Network Security ประกอบด้วยมาตรการ/เทคโนโลยีหลักดังนี้
1. Access Control (การควบคุมการเข้าถึง)
- Network Access Control (NAC / 802.1X): ยืนยันตัวตนและสภาพอุปกรณ์ก่อนให้เข้าถึงเครือข่าย
- Zero Trust Network Access (ZTNA): Never Trust, Always Verify ต่อทุก Request
- VPN / SDP (Software Defined Perimeter): Secure Remote Access
- Privileged Access Management (PAM): ควบคุมสิทธิ์ Admin/Root
2. Perimeter & Network Edge Security (ขอบเครือข่าย)
- Next-Generation Firewall (NGFW): L3-L7 Inspection, IPS, App Control, User/Group Awareness, SSL Inspection, Threat Intel
- DDoS Protection / Scrubbing: Volumetric, Protocol, Application Layer Mitigation
- DNS Security: DNSSEC, DNS Filtering (RPZ), DoH/DoT, Protective DNS
- Secure Web Gateway (SWG) / Proxy: URL Filtering, Malware Scanning, DLP, SSL Inspection
- Email Security Gateway: Anti-Spam, Anti-Phishing, Sandbox, DMARC/DKIM/SPF, BEC Protection
3. Network Infrastructure Security (แก่นเครือข่าย)
- Segmentation / Micro-segmentation: VLAN, VRF, VXLAN, Internal Firewalls, Host-based Firewall, SDN Security (ACI, NSX, Calico, Cilium)
- Routing Security: RPKI, BGPsec, Prefix Filtering, uRPF, RTBH
- Management Plane Hardening: SSHv2, HTTPS, SNMPv3, TACACS+/RADIUS, CoPP/CPPr, NTP Auth
- First Hop Security: DHCP Snooping, DAI, IP Source Guard, RA Guard, ND Inspection
- Wireless Security: WPA2/3-Enterprise (802.1X), NAC, WIPS/WIDS, Rogue AP Detection
4. Threat Detection & Monitoring (การตรวจจับและเฝ้าระวัง)
- NIDS/NIPS (Network IDS/IPS): Signature (Snort/Suricata), Anomaly, Protocol Analysis (Zeek/Bro)
- NDR (Network Detection & Response): Behavioral Analytics, ML, Encrypted Traffic Analysis (ETA)
- SIEM (Security Information and Event Management): Log Collection, Correlation, Alerting, Dashboards, Threat Hunting
- SOAR (Security Orchestration, Automation and Response): Playbooks, Case Management, Auto-remediation
- Threat Intelligence Platform (TIP): IOC Feeds, Enrichment, Sharing (STIX/TAXII)
- Deception Technology: Honeypots, Honeytokens, Decoys, Breadcrumbs
5. Data & Application Protection (ข้อมูลและแอปพลิเคชัน)
- Encryption in Transit: TLS 1.2/1.3 (mTLS), IPsec, MACsec (802.1AE), WireGuard, QUIC
- WAF (Web Application Firewall): OWASP Top 10 Protection, API Security, Bot Management
- API Security Gateway: Schema Validation, Rate Limiting, OAuth/OIDC/JWT Validation
- DLP (Data Loss Prevention): Network DLP, Endpoint DLP, Cloud DLP (Regex, Dictionary, ML, Fingerprinting)
- Database Firewall / Activity Monitoring: SQL Injection Prevention, Privileged User Monitoring
6. Cloud & Modern Architecture Security
- Cloud Network Security: Security Groups, NACLs, Cloud Firewall (AWS Network Firewall, Azure Firewall, GCP Cloud Armor), VPC Flow Logs
- SASE / SSE (Secure Access Service Edge / Security Service Edge): Converged SWG, CASB, ZTNA, FWaaS, DLP, RBI (Remote Browser Isolation)
- Container/Kubernetes Network Security: Network Policies, Service Mesh (Istio, Linkerd, Cilium), CNI Security, Admission Control
- Serverless/Function Security: IAM Least Privilege, VPC Config, Runtime Protection
7. Endpoint & Identity (Extended Perimeter)
- EDR/XDR (Endpoint/Extended Detection & Response): Behavioral Detection, Automated Response, Threat Hunting
- Identity Protection / IdP Security: MFA, Conditional Access, Identity Governance (IGA), PAM
- Unified Endpoint Management (UEM/MDM): Compliance, Config, Wipe, Cert Deployment
Framework การจัดกลุ่มมาตรฐาน (Common Frameworks)
- NIST CSF: Identify, Protect, Detect, Respond, Recover
- CIS Controls v8: 18 Critical Controls (IG1/IG2/IG3) - Network รวมอยู่ในหลาย Controls
- MITRE ATT&CK: Tactics/Techniques Mapping to Network Defenses
- Zero Trust Architecture (NIST SP 800-207): Never Trust, Always Verify, Assume Breach
สรุป
Network Security ไม่ใช่เครื่องมือชิ้นเดียว แตเป็น กลยุทธ์แบบหลายชั้น (Defense in Depth) ครอบคลุม: Perimeter → Core → Detection → Data/App → Cloud/Modern → Endpoint/Identity การเลือกและผสานรวมต้องขึ้นกับ Risk Appetite, Business Context, Regulatory Requirements, และ Threat Landscape ขององค์กร
