<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ransomware-proof-network-architecture
description: >-
  Design and implement network architectures resilient to ransomware
  propagation. Covers micro-segmentation, zero-trust network access (ZTNA),
  east-west traffic inspection, jump server hardening, VLAN isolation for
  critical assets, and automated network quarantine triggers. Provides
  firewall rules, NSG policies, and segmentation validation scripts.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - network-segmentation
  - zero-trust
  - micro-segmentation
  - vlan-isolation
  - firewall-hardening
  - ztna
  - east-west-traffic
  - lateral-movement-prevention
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Implementing Ransomware-Proof Network Architecture

## Overview

Flat networks are ransomware's greatest enabler. Once an attacker gains a
foothold, unrestricted lateral movement allows encryption of every reachable
host within hours. Ransomware-proof architecture eliminates flat network
assumptions through micro-segmentation, zero-trust enforcement, and automated
quarantine capabilities.

Goal: limit blast radius to a single segment, force attackers through
monitored chokepoints, and enable sub-minute network isolation of
compromised hosts.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| nmap | Network scanning and validation | `apt install nmap` |
| iptables/nftables | Host-based firewall rules | Built-in on Linux |
| Suricata | East-west traffic IDS | `apt install suricata` |
| Terraform | Infrastructure as code for NSGs | `brew install terraform` |
| Zeek | Network traffic analysis | `apt install zeek` |

## Key Concepts

### Defense-in-Depth Network Layers

```
Layer 1: Perimeter — WAF, DDoS protection, ingress filtering
Layer 2: DMZ — Reverse proxies, bastion hosts, MFA gateways
Layer 3: Segmentation — VLAN per function, ACLs between zones
Layer 4: Micro-segmentation — Host-level firewalls, identity-aware
Layer 5: Application — mTLS, service mesh, API gateways
Layer 6: Data — Encryption at rest, tokenization, DLP
```

### Segmentation Priority Matrix

| Zone | Critical Assets | Isolation Level | Monitoring |
|------|----------------|-----------------|------------|
| Domain Controllers | AD, DNS, DHCP | Maximum — dedicated VLAN | Full packet capture |
| Backup Infrastructure | Veeam, Commvault, tapes | Air-gapped or immutable | Integrity checks |
| User Workstations | Endpoints | Per-department VLANs | EDR + network |
| Servers (Prod) | App servers, databases | Tiered trust zones | IDS + flow logs |
| Management Plane | SIEM, jump servers | Out-of-band network | Privileged access logs |

## Workflow

### Step 1 — Audit Current Network Segmentation

```bash
# Discover live hosts and open ports per subnet
nmap -sn 10.0.0.0/16 -oG - | grep "Up" | awk '{print $2}' | sort -t. -k3,3n -k4,4n

# Check inter-VLAN routing rules
ip route show table all | grep -v "linkdown"

# Identify flat network indicators — hosts reaching across subnets
conntrack -L 2>/dev/null | awk '{print $4,$5}' | sort | uniq -c | sort -rn | head -20

# Verify firewall rules on critical hosts
iptables -L -n -v --line-numbers 2>/dev/null || nft list ruleset 2>/dev/null
```

### Step 2 — Implement Micro-Segmentation with nftables

```bash
# nftables: Restrict DC access to only domain-joined hosts on 389/636
cat > /etc/nftables.d/dc-protection.nft << 'EOF'
table inet dc_protection {
  chain input {
    type filter hook input priority 0; policy drop;

    # Allow LDAP/LDAPS only from known subnets
    ip saddr 10.10.0.0/24 tcp dport { 389, 636 } accept
    ip saddr 10.10.1.0/24 tcp dport { 389, 636 } accept

    # Allow Kerberos from domain members
    ip saddr 10.10.0.0/16 tcp dport 88 accept
    ip saddr 10.10.0.0/16 udp dport 88 accept

    # Allow DNS
    tcp dport 53 accept
    udp dport 53 accept

    # Allow management from jump server only
    ip saddr 10.99.0.10 tcp dport 22 accept

    # Log and drop everything else
    log prefix "DC_BLOCKED: " counter drop
  }
}
EOF

nft -f /etc/nftables.d/dc-protection.nft
```

### Step 3 — Deploy East-West Traffic Monitoring with Suricata

```yaml
# /etc/suricata/rules/ransomware-lateral.rules
alert smb any any -> any any (msg:"SMB lateral movement - admin share access"; \
  content:"|FF|SMB"; content:"ADMIN$"; nocase; \
  sid:3000001; rev:1; classtype:policy-violation;)

alert tcp any any -> any 445 (msg:"Potential PsExec service install over SMB"; \
  content:"PSEXESVC"; nocase; \
  sid:3000002; rev:1; classtype:trojan-activity;)

alert tcp any any -> any any (msg:"Cobalt Strike beacon interval pattern"; \
  flow:to_server,established; dsize:68; \
  sid:3000003; rev:1; classtype:trojan-activity;)
```

```bash
# Enable Suricata on internal interface
suricata -c /etc/suricata/suricata.yaml -i eth1 --set vars.HOME_NET="10.0.0.0/8" -D
```

### Step 4 — Automated Network Quarantine Script

```bash
#!/bin/bash
# Quarantine a compromised host by blocking at network level
QUARANTINE_HOST="$1"

if [ -z "$QUARANTINE_HOST" ]; then
  echo "Usage: quarantine.sh <IP_ADDRESS>"
  exit 1
fi

echo "[*] Quarantining $QUARANTINE_HOST"

# Block at host firewall (all traffic except management)
iptables -I FORWARD -s "$QUARANTINE_HOST" -j DROP
iptables -I FORWARD -d "$QUARANTINE_HOST" -j DROP
iptables -I FORWARD -s "$QUARANTINE_HOST" -d 10.99.0.10 -p tcp --dport 22 -j ACCEPT

# Log quarantine action
logger -t QUARANTINE "Host $QUARANTINE_HOST isolated at $(date -u +%Y-%m-%dT%H:%M:%SZ)"

echo "[+] Host $QUARANTINE_HOST quarantined — management access only via 10.99.0.10"
```

### Step 5 — Validate Segmentation with nmap

```bash
# From workstation VLAN — verify cannot reach DC directly
nmap -Pn -p 389,636,3389 10.10.99.1 --reason

# Verify backup network is unreachable from user segment
nmap -Pn -p 9392,9393,6160 10.20.0.0/24 --reason

# Verify inter-zone traffic is logged
tail -f /var/log/syslog | grep "DC_BLOCKED\|QUARANTINE"
```

## Detection

```yaml
title: Ransomware Proof Network Architecture Detection
id: 37474f92-fc98-4dd9-ac0d-9e011fceb441
status: experimental
description: Detects suspicious activity related to implementing ransomware proof network architecture techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Each critical asset zone has a dedicated VLAN/subnet
- [ ] Domain controllers accept LDAP only from authorized subnets
- [ ] Backup infrastructure is unreachable from user workstations
- [ ] East-west IDS rules detect SMB lateral movement attempts
- [ ] Quarantine script isolates hosts within 60 seconds of trigger
- [ ] Segmentation tested quarterly with nmap validation scans

## References

- NIST SP 800-207: Zero Trust Architecture
- CIS Control 12: Network Infrastructure Management
- MITRE ATT&CK T1021: Remote Services
- MITRE ATT&CK T1570: Lateral Tool Transfer
- CISA Zero Trust Maturity Model v2.0
