- [Instructor] Network segmentation is the process
of logically grouping
network assets, resources, and applications.
Segmentation provides the flexibility to implement
a variety of services, authentication requirements,
and security controls.
Working from the inside out,
network segments include the following types.
An enclave network,
which is a segment of the internal network
that requires a higher degree of protection.
Internal accessibility is further restricted
through the use of firewalls, VPNs, VLANs,
and network access control devices.
Trusted network, wired or wireless, is the internal network
that is accessible to authorized users.
External accessibility is restricted
through the use of firewalls, VPNs, and IDS/IPS devices.
Internal accessibility may be restricted
through the use of VLANs and NAC devices.
A semi-trusted network or perimeter network,
also considered a DMZ or demilitarized zone,
is a network that is designed to be internet accessible.
Posts such as web servers and email gateways
are generally located in the DMZ.
Internal and external accessibility is restricted
through the use of firewalls, VPNs, and IDS/IPS devices.
Guest networks, either wired or wireless,
are networks that are specifically designed
for use by visitors to connect to the internet.
There's no access from the guest network
to the internal trusted network.
And untrusted network is a network
outside your security controls.
The internet is considered an untrusted network.