Network Security Devices: ประเภท หน้าที่ และการเลือกใช้
องค์กรสมัยใหม่ต้องใช้ Defense in Depth (หลายชั้น) ไม่ใช่อุปกรณ์เดียวจบ อุปกรณ์แต่ละตัวแก้ปัญหา Layer/Vector ต่างกัน
1. Firewall (Next-Generation Firewall - NGFW) - Core Perimeter
- หน้าที่: ควบคุม Traffic In/Out ตาม Policy (L3/L4/L7), App-ID, User-ID, IPS, AV, URL Filtering, SSL Decrypt, Sandbox
- ตำแหน่ง: Perimeter (Internet Edge), Internal Segmentation (DC, OT, Guest), Cloud (FWaaS/SASE)
- Vendor: Palo Alto, Fortinet, Check Point, Cisco (Firepower/ASA), Sophos, WatchGuard, OPNsense/pfSense (Open Source)
- Key Feature: App Control, TLS Inspection, Threat Prevention, Automation/API
2. Intrusion Detection/Prevention System (IDS/IPS)
- IDS (Detection): Passive (TAP/SPAN) → Alert Only (Snort, Suricata, Zeek)
- IPS (Prevention): Inline → Block/Drop แพ็กเก็ตอันตราย (NGFW Integrated หรือ Standalone)
- Detection Methods: Signature (Known), Anomaly/Behavioral (Unknown), Protocol Analysis
- Placement: Perimeter, Internal Segments, Cloud (AWS/GCP/Azure Network Firewall/IDS)
3. Web Application Firewall (WAF)
- Focus: Layer 7 (HTTP/HTTPS) - OWASP Top 10 (SQLi, XSS, RCE, LFI, RFI, API Abuse)
- Mode: Reverse Proxy (Terminate TLS) / Out-of-band (Mirror) / Sidecar (K8s)
- Vendor: Cloudflare, AWS WAF, Azure WAF, Imperva, F5 ASM, ModSecurity (Open Source), Wallarm
- Advanced: Bot Management, API Security, DDoS Protection, Client-side Protection
4. Secure Web Gateway (SWG) / Proxy
- หน้าที่: Filter Outbound Web Traffic (User → Internet) - URL Category, Malware Scan, DLP, SSL Inspection
- Forward Proxy: Explicit (PAC/WPAD) / Transparent (Intercept)
- CASB (Cloud Access Security Broker): Shadow IT Discovery, Data Protection, Threat Protection สำหรับ SaaS (O365, GWS, Salesforce, Slack)
- Vendor: Zscaler, Netskope, Palo Alto Prisma, Forcepoint, Menlo Security, iboss
5. Network Detection & Response (NDR)
- Focus: Network Traffic Analysis (NTA) + ML/Behavioral → Detect Unknown Threats (C2, Lateral, Exfil, Recon)
- Data Source: SPAN/TAP, NetFlow, Cloud Flow Logs, Packet Capture
- No Agent Required (Network-based) - เห็น Encrypted Traffic Metadata (JA3, SNI, Cert)
- Vendor: Darktrace, Vectra AI, ExtraHop, Corelight (Zeek-based), Awake, Stamus
6. Network Access Control (NAC)
- หน้าที่: Identify, Authenticate, Authorize, Posture Check Device ก่อนให้เข้าถึง Network
- Methods: 802.1X (Port-based), MAB (MAC Auth Bypass), Captive Portal, Agent/Posture Agent
- Actions: VLAN Assignment, ACL/Dynamic ACL, Quarantine, Remediate
- Vendor: Cisco ISE, Aruba ClearPass, FortiNAC, Portnox, PacketFence (Open Source)
7. DDoS Protection / Scrubbing
- On-prem: Radware, Arbor (NETSCOUT), FortiDDoS, A10 - Layer 3/4/7 Mitigation
- Cloud/Always-on: Cloudflare, Akamai, AWS Shield, Azure DDoS, Google Cloud Armor - Absorb Volumetric Attacks
- Hybrid: On-prem Detection + Cloud Scrubbing
8. VPN / Zero Trust Network Access (ZTNA)
- Traditional VPN: IPsec SSL VPN (Full Network Access) - FortiClient, AnyConnect, GlobalProtect, OpenVPN, WireGuard
- ZTNA (Zero Trust Network Access): Application-level Access, Identity-based, Device Posture, No Network Visibility - Zscaler ZPA, Cloudflare Access, Twingate, Tailscale, Pomerium, Boundary
9. Email Security Gateway
- Inbound: Anti-Spam, Anti-Phishing, Anti-Malware, Sandbox, DMARC/DKIM/SPF, URL Rewriting, QR Code Analysis
- Outbound: DLP, Encryption, Account Takeover Protection
- Vendor: Proofpoint, Mimecast, Microsoft Defender for Office 365, Cisco Secure Email, FortiMail, SpamTitan
10. Data Loss Prevention (DLP) - Network/Endpoint/Cloud
- Network DLP: Inspect Traffic (Email, Web, FTP, Cloud) → Detect/Block Sensitive Data (Regex, Dictionary, Fingerprint, ML)
- Endpoint DLP: Agent-based (Clipboard, Print, USB, Screen Capture, Cloud Sync)
- Vendor: Forcepoint, Symantec (Broadcom), Digital Guardian, Microsoft Purview, Nightfall, Cyberhaven
11. Deception Technology / Honeypots
- Deploy Decoys (Fake Servers, Credentials, Shares, AD Objects, IoT) → Detect Attacker Early, Waste Attacker Time, Generate High-Fidelity Alerts
- Vendor: Attivo (SentinelOne), Illusive, TrapX, CounterCraft, Thinkst Canary (Simple/Effective)
12. Security Information & Event Management (SIEM) + SOAR
- SIEM: Collect, Normalize, Correlate, Alert, Dashboard, Hunt, Compliance Report (Splunk, Elastic, Sentinel, QRadar, LogRhythm, Graylog, Wazuh)
- SOAR: Automate Response (Playbooks), Enrichment, Case Management, Threat Intel Integration (Cortex XSOAR, Splunk SOAR, FortiSOAR, Shuffle, Tines)
Comparison Table: When to Use What?
| ความต้องการ | อุปกรณ์/โซลูชันหลัก | เสริม |
|---|---|---|
| Perimeter Protection | NGFW | IPS, DDoS, Threat Intel |
| Internal Segmentation / Zero Trust | Internal NGFW / Micro-segmentation (Illumio) / NAC | NDR, Deception |
| Web App Protection | WAF | API Security, Bot Mgmt |
| User Internet Access Control | SWG / CASB / SASE | DLP, RBI (Remote Browser Isolation) |
| Encrypted Traffic Visibility | NGFW SSL Decrypt / NDR (Metadata) / TLS Inspection Proxy | eBPF Host-based |
| Remote Access | ZTNA (Preferred) / VPN | MFA, Device Posture |
| Email Threat Protection | Email Security Gateway | DMARC, User Training |
| Data Exfiltration Prevention | DLP (Network + Endpoint + Cloud) | CASB, NDR |
| Unknown Threat Detection | NDR + Threat Hunting + Deception | EDR/XDR, Sandbox |
| Centralized Visibility/Compliance | SIEM + SOAR | Threat Intel, UEBA |
แนวโน้มปัจจุบัน: Consolidation → Platform Approach
- SASE (Secure Access Service Edge): Converge SWG + CASB + ZTNA + FWaaS + SD-WAN (Single Vendor: Zscaler, Netskope, Palo Alto Prisma, Cato, Versa)
- XDR (Extended Detection & Response): Unify Endpoint + Network + Cloud + Email + Identity Telemetry (CrowdStrike, SentinelOne, Microsoft Defender XDR, Palo Alto Cortex XDR, Trend Vision One)
- Cloud-Native Security: CNAPP (Cloud-Native Application Protection Platform) - Wiz, Orca, Lacework, Sysdig, Prisma Cloud
สรุป
ไม่มี "Single Silver Bullet" ต้องใช้ Layered Defense: NGFW (Perimeter/Internal) + WAF (Apps) + SWG/CASB (User Web) + ZTNA (Remote) + NDR (Visibility) + Email Security + DLP + SIEM/SOAR (Ops) → รวมเป็น SASE/XDR Platform ตามความพร้อมและงบประมาณ
