Network Security Model คืออะไร?
Network Security Model เป็นกรอบแนวคิด (Framework) ที่อธิบายว่า ความปลอดภัยเครือข่ายทำงานอย่างไร — ประกอบด้วย Entities (Entities), Assets, Threats, Vulnerabilities, Controls, Policies, Processes และ Trust Boundaries เพื่อให้สามารถออกแบบ Implement และ Audit ความปลอดภัยได้อย่างเป็นระบบ
โมเดลมาตรฐานที่ใช้กันอย่างแพร่หลาย
1. NIST Cybersecurity Framework (CSF) 2.0 — โมเดลระดับนโยบาย/องค์กร
5+1 Functions (Govern เพิ่มใน v2.0):
- Govern (GV): กำหนดนโยบาย กลยุทธ์ หน้าที่ความรับผิดชอบ จัดการความเสี่ยง
- Identify (ID): Asset Management, Business Environment, Governance, Risk Assessment, Supply Chain Risk
- Protect (PR): Access Control, Awareness Training, Data Security, Platform Security, Technology Resilience
- Detect (DE): Continuous Monitoring, Adverse Event Analysis, Detection Processes
- Respond (RS): Incident Management, Analysis, Mitigation, Reporting, Communication
- Recover (RC): Recovery Planning, Communications, Improvements
2. Zero Trust Architecture (NIST SP 800-207) — โมเดลสถาปัตยกรรมสมัยใหม่
Core Principles: Never Trust, Always Verify + Assume Breach
- Policy Engine (PE) + Policy Administrator (PA) + Policy Enforcement Point (PEP) — รูปแบบ Logical Components
- Trust Algorithm: Input: Subject (Identity+Device), Asset, Resource, Context (Time, Location, Behavior) → Decision: Allow/Deny/Step-up
- Data Plane vs Control Plane Separation
3. OSI Model Security Mapping (Layered Defense)
| OSI Layer | Security Controls | Threats |
|---|---|---|
| 7 Application | WAF, API Gateway, AppSec (SAST/DAST/IAST), Secure Coding, AuthZ/AuthN | OWASP Top 10, API Abuse, Business Logic Flaws |
| 6 Presentation | TLS/SSL Encryption, Certificate Validation, Encoding/Serialization Safety | MITM, Downgrade, Padding Oracle, Deserialization |
| 5 Session | Session Management, Token Security, MFA, Session Timeout, Concurrent Session Control | Session Hijacking, Fixation, Replay |
| 4 Transport | TLS 1.3, DTLS, QUIC, Port Security, TCP Hardening (SYN Cookies) | Port Scanning, TCP RST, Hijacking, Amplification |
| 3 Network | Firewall, ACL, Routing Security (RPKI, BGPsec), IPsec, Segmentation (VLAN/VRF), DDoS Protection | IP Spoofing, Routing Hijack, DDoS, Lateral Movement |
| 2 Data Link | Port Security, DHCP Snooping, DAI, IP Source Guard, 802.1X, MACsec, VLAN Isolation | ARP Spoofing, DHCP Starvation, VLAN Hopping, MAC Flooding |
| 1 Physical | Physical Access Control, Cable Security, TEMPEST, Fiber Monitoring, Environmental | Cable Tapping, Device Theft, Hardware Implant, Power/Cooling Failure |
4. Classic Network Security Model (RFC 2828 / ISO 7498-2) — โมเดลทางทฤษฎี
- Security Services: Confidentiality, Integrity, Availability, Authenticity, Non-repudiation, Access Control
- Security Mechanisms: Encryption, Digital Signature, Access Control, Authentication Exchange, Traffic Padding, Routing Control, Notarization
- Security Attacks: Interruption, Interception, Modification, Fabrication (Passive vs Active)
องค์ประกอบเทคนิค (Technical Components) ของ Network Security Model
| Component | Function | Examples |
|---|---|---|
| Perimeter Firewall / NGFW | North-South Traffic Control, App-ID, IPS, URL Filtering, SSL Decrypt | Palo Alto, Fortinet, Check Point, Cisco FTD |
| Internal Segmentation Firewall / East-West FW | Micro-segmentation, Lateral Movement Prevention | VMware NSX, Cisco ACI, Illumio, Guardicore |
| Network Access Control (NAC) | Device Profiling, Posture Assessment, 802.1X, MAB, Guest/Onboarding | Cisco ISE, Aruba ClearPass, FortiNAC, Portnox |
| Zero Trust Network Access (ZTNA) | App-level Access, Identity-centric, Continuous Verification | Zscaler ZPA, Cloudflare Access, Twingate, Netskope |
| Secure Web Gateway (SWG) / Proxy | Outbound Filtering, SSL Inspection, DLP, RBI, CASB | Zscaler, Netskope, Forcepoint, Cisco Umbrella |
| Network Detection & Response (NDR) | Traffic Analysis, Behavioral Analytics, Threat Hunting, Decryption | ExtraHop, Vectra AI, Darktrace, Corelight (Zeek) |
| DDoS Protection | L3/4 Volumetric, L7 Application, DNS Protection | Cloudflare, AWS Shield, Arbor, Radware |
| VPN / Remote Access | IPsec, SSL VPN, WireGuard, ZTNA Client | Palo Alto GlobalProtect, FortiClient, OpenVPN, Tailscale |
| DNS Security | RPZ, DNSSEC, DoH/DoT, Protective DNS | Infoblox, Cisco Umbrella, Quad9, NextDNS |
| SIEM / SOAR / XDR | Log Correlation, Alerting, Investigation, Automated Response | Splunk, Sentinel, Elastic, CrowdStrike, Cortex XSOAR |
Operational Model: PDCA / Continuous Cycle
- Plan: Risk Assessment → Policy/Standard → Architecture Design → Control Selection
- Do: Implement (Config, Deploy, Integrate), Train, Document, Baseline
- Check: Monitor (SIEM/NDR), Scan (Vuln, Config), Audit, Test (Pen Test, Red Team, Breach Attack Simulation)
- Act: Remediate, Patch, Tune Rules, Update Policy, Improve Process, Lessons Learned
ทำไมต้องมี Network Security Model?
- ให้ Common Language ระหว่าง Technical, Management, Audit, Vendor
- รับประกัน Coverage (No Gaps) และ Consistency (Standardized Controls)
- รองรับ Compliance Mapping (NIST CSF → ISO 27001 → PCI-DSS → PDPA)
- ช่วย Prioritization (Risk-based) และ Investment Justification
- รองรับ Automation & Scalability (Policy-as-Code, GitOps)
สรุป
Network Security Model ไม่ใช่ Diagram เดียว — เป็น ชุดของโมเดลหลายระดับ: Strategic (NIST CSF), Architectural (Zero Trust), Layered (OSI Security), Operational (PDCA) และ Technical (Component Stack) การเลือก/ปรับแต่งโมเดลให้เหมาะกับองค์กร (Size, Industry, Maturity, Cloud/On-prem, Regulatory) คือกุญแจสู่ Security Program ที่มีประสิทธิภาพและยั่งยืน
