กิจกรรมที่จำเป็นสำหรับ Network Security (Required Activities)
Network Security ไม่ใช่ผลิตภัณฑ์เดียว แตเป็น กระบวนการต่อเนื่อง (Continuous Process) ประกอบด้วย People, Process, Technology ตาม Framework (NIST CSF, ISO 27001, CIS Controls v8)
🎯 5 ข้อกำหนดหลัก (5 Essential Requirements)
- Identify (ระบุ): Asset Inventory (Hardware, Software, Data, People), Network Topology, Data Flows, Risk Assessment, Threat Modeling
- Protect (ปกป้อง): Network Segmentation, Firewall/IDS/IPS, NAC/Zero Trust, Encryption (TLS/IPsec), Hardening (CIS Benchmarks), Patch Management, MFA
- Detect (ตรวจจับ): SIEM/Log Aggregation, NDR (Network Detection & Response), Threat Intelligence, Vulnerability Scanning, Baseline/Anomaly Detection
- Respond (ตอบสนอง): Incident Response Plan, Playbooks (DDoS, Ransomware, Lateral Movement, Data Exfil), Containment/Eradication/Recovery, Communication, Forensics Readiness
- Recover (กู้คืน): Backup/Restore (3-2-1), Disaster Recovery, Business Continuity, Post-Incident Review, Lessons Learned, Improvement
🛡️ 5 Elements of Security (CIA + AN)
| Element | ความหมาย | Network Controls |
|---|---|---|
| Confidentiality | ข้อมูลลับไม่รั่วไหล | Encryption (TLS 1.3, IPsec, MACsec), Segmentation, DLP, Access Control |
| Integrity | ข้อมูลไม่ถูกแก้ไขโดยไม่ได้รับอนุญาต | Hashing, Digital Signature, Code Signing, FIM (File Integrity Monitoring), Secure Boot |
| Availability | ระบบพร้อมใช้งานเมื่อต้องการ | HA/Clustering, Load Balancing, DDoS Protection, Redundancy, Backup, DR |
| Authenticity | ยืนยันตัวตนแหล่งที่มา/ปลายทาง | PKI, Mutual TLS, 802.1X, FIDO2, Certificate Pinning, RPKI |
| Non-repudiation | ไม่สามารถปฏิเสธการกระทำได้ | Audit Logs (Immutable), Digital Signature, Non-repudiation Service, Blockchain/Trusted Timestamp |
🔧 Technical Controls ที่ต้องมี (Must-Have)
- Firewall: Next-Gen (App-ID, User-ID, SSL Decryption, Threat Prevention)
- Segmentation: VLAN, VRF, Micro-segmentation (Cisco ACI, VMware NSX, Illumio, Guardicore)
- NAC: 802.1X (Wired/Wireless), MAB, Posture Assessment, Guest/Quarantine VLAN
- VPN/ZTNA: IPsec, SSL VPN, WireGuard, ZTNA (Zscaler, Cloudflare Access, Twingate)
- Monitoring: SIEM (Splunk, Sentinel, Elastic), NDR (Corelight, Zeek, Darktrace), Flow Analysis (NetFlow/IPFIX)
- Vuln Management: Continuous Scanning (Nessus, Nuclei, Qualys), Prioritization (CVSS+EPSS+Exploitability), Patch Automation
- DDoS Protection: On-prem (Arbor, Radware) + Cloud (Cloudflare, AWS Shield, Azure DDoS)
- DNS Security: DNSSEC, DoH/DoT, RPZ, Protective DNS (Cisco Umbrella, Quad9, Cloudflare 1.1.1.1 for Families)
📋 5 Practices สำหรับ Enterprise Networks (CIS Controls v8 Mapping)
- Establish Firewalls as First Line of Defense (CIS 4.1, 4.2, 4.3, 4.4, 4.5) - Default Deny, Rule Review, Segmentation, Logging
- Secure Network Devices (CIS 4.6, 4.7, 4.8) - Hardening (CIS Benchmarks), Change Management, AAA (TACACS+/RADIUS), Encrypted Management (SSHv2, HTTPS, SNMPv3)
- Implement Wireless Security (CIS 4.9, 4.10) - WPA3/WPA2-Enterprise (EAP-TLS), Disable WPS, Guest Isolation, Rogue AP Detection
- Secure Email & Web (CIS 9, 10) - Email Gateway (Anti-spam, Anti-phishing, Sandbox), Web Proxy/Filter (TLS Inspection, DLP)
- Deploy Network Monitoring & Detection (CIS 8, 12, 13) - SIEM, NDR, IDS/IPS, Threat Intel, Flow Analysis, DNS Monitoring
⚠️ Common Mistakes
- Flat Network (No Segmentation) → Lateral Movement ง่าย
- Firewall Rules: Any-Any-Allow, Shadowed Rules, No Expiration, No Documentation
- Management Plane Exposed to Internet (SSH, HTTPS, SNMP, RDP)
- No Encryption for Management Traffic (Telnet, HTTP, SNMPv1/2c, HTTP API)
- Log Everything but Alert Nothing (No Correlation, No Tuning)
- Vendor Default Credentials on Network Devices
- No Network DR/Backup Config Test
📈 Maturity Model (CMMI-style)
| Level | Characteristics |
|---|---|
| 0 - Non-existent | No Network Security Controls |
| 1 - Initial/Ad-hoc | Firewall แต่อยู่คนเดียว, ไม่มี Policy, Reactive |
| 2 - Managed | Policy มี, Segmentation Basic, Vuln Scan ต่อเนื่อง, SIEM Basic |
| 3 - Defined | Standardized Process, Zero Trust Pilot, Automation (IaC), Threat Hunting, Metrics |
| 4 - Quantitatively Managed | KPI/KRI Driven, Predictive Analytics, Continuous Red Team, Auto-Remediation |
| 5 - Optimizing | AI/ML Driven, Self-Healing Network, Continuous Verification, Supply Chain Integrity |
สรุป
กิจกรรม Network Security ที่จำเป็น = Identify, Protect, Detect, Respond, Recover (NIST CSF) 5 Elements: CIA+AN Controls: Firewall, Segmentation, NAC, VPN/ZTNA, Monitoring, Vuln Mgmt, DDoS, DNS Security 5 Practices: Firewall First, Device Hardening, Wireless Sec, Email/Web Sec, Monitoring หลีกเลี่ยง Flat Network, Any-Any Rules, Exposed Management, Unencrypted Mgmt, Log Without Alert วัด Maturity Level 0-5
