Network hardening

Network hardening limits where an attacker can move once inside and what they can reach from outside. Its core idea is segmentation: compromising one host shouldn’t grant the whole network. It’s the direct countermeasure to lateral movement (Lateral Movement) and C2 (Command & Control).

Segmentation and Zero Trust

Segmentation      split the network into zones (VLAN/subnets) with control between them
Microsegmentation  policy per workload/host, not just per subnet (east↔west)
Zero Trust        "never trust, always verify": identity+context on every access,
                  no implicit trust from being "inside" the perimeter
DMZ               intermediate zone for exposed services, isolated from the internal network

Traffic control

Firewall          default-deny; minimal, documented rules; periodic cleanup
Egress filtering  control outbound (not just inbound) -> cuts C2 and exfiltration (mal-c2)
NAC (802.1X)      authenticate devices before granting LAN access
IDS/IPS           Suricata/Snort: signatures + anomalies at the perimeter and between zones
NDR               behavioral detection on traffic (beaconing, see mal-c2)

Protocols and services

- disable insecure legacy protocols: SMBv1, Telnet, LLMNR/NBT-NS/mDNS (see ad-llmnr)
- enforce encryption: SSH instead of Telnet, LDAPS/channel binding, SMB signing
- DNS: controlled resolution, Protective DNS, blocking malicious/DGA domains
- out-of-band management and a separate admin plane (jump hosts/bastion)

Remote access

- VPN with MFA / ZTNA instead of exposing RDP/SSH directly to the Internet
- RDP: never exposed; behind a gateway + MFA; NLA enabled
- inventory of exposed services (recon, see recon) and continuous reduction

Blue Team / operation

Map legitimate flows before segmenting; explicit east-west policy, not just north-south.
Monitor with IDS/IPS + NDR and centralize network logs in the SIEM (SIEM).
Review firewall rules (dead rules, “any-any”) and admin access regularly.
Combine with IAM (Identity management (IAM)) and NAC: the network trusts verified identity, not location.

Real-world cases

NotPetya/WannaCry (2017): flat, unsegmented networks let the worm spread over SMB.
Target (2013): vendor access into a poorly segmented network reached the POS systems.
Modern ransomware abuses flat networks and exposed RDP to move and encrypt the whole org.

Testing checklist

Network segmented (VLAN/subnets) with control between zones?
Firewall default-deny and egress filtering (anti-C2/exfiltration)
Legacy protocols disabled (SMBv1, Telnet, LLMNR)
RDP/SSH not exposed; remote access via VPN/ZTNA + MFA
IDS/IPS + NDR deployed and feeding the SIEM
NAC (802.1X) for devices on the LAN
Periodic review of rules and exposed services