In the ever-evolving landscape of cybersecurity, businesses are often lured by the promise of cutting-edge solutions like zero trust frameworks. While zero trust is a significant step forward, it falls short of its potential without proper segmentation and categorization. Many organizations mistakenly consider it a one-size-fits-all solution, overlooking fundamental strategies that fortify their security posture. At the core of this oversight lies the underlay infrastructure, particularly the often-neglected aspect of virtual LANs and routers.

Virtual LANs

A foundational element in bolstering network security is the utilization of virtual LANs (VLANs), acting as the essential building blocks of segmentation. The concept of VLANs involves categorizing traffic and users, creating separate virtual networks within a single physical network. Yet, despite their pivotal role, many businesses fail to implement VLANs effectively.

Categorizing traffic is crucial, delineating between functional departments, critical business services, operational technology, information technology, supply chain networks, and social networking services. By partitioning these various traffic types, businesses can control and isolate data flows, minimizing the risk of breaches or unauthorized access.

Moreover, guest and visitor networks must be distinct entities, segregated from the core infrastructure. This segregation prevents potential vulnerabilities or unauthorized access by external parties, safeguarding critical business assets.

An often-overlooked feature of VLANs is client isolation. Client isolation can be applied across both wireless and wired networks. This feature prevents lateral movement between clients within the same network, significantly reducing the risk of internal threats without the complexities of introducing intricate firewall rules or relying solely on a zero-trust approach.

Virtual Routers

However, the effective deployment of VLANs necessitates their association with virtual routers. These routers serve as the architectural backbone for segmentation. By interlinking VLANs through virtual routers, businesses establish a robust and scalable structure that effectively segregates different segments of their network.

Implementing virtual routers enables businesses to enforce access controls, manage traffic flow, and strengthen overall network security. It provides a clear framework for managing VLANs, ensuring that each segment operates independently while still being part of the larger network infrastructure.

Access Control Lists (ACLs)

Security professionals often undermine the importance of ACLs and encourage a business to implement strategies that are reliant on a next generation black box where the defense mechanisms are invisible or convoluted.

Appropriate ACLs between categorized traffic is a compulsory requirement before relying any alternative magic sauce. Attempting to use interception strategies is resource intensive and fails. Most traffic has become encrypted and has revision changes. Chances that your magic sauce appliance will see the latest encryption standards are slim and any intercepting and understanding propriety ones is non-existent. Bad actors will use proprietary protocols that will thwart inspection attempts and a strategy relying on that vector is an exercise in futility.

SD-WAN

SD-WAN facilities the aggregation of a businesses network from the edge to a data centre where traffic can be steered on alternative paths directly without requiring a universally accessible path. This strategy is dramatically easier and more simple to implement than attempting an architectural deployment on the edge which would lead to inconsistencies and unnecessary duplication.

As an example, business critical traffic can connect via a data centre cross connect directly into a co-location where the business servers are securely hosted. Access to content distribution networks as favoured by social media companies and streaming services can be direct via Internet Peering Exchanges. Operational Technology networks should have no Internet access while supply chain networks should only connect to the designated 3rd party supplier. This simple mitigation would have stopped the Solarwinds hack in its tracks.

Wrap

Businesses must recognize that while cutting-edge solutions like zero trust architectures are valuable, they are not standalone fixes for cybersecurity. The basics of network security, such as VLANs and virtual routers, lay the groundwork for a resilient and layered defense strategy.

Wrapping up, the efficacy of cybersecurity measures lies not only in advanced solutions but also in the meticulous attention to foundational elements. Virtual routers, coupled with VLANs, offer a powerful yet often underutilized means to fortify network security. By implementing these fundamental tools effectively, businesses can establish a robust and comprehensive security posture, safeguarding their critical assets against an evolving threat landscape.

---

Ronald Bartels ensures that Internet inhabiting things are connected reliably online at Fusion Broadband South Africa - the leading specialized SD-WAN provider in South Africa. Learn more: 👉 Contact Fusion