Network Security ต้องปกป้องอะไรบ้าง? (What Must Be Protected)
Network Security ไม่ใช่การปกป้อง "เครือข่าย" อย่างเดียว แต่ครอบคลุม ทุกชั้น (Layer) และทุกมิติ ของระบบสารสนเทศ ตามหลัก CIA Triad ขยายสู่ Parkerian Hexad (Possession/Control, Authenticity, Utility)
1. Data (ข้อมูล) - หัวใจของการปกป้อง
| ประเภทข้อมูล | ตัวอย่าง | มาตรการปกป้องหลัก |
|---|
| Data at Rest (ข้อมูลเก็บไว้) | Database, File Server, Backup, Archive, Cloud Storage (S3, Blob) | Encryption (AES-256), Access Control (ACL/RBAC/ABAC), DLP, Tokenization, Masking |
| Data in Transit (ข้อมูลขนส่ง) | Web Traffic, API Calls, Email, File Transfer, Replication, Backup Stream | TLS 1.2/1.3, IPsec, MACsec, SSH, SFTP, Mutual TLS (mTLS) |
| Data in Use (ข้อมูลประมวลผล) | RAM, CPU Cache, Registers, GPU VRAM, Enclave (SGX, SEV, TrustZone) | Confidential Computing (TEE), Memory Encryption, Homomorphic Encryption, Secure Enclaves |
| Sensitive Data Types | PII, PHI, PCI (CHD), PI, Credentials, Keys/Certs, IP/Trade Secrets, Classified Gov | Classification, Labeling, DLP, IRM, Key Management (HSM/KMS), Access Logging |
2. Infrastructure & Assets (โครงสร้างพื้นฐานและสินทรัพย์)
| หมวดหมู่ | องค์ประกอบ | มาตรการปกป้อง |
|---|
| Network Devices | Router, Switch, Firewall, Load Balancer, WLC, ADC, Gateway | Hardening (CIS Benchmark), AAA (TACACS+/RADIUS), Firmware Mgmt, Config Backup/Versioning, Out-of-band Mgmt |
| Servers & Compute | Physical, Virtual (VM), Container (K8s), Serverless, Cloud Instances | Image Hardening, Patch Mgmt, EDR/XDR, Host Firewall, Immutable Infra, CIS Benchmarks |
| Endpoints | Laptop, Desktop, Mobile, IoT/OT, Printer, Camera, BYOD | EDR/XDR, MDM/UEM, App Control (WDAC/AppLocker), Disk Encryption, Patch, Conditional Access |
| Applications & APIs | Web Apps, Microservices, APIs (REST/gRPC/GraphQL), Legacy Apps | WAF, API Gateway, SAST/DAST/IAST/SCA, Secure SDLC, AuthZ/AuthN (OAuth/OIDC), Rate Limiting |
| Identity Systems | AD/Entra ID, IdP (Okta, Ping), PAM, MFA, Directory, Certificate Authority (PKI) | MFA (Phishing-resistant), PAM, Lifecycle Mgmt, Privileged Access Governance, Conditional Access |
| Security Tools | SIEM, SOAR, Vuln Scanner, Threat Intel, Deception, Email/Web Gateway, DLP | Self-protection, Tamper-proof Logs, Secure Config, Privileged Access Only, Regular Updates |
3. Network Communications & Channels (การสื่อสารและช่องทาง)
- External/Internet Edge: Inbound/Outbound Traffic, DDoS Protection, FW, WAF, Email/Web Gateway, DNS Security, VPN/ZTNA
- Internal (East-West): Micro-segmentation (Zero Trust), Internal FW, IDS/IPS, NetFlow/Zeek, Lateral Movement Detection
- Wireless: WPA3-Enterprise (802.1X), NAC, Guest/Isolation, IoT VLAN, Rogue AP Detection
- Remote Access: ZTNA (Preferred), VPN (MFA, Posture Check), Bastion/Jump Host, Privileged Access
- Cloud Connectivity: Direct Connect, ExpressRoute, Cloud Interconnect, Transit Gateway, SASE/SSE
- Supply Chain/Partner Links: Dedicated Circuits, API Gateway, Zero Trust Network Access, Contractual Security
4. Operational Processes & Controls (กระบวนการและการควบคุมปฏิบัติการ)
| Process | คำอธิบาย | Key Controls |
|---|
| Vulnerability Management | Continuous Scan, Risk-based Prioritization (EPSS/KEV), Remediation SLA, Exception Mgmt | Tenable/Qualys/Rapid7, Automated Ticketing, Patch Mgmt (WSUS/Intune/Ansible) |
| Change Management | CAB, Risk Assessment, Testing, Rollback, Approval, Documentation, Emergency Process | ITSM (ServiceNow/Jira), GitOps, IaC (Terraform/Ansible), Policy as Code (OPA) |
| Incident Response | Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned | IR Plan, Playbooks, SOC, SOAR, Forensics, Legal/PR/LE Coordination, Cyber Insurance |
| Access Governance | Joiner/Mover/Leaver (JML), Access Review (Quarterly), Segregation of Duties (SoD) | IGA (SailPoint, Saviynt, Azure AD Access Reviews), PAM Session Recording |
| Security Awareness | Phishing Sim, Role-based Training, Culture, Reporting Mechanism, Metrics | KnowBe4, Proofpoint, Custom, Phish Reporting Button, Gamification |
| Third-party Risk (TPRM) | Vendor Assessment, Tiering, Contractual Clauses, Continuous Monitoring, Offboarding | Security Ratings (Bitsight, SecurityScorecard), Questionnaire (SIG Lite), On-site Audit |
| Business Continuity / DR | RTO/RPO, Backup (3-2-1-1-0), Immutable Backup, Failover Test, Ransomware Recovery | Veeam/Rubrik/Commvault, Cloud DR (AWS/Azure/GCP), Clean Room, Tabletop Exercise |
5. Policies, Standards & Compliance (นโยบาย มาตรฐาน และการปฏิบัติตาม)
- Policies (High-level): Information Security Policy, Acceptable Use, Data Classification, Incident Response, Remote Work, Cryptography
- Standards (Mandatory): Password Standard, Encryption Standard, Network Device Hardening Standard, Cloud Security Baseline
- Procedures/Guidelines (Operational): How-to: Onboard User, Provision Server, Respond to Phishing, Rotate Keys
- Regulatory/Compliance: Thailand: PDPA, Cybersecurity Act (CII), BOT Notification, SEC, NHSO | Global: GDPR, PCI DSS, ISO 27001, NIST CSF, SOC 2, HIPAA, NIS2, DORA
- Audit & Assurance: Internal Audit, External Audit, Penetration Test (Annual + Major Change), Red Team, Compliance Attestation
6. People & Culture (บุคคลและวัฒนธรรม) - ปัจจัยสำคัญที่สุด
- Security Culture: "Security is Everyone's Responsibility" ไม่ใช่แค่ IT/Security Team
- Roles & Accountability: CISO, CIO, DPO, Data Owners, System Owners, Security Champions, All Employees
- Psychological Safety: รายงาน Incident/Error ได้โดยไม่กลัวลงโทษ (Blameless Postmortem)
- Skills Development: Continuous Training, Certifications, Career Path, Purple Team Exercises
- Insider Threat Program: Detection (UEBA), Investigation, Mitigation, Legal/HR Coordination
Framework แนะนำสำหรับการครอบคลุม (Coverage Frameworks)
| Framework | Focus | ใช้ได้กับ |
|---|
| NIST CSF 2.0 | Govern, Identify, Protect, Detect, Respond, Recover | ทุกองค์กร ทุกขนาด ทุกอุตสาหกรรม (De facto Global Standard) |
| CIS Controls v8.1 | 18 Critical Controls (Implementation Groups IG1/IG2/IG3) | Prioritization ชัดเจน, Measurable, Community Tools |
| ISO 27001:2022 | ISMS, Risk Treatment, Annex A Controls (93 Controls) | Certification, International Business, Supply Chain Requirement |
| MITRE ATT&CK | Adversary Tactics, Techniques, Procedures (TTPs) | Threat Modeling, Detection Engineering, Red/Blue Team, Gap Analysis |
| Zero Trust (NIST 800-207 / CISA ZTMM) | Never Trust, Always Verify, Assume Breach | Modern Architecture, Cloud/Hybrid, Remote Work, Federal Mandate |
สรุป: Checklist "สิ่งที่ต้องปกป้อง" สำหรับ Network Security
- ☐ Data: At Rest (Encrypted), In Transit (TLS 1.3), In Use (Confidential Computing), Classified & Labeled
- ☐ Network Devices: Hardened, AAA, Patched, Config Versioned, OOB Management
- ☐ Servers/Compute: Hardened Images, Patched, EDR, Immutable, Least Privilege
- ☐ Endpoints: EDR/XDR, Encrypted, Managed (MDM), App Control, Conditional Access
- ☐ Applications/APIs: Secure SDLC, WAF/API GW, AuthZ/AuthN, Rate Limit, SCA/SAST/DAST
- ☐ Identity: MFA (Phishing-resistant), PAM, Lifecycle, Zero Trust Access, PKI
- ☐ Communications: Perimeter FW, East-West Segmentation, Wireless 802.1X, ZTNA/VPN, Cloud Connect
- ☐ Processes: Vuln Mgmt, Change Mgmt, IR, Access Governance, Awareness, TPRM, BC/DR
- ☐ Policies/Compliance: Policy Hierarchy, Regulatory Mapping, Audit Program, Evidence Collection
- ☐ People: Culture, Roles, Training, Psychological Safety, Skills, Insider Threat Program
Key Takeaway: Network Security ปกป้องไม่ได้แค่ "Port และ Protocol" แต่ต้องปกป้อง Data, Identity, Compute, Application, Process, Policy, และ People อย่างครบถ้วน (Holistic) ตาม Framework ที่เลือกใช้ และวัดผลด้วย Metrics/KPIs ที่เชื่อมโยงกับ Business Risk
