Data Center Network Security: หลักการออกแบบพื้นฐาน
Data Center Network Security ต้องปฏิบัติตามหลัก Defense in Depth (纵深防御) แบ่งเป็น 4 Layers (Tier 1-4 ตาม Uptime Institute / TIA-942):
Layer 1: Perimeter Security (ขอบเขตภายนอก)
- Physical: Perimeter Fence, Bollards, CCTV 24/7, Motion Sensors, Intrusion Detection, Security Guards, Mantrap Entry
- Network: Border Router → External Firewall (DDoS Scrubbing, Geo-blocking, Threat Intel Feed) → DMZ
- DDoS Protection: On-prem (Arbor, Radware) + Cloud Scrubbing (Cloudflare, AWS Shield, Akamai) — Hybrid Approach
Layer 2: Facility Security (สถานที่/อาคาร)
- Access Control: Biometric (Palm Vein/Iris) + MFA (Badge + PIN) ทุก Entry Point
- Zoning: Public → Reception → Operations → Restricted (Server Room) → High Security (Cage/Vault)
- Environmental: Fire Suppression (Inert Gas/FM-200), VESDA, Water Leak Detection, EMI Shielding
- Power/Cooling Redundancy: N+1 or 2N UPS, Generator, PDU Monitoring
Layer 3: Computer Room / White Space Security (ห้องเซิร์ฟเวอร์)
- Cabinet/Rack Security: Electronic Lock (Biometric/RFID), Per-PDU Power Monitoring, Environmental Sensors
- Network Segmentation (Core):
- Management Network (OOB): แยกกายภาพ/ลอจิก (Dedicated Switch, VRF) — ไม่ร่วมกับ Production
- Production Networks: Tenant VLANs/VXLANs, Micro-segmentation (ACI/NSX/Calico)
- Storage Network: Dedicated Fabric (FC/IP Storage), Isolated
- Backup/Replication Network: Isolated, Bandwidth Reserved
- Inter-DC Interconnect (DCI): IPsec/MACsec Encryption, Dedicated Lambda/Wave
- East-West Traffic Inspection: Distributed Firewall (Micro-segmentation), NDR Sensors, Service Chaining (FW, LB, WAF)
Layer 4: Cabinet / Asset Security (ระดับแร็ก/อุปกรณ์)
- Device Hardening: CIS Benchmarks/STIG สำหรับ Switch, Router, Firewall, Server, Storage, PDU
- Secure Boot, TPM 2.0, Measured Boot สำหรับ Server/Appliance
- Hardware Root of Trust: Silicon-level (Intel PTT/AMD PSP, Cisco Secure Boot)
- Port Security: 802.1X/MAB, Port Authentication, Sticky MAC, BPDU Guard, Root Guard
Network Security Devices ใน Data Center (Core Stack)
| Device/Function | Purpose | Placement |
|---|---|---|
| Border/Edge Firewall | North-South Inspection, DDoS, Threat Prevention | Internet Edge, DCI Edge |
| Internal Segmentation Firewall / Distributed FW | East-West Micro-segmentation, Zero Trust | Hypervisor/Host/Network (NSX, ACI, Illumio) |
| DDoS Scrubber | Volumetric/Application DDoS Mitigation | Internet Edge (Inline/Out-of-band) |
| WAF (Web App Firewall) | OWASP Top 10, API Protection, Bot Mitigation | DMZ, App Tier, Cloud |
| NDR (Network Detection & Response) | Behavioral Analytics, Threat Hunting, Encrypted Traffic Analysis | Core/Aggregation (SPAN/TAP/Packet Broker) |
| DNS Security (Protective DNS) | Block C2, DGA, Malicious Domains, DNS Tunneling | Recursive Resolver, Forwarder |
| Load Balancer (ADC) + SSL Offload | TLS Termination, L7 Inspection, WAF Integration | App Tier, DMZ |
| Network Packet Broker / TAP | Traffic Visibility, Tool Aggregation, Deduplication | Aggregation/Core Layer |
Security Operations & Compliance
- SIEM/SOAR: Centralized Logging (Syslog, NetFlow, sFlow, Streaming Telemetry, Cloud Logs)
- Threat Intelligence Integration: STIX/TAXII, MISP, Commercial Feeds → Auto-block
- Vulnerability Management: Continuous Scanning (Network + Host), Patch SLA, Compensating Controls
- Compliance Frameworks: PCI-DSS, ISO 27001, SOC 2, NIST 800-53, HIPAA, GDPR/PDPA
- Audit Trail: Immutable Logs (WORM, Blockchain-anchored), Tamper-evident
Design Principles สำคัญ (Key Design Principles)
- Zero Trust Architecture: Never Trust, Always Verify — Identity-based, Micro-segmentation, Continuous Verification
- Assume Breach: Design สำหรับ Containment, Detection, Recovery — ไม่ใช่แค่ Prevention
- Automation & API-first: Infrastructure as Code (Terraform/Ansible), GitOps, Policy as Code (OPA/Rego)
- Cryptographic Agility: TLS 1.3, IPsec/IKEv2, MACsec, Post-Quantum Ready (Kyber, Dilithium)
- Resiliency: Active-Active, Graceful Degradation, Chaos Engineering
สรุป Checklist สำหรับ Data Center Network Security Design
- [ ] Physical Perimeter & Access Control (Biometric, Mantrap, CCTV)
- [ ] Network Segmentation (Mgmt, Prod, Storage, Backup, DCI) — VLAN/VXLAN/VRF
- [ ] Border Firewall + DDoS Protection (Hybrid Cloud Scrubbing)
- [ ] East-West Micro-segmentation (Distributed FW / Service Mesh)
- [ ] Encryption In-Transit (TLS 1.3, IPsec, MACsec) + At-Rest
- [ ] Device Hardening (CIS/STIG) + Secure Boot + AAA (TACACS+/RADIUS)
- [ ] NDR + SIEM/SOAR + Threat Intel
- [ ] DNS Security, WAF, API Protection
- [ ] OOB Management Network (Isolated)
- [ ] Compliance Mapping & Audit Ready
- [ ] DR/BCP Tested (Network Failover, Data Replication)
