Intro

In this first video in the communication and network security playlist, I explore safeguards needed to secure an organization's network with domain separation, including MAC address resolution, collision domains, broadcast domains, and network segmentation with VLANs. You can download the script from this video from above or at the end of the video. Before jumping in, let's review principles from the CISSP Domain 3 video, Security Architecture Design Principles. You can watch the video by clicking on the link above or from the list of included video links. The two most common principles are domain separation and layering. I address layering in later videos in my CISSP Domain 4 playlist.

Intro to Domain Separation

Domain separation is done at two levels: minimizing collision domains and network segmentation traffic control, which also addresses broadcast domains. Let's look at how collision works in an Ethernet network.

Collision Domains

When devices are connected to a network via a hub, they are all essentially on the same network segment or collision domain. When the laptop wants to communicate with the application server, it must first check to see if it must wait for other traffic. If the network appears clear, the laptop places the packet for the server on the network. Sometimes, the packet collides with other traffic sent from one or more devices also connected to the network. When this happens, the laptop waits a short period, and then it sends the packet again. In a collision domain, all devices can SEE all traffic on the network. That doesn't mean that they READ all packets. They look for packets with their MAC address, and they read those only unless the system is set up in promiscuous mode, which is not usually the case. This network is also a broadcast domain. All devices in the network READ all broadcast packets placed on the network. Collision domains are less expensive to implement because they don't use switches to control traffic. This also makes them easier to manage because hubs usually require no configuration. However, every device can see all the traffic on the network. This means that a compromised system can see and collect all packet data. Finally, packet collisions can cause performance issues as the size of the network increases.

MAC Address Resolution & ARP

Before we go further, it's important that you understand mac address resolution. MACaddress resolution is accomplished with the address resolution protocol also known as ARP. A MAC address is the hardware address of a device. We can't directly communicate with the device unless we know its MAC address. This requires the resolution of the target device's IP address to its MAC address. In our example, address resolution begins when the laptop broadcasts an ARP packet with the target system's IP address in a broadcast. Each device looks at the packet, and each looks to see if its MAC address is requested. If the ARP packet's target IP address is the same as the device's IP address, it responds to the laptop with its MAC address. Once the laptop receives the MAC address, it adds it to its ARP cache and initiates a session with the target. Now we can move to switches and the minimization or elimination of collision domains.

Layer 2 Switch Segments and Collision/Broadcast Domains Minimization

This is an example OSI layer 2 switch-centric network with a very common configuration. Each device is connected to its own switch port. Switches work differently than hubs. Switches only send traffic out a port where the target MAC address resides. So if the laptop sends a packet to the email server using the server's MAC address, the switch looks at the MAC address, and then sends the packet out the port to which the server is connected. Neither the file server nor the desktop will see the packet. This process requires the switch to build tables to know where devices reside. To see how this happens, download the document above or at the end of the video. All devices on the same switch port are members of the same collision domain. In this example, there is only a single device in each collision domain, but this is not always the case. The number of devices in a collision domain depends upon how the network is segmented and how many devices are on a segment. Switches pass broadcasts to all devices. Consequently, this network is still one big broadcast domain.

VLAN Segmentation

In addition to reducing collision domain size, segmentation is also used as a security control. This example shows a common segmentation approach using VLANs or virtual local area networks. A layer 3 switch includes routing capabilities as well as layer 2 switch functionality. The routing capability is needed to allow VLANs to communicate with each other. When allowed, VLANs are configured by assigning one or more ports on the layer 3 switch to a VLAN number. In our example, we have four ports configured as VLANs. Layer 2 switches physically connect multiple devices to each VLAN port. VLAN access control lists or VACLs configured in the layer 3 switch control traffic access. For example, if an office user tries to directly access a database server, the VACL for VLAN 40 will block the traffic. However, access is allowed to VLAN 30. access across VLANs is enabled with routing rules and access control lists configured in the layer 3 switch. Broadcast traffic is limited to the VLAN on which the broadcast was initiated, and devices on the same VLAN can be prohibited from speaking with each other. This device isolation is often part of a zero-trust network design. Consequently, a broadcast domain is limited to the size of the VLAN. Limiting broadcasts helps keep compromised systems from finding targets that are not part of the same VLAN. For a detailed look of how VLANs work and how to manage them, download the article above or at the end of the video. Well, that's it for this lesson. if you have questions, please ask. ...and until next time be careful once you click