Network Segmentation

Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.

Segregate SNMP traffic on a separate management network.^[1]

Network segmentation can be used to isolate infrastructure components that do not require broad network access.

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Employ network segmentation for sensitive domains.^[2].

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.

Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.^[3]

Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.

Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as LLMNR/NBT-NS Poisoning and SMB Relay

Ensure proper network segmentation is followed to protect critical servers and devices.

Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

Ensure proper system isolation for critical network systems through use of firewalls.

Enable firewall rules to block unnecessary traffic between network security zones within a network.

Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.