A enterprise security architecture team is revising its infrastructure segmentation strategy to address specific threat models across varied operational zones. Match each network design architectural technique to the security requirement it fulfills.
- Out-of-band (OOB) management network with a bastion hostIsolating administrative access to core switches and routers completely from standard employee workstations and general LAN traffic.
- Software-defined microsegmentationEnforcing granular access controls to restrict lateral (East-West) traffic between workload instances residing within the same virtual subnet.
- Screened subnet (DMZ) with multi-homed firewallsTerminating untrusted Internet traffic on public services while preventing direct inbound connections to backend enterprise database networks.
- Physical air-gappingPreventing any network-based communication or remote intrusion vectors into high-consequence legacy SCADA control systems.
Answer
Out-of-band management with a bastion host pairs with administrative switch isolation; Software-defined microsegmentation pairs with restricting East-West lateral workload traffic; Screened subnets with multi-homed firewalls pair with terminating untrusted Internet traffic away from internal databases; Physical air-gapping pairs with preventing remote intrusion into sensitive SCADA systems.
Each architectural pattern matches its specific security objective: Out-of-band management secures network infrastructure access; Microsegmentation halts intra-subnet lateral movement; DMZs secure public endpoints while safeguarding backend assets; Air gaps eliminate remote connectivity risks for critical isolated systems.
Step-by-Step Solution
Key Concept
Secure Network Design and Segmentation Archetypes