Imagine you are building your house, what do you start with - first of all you will secure your land area from trespassers with a boundary wall. You will probably also add an entry point to allow people who are supposed to enter and work in the property. Once the property is secured and marked, you will start designing the master plan of your house - no. of rooms, their types, passages etc. You will have to ensure there is seamless connectivity across the house at the same time it's secured from unwanted elements.
Building software infrastructure is similar, after all it's the house where your potential best selling software will be deployed.
Network is the root of infra, the stronger the root is, the healthier entire tree will be. Any loophole in it will lead to compromising the entire software infrastructure. Like in a house, a robust infrastructure needs to have secure and seamless connectivity across all systems and services.
Segregated Network:
To secure connectivity, the network should be segregated or subnetted with respect to incoming and outgoing access.
Network privacy can be achieved via VPCs and subnets if you are hosted on cloud or through VLAN and DMZs if you are on premise and on legacy systems. You should have VPCs over classic or dynamic networks.
Configurations must be logically segregated or tiered with respect to usage (e.g. per product or customer).
Firewall rules must be adapted per tier/subnet.
If necessary segregate virtual machines and appliances to dedicated hardware.
Always keep separate networks for production and non-production.
Perimeter Security:
Network Policies based on whitelisting.
Deny All by default.
Apply ports/protocol level filters.
Do not allow any to any.
System to system access policy with firewall rules or network policies.
Sometimes some cloud providers tend to add external IP sources on the network policies or security groups of the services managed by them for monitoring, management or security scanning.
Make sure you validate the whitelisted sources as trusted ones. For example: cloud managed database service or managed kubernetes service or vulnerability scanners. Make sure to confirm these sources with your cloud provider.
Single Secure Entry point:
Make sure the device where requests land first is secure. It must be a single trusted Point endpoint exposed with IP Segregation, DNS based backend mapping, WAF features that implements OWASP policies, DDoS Protection.
You can use services like Cloudflare, Akamai. These also come with CDN that helps keeping your app endpoint flexible to point to wherever you backend it, helps in static asset migrations.
Configure certificate management for SSL certificate generation, renewal and offloading.
Mutual TLS to establish zero trust policy with any third party application endpoint.
Dedicated interconnected Links:
If you are running your services in a hybrid cloud model or if you are in a DC and DR setup you need to have direct links between your clouds or sites. These help ensure:
Minimum latency, better performance If you have third party connections.
Privacy of data in transit between the sites to avoid man in the middle attacks. Be the owner of your entry points.
Fault tolerance with dual ISP links so that if one path fails, another is available.
For data replication you need to have a latency < 1 ms between both sites. This can only be achieved through a direct dedicated connection. For example, MPLS, GCP Direct Connect, Alicloud Express Connect etc.
Some people think a site to site vpn is sufficient to connect two locations, thats not enough. Remember VPN over internet can give you secure connectivity but not the latency.
Let's delve into the comparison between cloud and on-premise networking, while addressing specific considerations such as subnet and VLAN configuration, hardware limitations, management complexities, and more.
Cloud v/s On-Premise:
Cloud Networking | On-Premise Networking |
Pros:
| Pros:
|
Cons:Cost of Operation: Cloud services typically operate on a subscription-based model, requiring ongoing payments for usage and support. While this eliminates the need for upfront hardware purchases, businesses must budget for recurring expenses and ensure timely renewal of licenses and warranties to maintain service continuity. | Cons:
|
Key Points For Network Security:
For every new subnet a new VLAN must be configured on the hardware firewall manually and then ports need to be mapped and then it can be used in the virtualisation platform.
Limitation of ports in switches, while VPCs are free with all the packages.
From switches to firewalls to backup ISP links, everything self-managed
Packet drops between software switches & firewalls.
Bandwidth & latency limitation.
Warranty and license renewal.
Most virtualisation for networking devices such as routing, switching, firewall, vpns are limited and heavily licensed. This makes infrastructure development and testing very costly and time consuming.
Although On-premise has some advantages over cloud such as data localisation, security, when it comes to scalability it becomes a bottleneck rather than an accelerator.
In conclusion, the choice between cloud and on-premise networking hinges on various factors, including scalability requirements, security concerns, budget considerations, and performance expectations.
While cloud networking offers agility, cost efficiency, and global accessibility, on-premise networking provides greater control, customisation, and data security.
Businesses must evaluate their unique needs and priorities to determine the most suitable approach for their networking infrastructure, weighing the trade-offs between convenience, control, and cost-effectiveness.
If you like this article, don't forget to like 👍 and share by reposting ♻️ in your network. Follow Kamalika Majumder for more.
Thanks & Regards
Kamalika Majumder
Comments