Unit 9: Firewalls and segmentation · Lesson 4 of 6 · 18 min

Segmentation and zero trust

Compare observed internal connections with the allowed paths between zones and find the ones that should never happen.

mission

You are
The analyst checking segmentation.
Situation
The network is split into zones with a short list of allowed paths. Flow logs from the internal firewall show what actually connected this afternoon.
Goal
Find every observed connection that is not on the allowed list.
Hand in
The source of the forbidden connections and the database server it reached.

Segmentation as rooms and doors

01

Learn the allowed paths

Read the first tab. Every row is a door between two zones with a reason.

you should see Laptops reach web, mail, intranet and DNS. Only the jump host reaches SSH. Only web01 reaches the database.

02

Check each observed connection

Switch tabs and sort by Source. For each row, find the door it used.

you should see One laptop tried SSH, file sharing and remote desktop on several servers within a second. None of those doors exist for laptops.

defender tip Zero trust means every connection must be explicitly allowed for that identity and that service, even inside the network. A laptop reaching db01 on SSH would be refused by policy before any firewall rule is consulted.

03

Weigh the results

syn-ack means a server answered. Those are the gaps in segmentation, even if nothing else happened.

you should see Two servers answered SSH from a laptop, one of them the database server.

04

Confirm in the capture

The same afternoon is in incident.pcap. The SYN-ACKs prove the paths were open.

analyst@net-lab
tshark -r incident.pcap -Y 'ip.src==10.20.0.0/24 && tcp.flags.syn==1 && tcp.flags.ack==1' -T fields -e ip.src -e tcp.srcport
10.20.0.11	22
10.20.0.12	22

What a defender takes away

  1. 1Segmentation is a short list of doors with reasons. Everything else is wall.
  2. 2Compare what connected with what is allowed, not just what was blocked.
  3. 3A server answering a laptop on an admin port is a segmentation gap, even if the login failed.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    Sort the observed connections by source.

  2. Show hint

    Look for syn-ack rows.