Segmentation and zero trust architecture
You plan how to split a flat corporate network, make lateral movement harder with micro-segmentation and zero trust principles, and run the migration without downtime.
Level 501 · 12 lessons · 12 practice labs
Lessons
Design
- The risk of a flat network: how lateral movement spreads
- Mapping flows: who talks to whom
- Segment design: crown jewels, users, servers, OT
- Short task: derive a segment proposal from a week of flow data
Implementation
- Filtering between VLANs and the management network
- Micro-segmentation on the host
- Zero trust principles: verifying every request
- Identity-aware access: reverse proxy and mTLS
- Short task: allow access to an internal service only with a client certificate
Migration
- Migration without downtime: monitor mode, staged rules, rollback
- Testing segmentation: trying the paths that should be blocked
- Capstone: split a flat network into four segments and prove lateral movement is blocked
Practice labs
- Derive a segment proposal from a week of flow data: Group flows by role, propose four segments and write the minimum required permissions between them as a table.
- Map lateral movement paths on a flat network: Map the paths from a compromised workstation to critical servers and find the single rule that cuts the most paths.
- Find the hidden link between the OT and office networks: Find the machine bridging the two networks in the flow data and assess the impact of cutting it.
- Allow a database server only from the app server: Use the host firewall to restrict the database port to one source and test other sources.
- Narrow an overly open rule in an inter-VLAN ACL: Reduce a rule opening every port from the user VLAN to the server VLAN to the needed services and test it.
- Try rules in monitor mode first, then enforce: Watch new segment rules with counters, find unexpected flows, fix the rules and enforce with no outage.
- Allow access to an internal service only with a client certificate: Require mTLS on the reverse proxy and show a request without a certificate is refused.
- Notice a revoked certificate still works and fix it: Show the reverse proxy does not check the CRL, enable the check and prove the revoked certificate is refused.
- Write an identity-based access rule and test the lateral path: Write an access policy using group information from a header and prove an unauthorised role cannot reach the service.
- Test one by one the paths that should be blocked: Try every path on the post-segmentation test list, find the one still open and fix the rule.
- Place assets into segments by trust level: Sort a list of twenty assets into user, server, management and guest segments and give a one-word reason for each placement.
- Measure which ports are open between two segments: Scan from the user segment to the server segment inside your own lab and compare the result with what the access matrix expects.
About this course
You plan how to split a flat corporate network, make lateral movement harder with micro-segmentation and zero trust principles, and run the migration without downtime.
What you will learn
- Design
- Implementation
- Migration
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.