ประเภท Network Security Devices แบบครบถ้วน
1. Firewall (กำแพงไฟ) - หัวใจของ Network Security
| ประเภท | คำอธิบาย | ใช้เมื่อไหร่ |
|---|---|---|
| Packet Filtering | ตรวจสอบ Header (IP, Port, Protocol) Layer 3/4 | Basic filtering, High throughput |
| Stateful Inspection | จำสถานะ Connection (TCP State Table) | Standard enterprise firewall |
| Application Proxy | Terminate connection, Inspect Layer 7 | Deep inspection, WAF |
| Next-Gen Firewall (NGFW) | App-ID, User-ID, IPS, SSL Inspect, Threat Intel | Modern enterprise (Recommended) |
ยี่ห้อหลัก: Palo Alto Networks, Fortinet FortiGate, Check Point, Cisco Secure Firewall, Sophos XGS
2. Intrusion Detection/Prevention System (IDS/IPS)
- NIDS/NIPS: Network-based (Tap/SPAN Port) - Snort, Suricata, Zeek, Cisco FirePOWER
- HIDS/HIPS: Host-based (Agent บน Server/Endpoint) - OSSEC, Wazuh, CrowdStrike
- Detection Methods: Signature-based (Known threats) + Anomaly/Behavioral (Unknown/Zero-day)
3. Secure Web Gateway (SWG) / Web Proxy
- Forward Proxy: User → Internet (URL Filtering, Malware Scan, DLP, SSL Inspect)
- Reverse Proxy: Internet → Web App (WAF, Bot Mitigation, API Protection)
- Cloud SWG (SASE): Zscaler, Netskope, Cloudflare, Menlo Security
4. Email Security Gateway
- Inbound: Anti-spam, Phishing, Malware, Sandbox, BEC Protection
- Outbound: DLP, Encryption, Archiving
- Cloud-native: Proofpoint, Mimecast, Microsoft Defender, Cisco ESA, FortiMail
5. Network Access Control (NAC)
- Pre-admission: ตรวจ Posture ก่อนให้เข้า Network (802.1X, MAB)
- Post-admission: ตรวจต่อเนื่อง, Re-auth, Quarantine
- Use cases: BYOD, Guest, IoT/OT, Contractor, Device Profiling
- Vendors: Cisco ISE, Aruba ClearPass, FortiNAC, Portnox, Pulse Policy Secure
6. DDoS Protection
- On-premise: Radware, Arbor, FortiDDoS (สำหรับ Application Layer)
- Cloud Scrubbing: Cloudflare, Akamai, AWS Shield, Azure DDoS Protection (Volumetric)
- Always-on vs On-demand
7. Data Loss Prevention (DLP) Network
- Monitor/Block ข้อมูลละเอียดอ่อน (PII, PCI, PHI, IP) ใน Traffic
- Channels: Email, Web, Cloud App, FTP, USB/Endpoint
- Vendors: Symantec/Broadcom, Forcepoint, Digital Guardian, Microsoft Purview
8. VPN Gateway / ZTNA (Zero Trust Network Access)
- Traditional VPN: IPsec, SSL VPN, WireGuard (Network-level access)
- ZTNA: Application-level access, Identity-aware, No lateral movement
- Vendors: Palo Alto Prisma Access, Zscaler ZPA, Cloudflare Access, Cisco Duo, Twingate
9. SIEM / SOAR (Security Operations)
- SIEM: Log Collection, Correlation, Alerting (Splunk, QRadar, Elastic, LogRhythm, FortiSIEM)
- SOAR: Automation, Playbook, Case Management (Palo Alto Cortex XSOAR, Splunk SOAR, FortiSOAR)
10. Threat Intelligence Platform (TIP)
- Aggregate, Enrich, Share IOC (IP, Domain, Hash, URL)
- MISP, Anomali, ThreatConnect, IBM X-Force Exchange
Network Devices (ไม่ใช่ Security Devices แต่เกี่ยวข้อง)
| Device | Function | Security Relevance |
|---|---|---|
| Router | Routing between networks | ACL, Zone-based FW, VPN |
| Switch | L2 Forwarding, VLAN | Port Security, DHCP Snooping, DAI, 802.1X |
| Wireless Controller/AP | Wi-Fi Management | WPA3, 802.1X, Guest Isolation, Rogue AP Detection |
| Load Balancer | Traffic Distribution | WAF, SSL Offload, DDoS |
การเลือกใช้: Defense in Depth Strategy
ไม่มี Device ตัวไหน "ครบวงจร" เอง ต้องวางหลายชั้น:
- Perimeter: NGFW + DDoS Protection
- Network Core: Segmentation (VLAN, Firewall), NAC, NIDS
- Application: WAF, API Gateway, SWG
- Endpoint: EDR/XDR, Anti-malware, DLP Agent
- Data: Encryption, DLP, Classification
- Visibility: SIEM, NDR, UEBA, TIP
Threat Types ที่ Devices ป้องกัน
- Direct Threats: โจมตีโดยตรง (Exploit, Brute Force)
- Indirect Threats: ผ่าน Third-party, Supply Chain
- Veiled Threats: ซ่อนตัว (Encrypted Traffic, Living off the Land)
- Conditional Threats: กระตุ้นเมื่อเงื่อนไขตรง (Logic Bomb, Time-based)
