๐ Secure Bits ๐ก
๐ฆ๐๐ถ๐น๐น ๐๐๐ถ๐ป๐ด ๐ท๐๐๐ ๐๐๐ผ ๐ฉ๐๐๐ก๐ย โ one for servers, one for clients?
Thatโs not security. Thatโs a ๐ณ๐น๐ฎ๐ ๐ป๐ฒ๐๐๐ผ๐ฟ๐ธ.
Even a very basic Active Directory environment needs more segmentation than two VLANs – I see this way too often, so ๐น๐ฒ๐’๐ ๐ด๐ฒ๐ ๐ฟ๐ถ๐ฑ ๐ผ๐ณ ๐๐ต๐ถ๐.
๐๐ฒ๐ฟ๐ฒโ๐ ๐๐ต๐ฒ๐ฟ๐ฒ ๐๐ผ๐ ๐๐ต๐ผ๐๐น๐ฑ ๐๐๐ฎ๐ฟ๐:
๐น ๐๐ผ๐บ๐ฎ๐ถ๐ป ๐๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐ โ isolated in their own VLAN(s)
๐น ๐๐ฑ๐บ๐ถ๐ป ๐ช๐ผ๐ฟ๐ธ๐๐๐ฎ๐๐ถ๐ผ๐ป๐ (๐ฃ๐๐ช๐) โ separate VLANs for each tier
๐น ๐ฆ๐ฒ๐ฟ๐๐ฒ๐ฟ๐ โ grouped by security tiers and also roles (e.g., WSUS and Entra Connect need to access the internet โ separate them from other tier 0 devices)
๐น ๐๐น๐ถ๐ฒ๐ป๐๐ โ likely need multiple VLANs within Tier 2
๐ก You can go even further with ๐บ๐ถ๐ฐ๐ฟ๐ผ๐๐ฒ๐ด๐บ๐ฒ๐ป๐๐ฎ๐๐ถ๐ผ๐ปย โ controlling traffic per host or per app.
๐ง๐ต๐ถ๐ป๐ธ ๐ผ๐ณ ๐ถ๐ ๐๐ต๐ถ๐ ๐๐ฎ๐:
โก๏ธ Tiering Model protects authentication
โก๏ธ Network segmentation protects communication
They go ๐ต๐ฎ๐ป๐ฑ ๐ถ๐ป ๐ต๐ฎ๐ป๐ฑ.
Need help planning traffic rules between roles?
๐๐๐ต๐ฒ๐ฐ๐ธ ๐ผ๐๐ ๐๐ต๐ฒ ๐ณ๐ฟ๐ฒ๐ฒ ๐ด๐๐ถ๐ฑ๐ฒ:
https://academy.horizon-secured.com/p/windows-infrastructure-security-guides
๐๐ผ๐ ๐๐ฒ๐ด๐บ๐ฒ๐ป๐๐ฒ๐ฑ ๐ถ๐ ๐๐ผ๐๐ฟ ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐?
