Network Segmentation Best Practices: Shrink Your Ransomware Blast Radius

Network segmentation best practices can be the difference between ransomware taking out one laptop and ransomware taking out your whole company. Prasanna, my co-author Dr. Mike Saylor, and I talk about how to stop running a flat network, what VLANs and microsegmentation actually do, and where you should start. Mike and I wrote Learning Ransomware Response and Recovery around one basic idea: assume breach. You’re probably going to get hit, so the real question is how big the blast radius will be. Is it a plop, or does it take out the whole building? We start with the old hard, crunchy exterior and soft, chewy interior model, and why so many billion-dollar organizations still run flat networks. Spoiler: laziness, budget, and management decisions all play a part. Mike explains VLANs with a hotel key card analogy that will make sense to those who aren’t network people. Then we take it a step further into microsegmentation, where access is based on what you’re there to do instead of where you’re plugged in. Then we talk about: • Get buy-in from on high. • Inventory everything. • Tag your workloads and build policy around those tags. • Start with your crown jewels and work your way out. That means the stuff with tight RTOs and RPOs, plus the stuff you really don’t want ending up on the internet. • Roll it out in phases instead of trying to rebuild everything in a day. • Document every single rule, or the next guy will tear it all down and go flat again. We also talk about why IT shouldn’t be the one deciding what’s critical (that’s what a business impact analysis is for) and how to wall off your backup network. You’ll also hear about the night before Y2K when the security team blocked my NetBackup ports one too many times and I lost it. And Mike explains how he used network segmentation to win an argument with a teenager. If you’re a backup person who’s never had to think much about the network, this one’s for you. Chapters: 00:00 – Intro 01:26 – Welcome, Prasanna and Dr. Mike Saylor 02:41 – My first client with firewalls on the inside 04:43 – Assume breach and the blast radius 06:24 – Grenades, house locks, and panic rooms 08:41 – What a flat network looks like 09:42 – Why so many companies still run flat networks 10:18 – VLANs explained with a hotel analogy 13:22 – Going further with microsegmentation 14:51 – The management overhead problem 15:15 – Why undocumented segmentation falls apart 18:45 – Leadership buy-in and starting with inventory 20:07 – Rolling it out in phases 21:16 – Tags, policy, and allow rules 22:56 – Default deny (and Mike says “it depends”) 24:00 – Start with your crown jewels 28:18 – Why IT shouldn’t decide what’s critical 30:38 – The night I lost my mind over segmentation 33:00 – Monitor traffic and wall off your backup network 34:35 – Final thoughts, home networks, and the chicken coop 36:04 – Mike’s teenager gets her own segment