Network Security ประกอบด้วยอะไร (Framework แบบครบวงจร)
Network Security ไม่ใช่เครื่องมือเดียว แต่เป็น Strategy + Architecture + Controls หลายชั้น (Defense in Depth) ครอบคลุม: Prevention, Detection, Response, Recovery
หมวดหมู่หลักของ Network Security Controls
1. Network Access Control (NAC) & Identity
- 802.1X / EAP-TLS/PEAP: Port-based Authentication
- MAB (MAC Authentication Bypass): สำหรับ IoT/Printer ที่ไม่รองรับ 802.1X
- Posture Assessment: Health Check (OS Patch, AV, Encryption) ก่อนให้เข้าถึง
- Guest/BYOD Onboarding: Captive Portal, Sponsor Approval, Limited VLAN
- Zero Trust Network Access (ZTNA): Identity-based, Micro-segmentation, Continuous Verification
2. Perimeter & Edge Security (North-South Traffic)
- Next-Gen Firewall (NGFW): App-ID, User-ID, Content-ID (URL Filtering, AV, Anti-Spyware, Vulnerability Protection, File Blocking, WildFire Sandbox)
- DDoS Protection: On-prem (Arbor, Radware, FortiDDoS) + Cloud Scrubbing (Cloudflare, AWS Shield, Akamai)
- Secure Web Gateway (SWG): URL Filtering, Malware Scanning, DLP, SSL Inspection
- Email Security Gateway: Anti-Spam, Anti-Phishing, Sandbox, DMARC/DKIM/SPF, BEC Protection
- DNS Security: Protective DNS (Block C2, DGA, Malware Domains), DNS over HTTPS/TLS
3. Internal Network Security (East-West Traffic)
- Micro-segmentation / Distributed Firewall: VM/Container/Pod Level (VMware NSX, Cisco ACI, Illumio, Calico, Cilium)
- Network Detection & Response (NDR): Behavioral Analytics, ML-based Anomaly Detection, Encrypted Traffic Analysis (ETA), Threat Hunting (ExtraHop, Corelight, Darktrace, Vectra)
- Internal IDS/IPS: Suricata, Zeek, Snort, Vendor Appliance — Span/TAP Traffic
- Lateral Movement Prevention: SMB Signing, LAPS, Tiered Admin, Credential Guard, Kerberos Armoring
4. Cloud & Hybrid Network Security
- SASE (Secure Access Service Edge): Converged Network + Security (Zscaler, Netskope, Cato, Palo Alto Prisma, FortiSASE)
- SSE (Security Service Edge): SWG + CASB + ZTNA + FWaaS (No SD-WAN)
- Cloud-Native Firewall: AWS Network Firewall, Azure Firewall, GCP Cloud Armor
- Cloud Network Segmentation: VPC/VNet, Subnets, Security Groups, NACLs, Transit Gateway, Service Endpoints/Private Link
- CNAPP (Cloud-Native Application Protection Platform): CSPM, CWPP, CIEM, DSPM, IaC Scanning
5. VPN & Remote Access
- IPsec VPN (Site-to-Site, Remote Access): IKEv2, Certificate/Auth, Perfect Forward Secrecy
- SSL/TLS VPN: AnyConnect, GlobalProtect, FortiClient, Pulse Secure — Browser/Client-based
- WireGuard: Modern, Fast, Simple, Kernel-level — แทนที่ OpenVPN/IPsec ในหลาย Use Case
- ZTNA (Zero Trust Network Access): App-level Access, No Network-level Access (BeyondCorp, Zscaler ZPA, Cloudflare Access, Twingate)
6. Wireless Security
- WPA3-Enterprise (192-bit), WPA3-Personal (SAE)
- 802.1X (EAP-TLS/PEAP) + RADIUS — Enterprise Wi-Fi
- Wireless IDS/IPS (WIPS): Rogue AP Detection, Deauth Attack Prevention
- IoT/OT Wireless Segmentation: Separate SSID/VLAN, PSK per Device Group, MAB
7. Data Protection on Network
- Encryption In-Transit: TLS 1.3 (Mandatory), IPsec, MACsec (802.1AE), QUIC
- DLP (Data Loss Prevention): Network DLP, Endpoint DLP, Cloud DLP — Regex, Dictionary, ML, Fingerprinting
- Rights Management (IRM): Persistent Protection (Microsoft Purview, Seclore)
8. Security Operations & Monitoring
- SIEM (Security Information & Event Management): Splunk, Elastic, Sentinel, Chronicle, QRadar — Correlation, Alerting, Dashboards
- SOAR (Security Orchestration, Automation & Response): Playbooks, Auto-remediation, Case Management
- Threat Intelligence Platform (TIP): STIX/TAXII, MISP, Commercial Feeds — Enrichment, Auto-block
- Vulnerability Management: Continuous Scanning (Tenable, Qualys, Rapid7), Risk-based Prioritization (EPSS, KEV)
Network Security Architecture Models
| Model | Characteristics | Use Case |
|---|---|---|
| Perimeter (Castle-and-Moat) | Trusted Internal, Untrusted External, Firewall at Edge | Legacy, Small Flat Network |
| Zero Trust | Never Trust, Always Verify, Identity-centric, Micro-segmentation | Modern, Cloud, Hybrid, Remote Work |
| SASE/SSE | Cloud-delivered, Converged Network+Security, Edge PoPs | Distributed Workforce, Cloud-first |
| Cybersecurity Mesh (CSMA) | Distributed, Composable, Interoperable Security Services | Complex Multi-cloud, Decentralized |
Network Security Threats (ที่ Controls ข้างต้นป้องกัน)
- Malware/Ransomware, Phishing, DDoS, APT, Insider Threat, Supply Chain, Zero-day, Data Exfiltration, Cryptojacking, Botnet, MITM, DNS Tunneling, Credential Theft
สรุป: Network Security Types = Controls Matrix
ไม่มี "Type" เดียว — เป็น Portfolio of Controls ตาม Risk Appetite, Architecture, Compliance, Budget:
- Small Business: NGFW + Endpoint EDR + Email Security + Backup + MFA
- Enterprise: NGFW + ZTNA + Micro-segmentation + NDR + SASE + SIEM/SOAR + PAM + DLP
- Cloud-Native: CNAPP + Cloud FW + Private Link + ZTNA + CSPM
- OT/ICS: Purdue Model, OT Firewall, Unidirectional Gateway, Asset Visibility, No Active Scanning
Key Principle: Defense in Depth + Zero Trust + Automation + Continuous Monitoring
