Question

Which specific design technique uses VLANs and subnets to prevent an attacker from moving from a compromised workstation to a sensitive database server?

Accepted Answer

The specific design technique is called network segmentation. Network segmentation is the practice of splitting a computer network into smaller, isolated sub-networks to control the flow of traffic. A VLAN, or Virtual Local Area Network, is a logical grouping of devices that allows network administrators to organize traffic at the data link layer, regardless of the physical location of the devices. A subnet is a logical subdivision of an IP network that acts as a boundary for IP traffic. By placing a workstation on one VLAN and subnet and the sensitive database server on a different VLAN and subnet, the two systems cannot communicate directly with each other at the link layer. To allow traffic between these segments, the data must pass through a router or a firewall. By placing a firewall between these segmented VLANs, security policies can be enforced to strictly permit only necessary traffic, such as specific database queries, while blocking all other access attempts. This effectively prevents an attacker who compromises a workstation from moving laterally across the network to access the database server because the architecture requires authorized verification and inspection at the gateway between the isolated zones.

Home → All Courses → Engineering and Technology Courses → Cybersecurity Engineering → Flashcard

Which specific design technique uses VLANs and subnets to prevent an attacker from moving from a compromised workstation to a sensitive database server?