Question
What is the basic idea of perimeter security, and what draws the system boundary?
Answer
Distinguish an inside from an outside and regulate every crossing between the two. The system boundary is a network boundary, and network addresses and protocol types are what tell actors and actions apart.
* Inside is trusted, outside is not; the firewall at the border decides by address and protocol. *
"Perimeter" means circumference or border. A perimeter fence is the fence around a site, and a security perimeter is a security zone. The term moved into cyber security, where its first use was access control via the network.
The guiding thought is "only allow secure networks": inside is assumed good, outside bad, and firewalls and similar devices act as border control at the crossing points. Who you are and what you may do is decided by where your traffic comes from (source address) and what kind of traffic it is (protocol and port). Everything else about this model, both its strength and its weaknesses, follows from that one decision.
Go deeper:
Firewall (computing) — Wikipedia — packet filters, stateful and application firewalls side by side.- NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy — how firewall classes differ and how to build a rule set.
Note saved — thanks!
Question
On which network layers is a perimeter built in practice, and what is the difference between separating on Layer 2 physically and virtually?
Answer
In principle a perimeter is possible on every OSI layer, but in practice it is almost always isolation on Layer 2 plus restriction on Layer 3. Physical L2 separation uses different switches and can only be broken physically; virtual separation (VLANs) can be broken by configuration.
* Physical separation can only be broken by a cable; a VLAN boundary is a setting that a mistake or an attacker can change. *
| Physical L2 separation | Virtual L2 separation (VLAN) | |
|---|---|---|
| How | Each broadcast domain is served by its own switches | One switch is split into virtual Layer 2 networks (supported from the lower mid-range up) |
| How the perimeter can break | Only physically: someone plugs in a cable that bridges the two | Through configuration: an accidental misconfiguration, or a successful attack on the switch's management interface |
The trade-off is the same as with isolation in general: the virtual variant is cheaper and more flexible, but the boundary is now a setting rather than a missing cable, so anyone who can change the setting can remove the boundary.
Go deeper:
- VLAN — Wikipedia — how one switch is split into separate broadcast domains.
TechKnowSurge — CCNA LANs 11-4: VLAN Hopping — how a misconfigured trunk lets traffic jump between VLANs.- NetworkLessons — VLAN Hopping — switch spoofing and double tagging, with the configuration that prevents them.
Note saved — thanks!