Peter A Clarke

The US National Institute of Standards and Technology (the “NIST”) has released a guide to a secure Enterprise Network Landscape.

The Guide to a Secure Enterprise Network Landscape is designed to provide guidance for navigating the current enterprise network landscape. It examines the security limitations of current network access solutions and point security solutions through traditional appliances with enhanced security features. It also considers new appliances, emerging network configurations, frameworks that incorporate the configurations, and cloud-based wide area network (WAN) services with integrated security infrastructures. The guide considers the following security impacts:

• disappearance of the concept of a perimeter associated with the enterprise network;
• an increase in attack surface due to the sheer multiplicity of IT resource components; and
• sophistication of the attackers in their ability to escalate attacks across several network boundaries leveraging the connectivity features.

Specific areas addressed in the Guide include:

• Feature enhancements to traditional network security appliances
• Secure enterprise networking configurations fs
• Security frameworks that integrate individual network configurations
• Evolving wide area network (WAN) infrastructure that provides a comprehensive set of security services

The abstract provides:

Access to multiple cloud services, the geographic spread of enterprise IT resources (including multiple data centers), and the emergence of microservices-based applications (as opposed to monolithic ones) have significantly altered the enterprise network landscape. This document is meant to provide guidance to this new enterprise network landscape from a secure operations perspective. Hence, it starts by examining the security limitations of the current network access solutions to the enterprise network. It then considers security feature enhancements to traditional network appliances in the form of point security solutions, network configurations for various security functions (e.g., application security, cloud access security, device or endpoint security, etc.), security frameworks that integrate these individual network configurations, and the evolving wide area network (WAN) infrastructure to provide a comprehensive set of security services for the modern enterprise network landscape.

The Guide identifies limitations and security risks associated with using VPNs including:

• An increasing trend involves the movement of corporate resources to the cloud and the use of mobile The VPN connections that remote users establish terminate at the  VPN concentrators located at the edge of the corporate network.
• the mobile devices used by many employees can connect directly to software-as-a-service (SaaS) applications and data in the cloud.  Mobile devices are especially prone to phishing attacks that steal credentials or deliver malware.
•  some VPNs have vulnerabilities such as “session hijacking,” where malicious actors access a valid session ID through brute-force attacks and the leveraging web browser development tools to manually set a value to an ID and using that to obtain unauthenticated access to the VPN administrator and then remotely connect to internal systems, harvest passwords, move laterally in the network, and deploy ransomware.