How do you build a network that limits attacks?
High-security IT networks.
How to build networks that limit attacks, withstand failures and are demonstrably protected.
In 60 seconds
- Zones instead of a flat network: each zone only gets the connections it needs.
- Zero Trust, a separate management network and redundancy are the core building blocks.
- Standards such as BSI IT-Grundschutz and ISO 27001 make security auditable.
What high security means.#
There is no seal of quality. It is a standard that follows from the need for protection.
Segmentation instead of a flat network
If everything is in one network, an attacker can reach everything. Zones stop them.
Zero Trust
No device and no user is automatically trusted. Every access is checked.
Redundancy
2 paths, duplicate devices, tested failover: an outage remains a disruption.
Demonstrable
Following standards such as BSI IT-Grundschutz and ISO 27001 makes security auditable.
8 principles.#
Click a principle to read more.
Defense in Depth
Several independent layers of protection instead of one strong wall. If one fails, the next one holds.
Least Privilege
Every device and every user only gets the connections and permissions they need, no more.
Segmentation and microsegmentation
The network is divided into zones, with a firewall enforcing rules between them. Microsegmentation goes down to individual servers or applications.
Hardening
Turn off unnecessary services and functions, secure defaults, current firmware and regular checks against requirements.
Encryption
Protect data in transit, for example with TLS, IPsec or MACsec, and encrypt stored data.
Separate management
Administration runs over a separate network with strong authentication, not over the normal office network.
Redundancy
Design critical components and lines redundantly and test failover regularly.
Visibility
Logs and network data are brought together so that anomalies are detected quickly. More under Monitoring.
Try out Zero Trust.#
It is not the location that decides, but identity, device and need. Every time access is requested.
Simplified example of a policy. Every company sets its own real rules.
The zone model.#
5 zones, strictly separated, with rules at every transition.
Publicly accessible services are often placed in an additional buffer zone (DMZ) between the internet and the internal network.
Key building blocks.#
| Building block | Task | Note |
|---|---|---|
| Next-generation firewall | Inspect and filter traffic between zones | Rules by purpose, not by convenience |
| VLAN / VRF | Logical separation of networks on shared hardware | The basis of any segmentation |
| NAC and 802.1X | Authenticate devices and users before they are allowed onto the network | Prevents unknown devices at the network socket |
| VPN and ZTNA | Secure access from outside | ZTNA grants access per application instead of to the whole network |
| IDS/IPS and NDR | Detect attacks in network traffic | Also useful for devices without agents |
| Encryption (TLS, IPsec, MACsec) | Protect data in transit | MACsec encrypts at the level of the link between devices |
| Management network | Administration separated from the production network | Access only with MFA and from defined systems |
| Redundant paths and HA pairs | Absorb failures without interruption | Test failover regularly |
VLANs: who can reach whom?#
Choose a hacked device and see how far an attacker gets.
Example: VLAN 10 for work (laptop, printer, NAS), VLAN 20 for IoT (camera, smart TV), VLAN 30 for guests. The firewall only allows connections from work to IoT, not the other way round. Guests only get internet access.
Firewalls compared.#
Four types, four tasks. In practice they work together.
| Type | What is inspected | Protects well against | Limits | Typical use |
|---|---|---|---|---|
| Packet filter | Sender, destination, port and protocol of each individual packet | Obviously unwanted connections | Knows no relationship between packets, sees no content | Simple rules on routers and switches |
| Stateful Inspection | Additionally the state of each connection | Responses that were never requested | Does not see which application or content is running | Standard in every home and business firewall |
| Next Generation Firewall | Applications, users, content, often with intrusion prevention (IPS) | Malware, prohibited applications, known attacks | Encrypted traffic only visible with decryption, needs maintenance | Internet edge and zones within the company |
| Web Application Firewall | Requests to a web application (HTTP) | SQL injection, cross-site scripting, bot attacks | Only protects the web application, not the network | In front of web shops, portals and APIs |
Security is operation.#
A good design only holds if it is maintained.
Manage configuration
Changes traceable, approved and backed up.
Clean up rules
Review firewall rules regularly and remove legacy entries.
Patch
Update firmware and operating systems promptly.
Test
Penetration tests and failover tests show what really holds.
Document
Current network diagrams and zone overviews are worth their weight in gold in an emergency.
Check: network.#
6 questions about your network.
Rough guidance, no audit and no legal advice. Your selection stays in your browser.
Frequently asked questions.#
When is microsegmentation worthwhile?
For critical applications and data centres, where lateral movement in the network is particularly dangerous. For smaller environments, clean zone separation is often enough.
Is a VPN sufficient?
A classic VPN gives access to the network. Zero Trust access also checks each application and device. The two can be combined.
How secure is Wi-Fi?
Good with WPA3 and sign-in by certificate or user account (802.1X). Shared passwords for everyone are the weaker solution.
What should I use as a guide?
The BSI IT-Grundschutz or ISO 27001. Both provide a framework that can be tailored to your own protection needs.
Discuss network design?
Tell me where you are stuck, and we will add to the content.