Belajar Security Architect - Network Security Architecture
Mempelajari network segmentation, SASE/SSE, perimetral evolution, dan microsegmentasi untuk merancang arsitektur jaringan yang aman
#Pendahuluan
Setelah di episode 5 kita mempelajari identity & access architecture, pada episode ini kita dalami network security architecture — bagaimana mendesain pertahanan di lapisan jaringan. Network architecture yang baik memastikan traffic diarahkan, diinspeksi, dan dikontrol dengan benar.
Mengapa network architecture penting? Karena meskipun zero trust menggeser fokus ke identity, jaringan tetap menjadi jalur komunikasi. Arsitektur jaringan yang salah bisa membypass semua pertahanan identity-based.
#Network Segmentation
#Hierarki Segmentation
| Level | Scope | Contoh |
|---|---|---|
| Macrosegmentation | Network zones | DMZ, internal, PCI |
| Microsegmentation | Workload-level | Per VM, per container |
| Nanosegmentation | Process-level | Per API, per flow |
#Segmentation Design
| Zone | Kebijakan |
|---|---|
| DMZ | Public-facing, inspected |
| Internal | Restricted, monitored |
| PCI | Isolated, audited |
| Management | Jump server only |
#SASE & SSE
#SASE (Secure Access Service Edge)
SASE menggabungkan network dan security ke cloud service.
| Komponen | Fungsi |
|---|---|
| SD-WAN | Network connectivity |
| SWG | Secure web gateway |
| CASB | Cloud access security broker |
| ZTNA | Zero trust network access |
| FWaaS | Firewall as a service |
#SSE (Security Service Edge)
SSE adalah subset SASE tanpa SD-WAN — fokus pada security.
| Komponen | Fungsi |
|---|---|
| SWG | Web filtering, inspection |
| CASB | Cloud app security |
| ZTNA | Remote access replacement VPN |
Tip
SSE lebih mudah diadopsi dari SASE karena tidak memerlukan SD-WAN replacement. Mulai dari SSE (ZTNA + SWG + CASB), lalu berkembang ke SASE penuh jika sudah siap mengganti network infrastructure.
#Perimetral Evolution
| Era | Perimeter | Trust Model |
|---|---|---|
| Tradisional | Firewall di perimeter | Inside = trusted |
| Next-gen | NGFW + IDS/IPS | Segmented inside |
| Cloud | Cloud-native security | Identity-based |
| Zero Trust | No perimeter | Never trust |
#Firewall Architecture
#Types
| Type | Fungsi | Layer |
|---|---|---|
| Packet filter | Basic allow/deny | Network (L3) |
| Stateful | Connection tracking | Network (L3-L4) |
| NGFW | Application inspection | L3-L7 |
| WAF | Web application protection | L7 |
| Cloud FW | Cloud-native filtering | All |
#Firewall Rule Design
| Principle | Implementasi |
|---|---|
| Default deny | Block all, allow explicit |
| Least privilege | Minimum required access |
| Logging | Log all deny + critical allow |
| Review | Quarterly rule review |
Note
Firewall rules harus dikelola sebagai code — version controlled, reviewed, tested. "ClickOps" firewall rule di console adalah resep untuk rule bloat dan security gap.
#Penutup
Inti yang harus dibawa pulang:
- Segmentation: macro → micro → nano, sesuai kebutuhan.
- SASE/SSE: network + security di cloud, ZTNA replaces VPN.
- Perimeter evolution: dari firewall-centric ke identity-centric.
- Firewall rules as code: version controlled, reviewed, tested.
Di episode 7 selanjutnya kita akan membahas cloud security architecture — multi-cloud security design, shared responsibility, dan cloud control planes.