Network Security Devices (อุปกรณ์ความปลอดภัยเครือข่าย) คืออะไร?
Network Security Devices คือฮาร์ดแวร์ หรือซอฟต์แวร์ (Virtual Appliance) ที่ติดตั้งในเครือข่ายเพื่อ ป้องกัน ตรวจจับ และตอบสนอง ต่อภัยคุกคามทางเครือข่าย
ประเภทหลักของ Network Security Devices
1. Firewall (กั้นไฟ/ผนังไฟ) - Core Device
- Next-Gen Firewall (NGFW): Palo Alto, FortiGate, Check Point, Cisco Firepower, Sophos XG
- Features: App-ID, User-ID, SSL Decryption, IPS, Anti-Malware, URL Filtering, DNS Security
- Cloud/VM: AWS Network Firewall, Azure Firewall, GCP Firewall, FWaaS
2. Intrusion Detection/Prevention System (IDS/IPS)
- NIDS/NIPS: Network-based (Snort, Suricata, Zeek, Cisco Firepower, TippingPoint)
- HIDS/HIPS: Host-based (OSSEC, Wazuh, CrowdStrike, SentinelOne)
- Modes: Inline (IPS - Block) / Tap/Span (IDS - Alert Only)
3. Network Access Control (NAC)
- Cisco ISE, Aruba ClearPass, FortiNAC, Portnox, PacketFence
- 802.1X, MAB, Posture Assessment, Guest Management, IoT Profiling
4. VPN Gateway / Concentrator
- IPsec SSL VPN: Cisco ASA/AnyConnect, FortiClient, Pulse Secure, Palo Alto GlobalProtect
- Zero Trust Network Access (ZTNA): Zscaler ZPA, Cloudflare Access, Twingate
5. Secure Web Gateway (SWG) / Proxy
- Forward Proxy: Zscaler, Netskope, Forcepoint, McAfee Web Gateway, Squid
- SSL Inspection, URL Filtering, DLP, CASB Integration
6. Email Security Gateway
- Proofpoint, Mimecast, Cisco ESA, FortiMail, Microsoft Defender for Office 365
- Anti-Phishing, Anti-Spam, Sandbox, DMARC/DKIM/SPF
7. DDoS Protection / Scrubbing
- Cloud: Cloudflare, Akamai, AWS Shield, Azure DDoS, Radware
- On-prem: Arbor (NETSCOUT), Radware DefensePro, FortiDDoS
8. Network Detection & Response (NDR)
- ExtraHop, Vectra AI, Darktrace, Corelight (Zeek-based), Awake Security
- Behavioral Analytics, ML/AI, Encrypted Traffic Analysis
9. Data Loss Prevention (DLP) - Network
- Symantec/DLP, Forcepoint, Digital Guardian, Netskope, Zscaler
- Inspect Data in Motion (Email, Web, FTP, Cloud)
10. Load Balancer / ADC with Security (WAF, SSL Offload)
- F5 BIG-IP (ASM/WAF), Citrix ADC, A10 Networks, HAProxy + ModSecurity
Active vs Passive Devices
| Type | ตัวอย่าง | การทำงาน |
|---|---|---|
| Active (Inline) | Firewall, IPS, WAF, NAC, Proxy | Block/Modify Traffic จริง |
| Passive (Out-of-band) | IDS, NDR, Packet Capture, SIEM | Monitor/Alert เท่านั้น |
CIA Triad ใน Network Security Devices
- Confidentiality: Encryption (VPN, TLS, MACsec), DLP
- Integrity: IPS, File Integrity Monitoring, Secure Boot
- Availability: DDoS Protection, HA/Clustering, Load Balancing
เลือก Device ยังไง? (Selection Criteria)
- Requirements: Threat Model, Compliance, Use Cases
- Performance: Throughput, Latency, Concurrent Sessions, SSL Decrypt Capacity
- Integration: API, SIEM, SOAR, Cloud, Existing Stack
- Management: Centralized, Automation (API/Ansible/Terraform), Reporting
- TCO: License, Hardware, Maintenance, Staffing, Training
Trend: Consolidation → Platform Approach
- SASE (Secure Access Service Edge): SWG + CASB + ZTNA + FWaaS
- SSE (Security Service Edge): SASE ลบ SD-WAN
- Unified Platform: Palo Alto Prisma, Fortinet Security Fabric, Cisco SecureX, Zscaler
