Secure Network Zones

Abstract

Large networks, which are often distributed over physically separate locations, require a coherent security approach. This paper introduces the concept of secure network zones, arranged in "onion-like" layers, providing increasing security levels towards the inner, more secure zones. Increased security is provided by both protective layers around sensitive networks and additional (cumulative) security measures, ranging from basic measures such as hardening and firewalls to more sophisticated techniques such as intrusion detection and encryption of transmitted and stored data. The implementation of secure network zones is described, including classification of data, assignment of applications to zones, and data flow. A path for the migration of existing environments is discussed and recommendations for special use cases are provided.