Changing subnet mask?
-
@irj said in Changing subnet mask?:
How do you move to zero trust model without network segmentation?
Using a VLAN does not have anything to do with zero trust. Actually, using a VLAN implies you are still using a LAN trust model for the things within the VLAN.
-
@travisdh1 said in Changing subnet mask?:
You're conflating VLANs with security.
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
-
@stacksofplates Yup...
-
@jaredbusch said in Changing subnet mask?:
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
Just checking is that sarcasm or the truth
-
@hobbit666 said in Changing subnet mask?:
@jaredbusch said in Changing subnet mask?:
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
Just checking is that sarcasm or the truth
Truth.
-
@jaredbusch said in Changing subnet mask?:
@irj said in Changing subnet mask?:
How do you move to zero trust model without network segmentation?
Using a VLAN does not have anything to do with zero trust. Actually, using a VLAN implies you are still using a LAN trust model for the things within the VLAN.
Yeah, ideally each application would be separated. In enterprise, it's done on each tier within the application. Also you would just want to whitelist specific traffic needed and allow nothing else.
I didn't recommend zero trust in my first response due to amount of effort. I did recommend not having a flat network and using simple VLANs and firewall. At a minimum separate your servers and block access there.
-
@irj said in Changing subnet mask?:
@jaredbusch said in Changing subnet mask?:
@irj said in Changing subnet mask?:
How do you move to zero trust model without network segmentation?
Using a VLAN does not have anything to do with zero trust. Actually, using a VLAN implies you are still using a LAN trust model for the things within the VLAN.
Yeah, ideally each application would be separated. In enterprise, it's done on each tier within the application. Also you would just want to whitelist specific traffic needed and allow nothing else.
I didn't recommend zero trust in my first response due to amount of effort. I did recommend not having a flat network and using simple VLANs and firewall. At a minimum separate your servers and block access there.
Well, you did forget to mention the firewall, but meh...
Then comes the question - does he have the gear needed to do that?
-
@jaredbusch said in Changing subnet mask?:
Anything in the larger subnet can talk to the smaller subnet.
The smaller subnet cannot talk to the larger subnet beyond its boundary.Thanks @JaredBusch that ^^^ was all the info I was after. I really appreciate everyones help.
-
@dashrender said in Changing subnet mask?:
Then comes the question - does he have the gear needed to do that?
the answer is no, the answer to whether I have the desire or need is also no.
Thanks everyone for the help it is greatly appreciated.
-
@siringo said in Changing subnet mask?:
@dashrender said in Changing subnet mask?:
Then comes the question - does he have the gear needed to do that?
the answer is no, the answer to whether I have the desire or need is also no.
That's a very sad answer IMO
-
@jaredbusch said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
You're conflating VLANs with security.
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
I know this, and statements like he made give me headaches after having to explain to other people that VLAN does nothing for security if you don't have firewall/access rules as well.
The types of places @IRJ has worked at, I agree that it would be insane to have a flat network.
-
@travisdh1 said in Changing subnet mask?:
@jaredbusch said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
You're conflating VLANs with security.
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
I know this, and statements like he made give me headaches after having to explain to other people that VLAN does nothing for security if you don't have firewall/access rules as well.
The types of places @IRJ has worked at, I agree that it would be insane to have a flat network.
This is my thoughts - most small businesses don't need/want more complexity than a flat network.
-
@dashrender said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
@jaredbusch said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
You're conflating VLANs with security.
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
I know this, and statements like he made give me headaches after having to explain to other people that VLAN does nothing for security if you don't have firewall/access rules as well.
The types of places @IRJ has worked at, I agree that it would be insane to have a flat network.
This is my thoughts - most small businesses don't need/want more complexity than a flat network.
Most small businesses don't want to deal with ransomware. What they want is immaterial. They should be doing what they need.
-
@stacksofplates said in Changing subnet mask?:
@dashrender said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
@jaredbusch said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
You're conflating VLANs with security.
You need to realize who you are talking to.
@IRJ is probably the most skilled security person on the community.
I know this, and statements like he made give me headaches after having to explain to other people that VLAN does nothing for security if you don't have firewall/access rules as well.
The types of places @IRJ has worked at, I agree that it would be insane to have a flat network.
This is my thoughts - most small businesses don't need/want more complexity than a flat network.
Most small businesses don't want to deal with ransomware. What they want is immaterial. They should be doing what they need.
Yep, and most small businesses shouldn't be running their own server in the first place, and most of our clients are actually moving to all hosted services. So no need to segment the network.
-
@travisdh1 I wouldn't host with Microsoft's Azure due to their costs, well accept for 365 for small businesses.
But there are many other server hosting places that are reliable including amazon, digital ocean and vultr for VM's and OVH, Hestner for dedicated. hell you can even colo in the uk for about £50-60 per 1u. I've seen a 5u rack for about £100 the other day. -
@stuartjordan said in Changing subnet mask?:
@travisdh1 I wouldn't host with Microsoft's Azure due to their costs, well accept for 365 for small businesses.
But there are many other server hosting places that are reliable including amazon, digital ocean and vultr for VM's and OVH, Hestner for dedicated. hell you can even colo in the uk for about £50-60 per 1u. I've seen a 5u rack for about £100 the other day.Azure should not be serving workloads that go in a VM on Vultr. Azure is a cloud not a VPS. Host the workload correctly and the cost is actually not that different than others.
-
@jaredbusch I know it's cloud, but you still really creating VM's or containers in most cases just that you can upscale and downscale easier due to how you can change the resources and how the cloud is managed. I just see it as an expensive solution for most workloads.
-
@stuartjordan said in Changing subnet mask?:
@travisdh1 I wouldn't host with Microsoft's Azure due to their costs, well accept for 365 for small businesses.
But there are many other server hosting places that are reliable including amazon, digital ocean and vultr for VM's and OVH, Hestner for dedicated. hell you can even colo in the uk for about £50-60 per 1u. I've seen a 5u rack for about £100 the other day.I wouldn't either. They all use Office 365 and get everything they need via services offered with Office 365 already. No need to pay more for a VM to do anything.
Now, if it was me doing the selling/planning I'd be using Zoho Office rather than Office 365, but I have no say in that stuff.
-
@travisdh1 said in Changing subnet mask?:
@stuartjordan said in Changing subnet mask?:
@travisdh1 I wouldn't host with Microsoft's Azure due to their costs, well accept for 365 for small businesses.
But there are many other server hosting places that are reliable including amazon, digital ocean and vultr for VM's and OVH, Hestner for dedicated. hell you can even colo in the uk for about £50-60 per 1u. I've seen a 5u rack for about £100 the other day.I wouldn't either. They all use Office 365 and get everything they need via services offered with Office 365 already. No need to pay more for a VM to do anything.
Now, if it was me doing the selling/planning I'd be using Zoho Office rather than Office 365, but I have no say in that stuff.
I've heard good things about people using Zoho, I did give there free account a try a few years ago. They seem to incorporate a lot into their product, it's not just email is it.
-
@stuartjordan said in Changing subnet mask?:
@travisdh1 said in Changing subnet mask?:
@stuartjordan said in Changing subnet mask?:
@travisdh1 I wouldn't host with Microsoft's Azure due to their costs, well accept for 365 for small businesses.
But there are many other server hosting places that are reliable including amazon, digital ocean and vultr for VM's and OVH, Hestner for dedicated. hell you can even colo in the uk for about £50-60 per 1u. I've seen a 5u rack for about £100 the other day.I wouldn't either. They all use Office 365 and get everything they need via services offered with Office 365 already. No need to pay more for a VM to do anything.
Now, if it was me doing the selling/planning I'd be using Zoho Office rather than Office 365, but I have no say in that stuff.
I've heard good things about people using Zoho, I did give there free account a try a few years ago. They seem to incorporate a lot into their product, it's not just email is it.
No, SO much more than just email.
