanks! Next up is access control lists!! Should have it out tomorrow!

[@tamashalmai8224]

The security concepts such as L2 segmentation, FW, ACL, router on a stick etc. are all fine. However, my impression is that you try to cover too much in this vlog and give the wrong impression to an especially novice user that these basic security techniques are the holly grails that will cure all security concerns. Therefore I would rather start with a top-down analysis, highlight potential attack vectors and demonstrate which technique would be suitable to mitigate what concern. I.e. what you mention few times in your vlog as defense-in-depth

[@intelligencequest]

Thank you for the feedback! I actually agree to some extent and I think we are trying to fill in the gaps in this content with subsequent videos.. in response to the "cure all nature" of this segmentation video... that certainly was not the intent! How ever we do think segmentation is an area of basic networking that is very under utilized is most small and medium networks.