<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: designing-secure-network-architecture
description: >-
  Design defense-in-depth network architectures with segmentation, micro-segmentation,
  zero trust network access, and traffic inspection across on-premises, cloud, and
  hybrid environments.
domain: cybersecurity
subdomain: security-architecture
tags:
  - network-segmentation
  - zero-trust
  - micro-segmentation
  - firewall
  - ndr
  - vpc
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1046"]
---

# Designing Secure Network Architecture

## Overview

Secure network architecture applies defense-in-depth principles through segmentation,
traffic inspection, and zero trust network access (ZTNA). This skill covers designing
network topologies that minimize blast radius, enforce least-privilege connectivity,
and provide visibility into east-west and north-south traffic.

Mode: `[MODE: ARCHITECT]` — Network security design and segmentation.

## Prerequisites

- Network topology documentation or cloud VPC configuration
- Firewall management access (pf, iptables, cloud security groups)
- Python 3.10+ for automation scripts
- Optional: Terraform for IaC network definitions

## Key Concepts

### Network Segmentation Tiers

| Zone | Purpose | Trust Level | Example Controls |
|------|---------|-------------|------------------|
| **DMZ** | Public-facing services | Untrusted | WAF, reverse proxy, IDS |
| **Application** | Business logic tier | Semi-trusted | Micro-segmentation, mTLS |
| **Data** | Databases, storage | Trusted | Encryption, ACLs, DLP |
| **Management** | Admin/control plane | Highly trusted | PAM, MFA, jump hosts |
| **OOB** | Out-of-band management | Isolated | Physical separation, serial |

### Zero Trust Network Architecture

```
┌─────────────────────────────────────────────────┐
│                  Policy Engine                   │
│         (Identity + Device + Context)            │
└──────────────┬──────────────────┬───────────────┘
               │                  │
       ┌───────▼──────┐   ┌──────▼───────┐
       │  Policy      │   │  Policy      │
       │  Enforcement │   │  Enforcement │
       │  Point (PEP) │   │  Point (PEP) │
       └───────┬──────┘   └──────┬───────┘
               │                  │
       ┌───────▼──────┐   ┌──────▼───────┐
       │  Workload A  │   │  Workload B  │
       │  (Isolated)  │   │  (Isolated)  │
       └──────────────┘   └──────────────┘
```

### Cloud VPC Security Design

```hcl
# Terraform — Three-tier VPC with network ACLs
resource "aws_vpc" "secure" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags = { Name = "secure-vpc" }
}

resource "aws_subnet" "dmz" {
  vpc_id            = aws_vpc.secure.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "dmz-subnet", Zone = "untrusted" }
}

resource "aws_subnet" "app" {
  vpc_id            = aws_vpc.secure.id
  cidr_block        = "10.0.10.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "app-subnet", Zone = "semi-trusted" }
}

resource "aws_subnet" "data" {
  vpc_id            = aws_vpc.secure.id
  cidr_block        = "10.0.20.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "data-subnet", Zone = "trusted" }
}

resource "aws_network_acl" "data_acl" {
  vpc_id     = aws_vpc.secure.id
  subnet_ids = [aws_subnet.data.id]

  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "10.0.10.0/24"
    from_port  = 5432
    to_port    = 5432
  }

  ingress {
    protocol   = "-1"
    rule_no    = 200
    action     = "deny"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }
}
```

### Micro-Segmentation Policy Matrix

```json
{
  "policies": [
    {
      "name": "web-to-api",
      "source": {"label": "tier=web", "zone": "dmz"},
      "destination": {"label": "tier=api", "zone": "app"},
      "protocol": "tcp",
      "ports": [443, 8443],
      "action": "allow",
      "logging": true
    },
    {
      "name": "api-to-db",
      "source": {"label": "tier=api", "zone": "app"},
      "destination": {"label": "tier=db", "zone": "data"},
      "protocol": "tcp",
      "ports": [5432],
      "action": "allow",
      "logging": true
    },
    {
      "name": "default-deny",
      "source": {"label": "*"},
      "destination": {"label": "*"},
      "protocol": "*",
      "ports": [],
      "action": "deny",
      "logging": true
    }
  ]
}
```

## Workflow

### Step 1: Inventory Network Assets and Flows

```bash
node scripts/agent.js --action inventory --topology topology.json
```

### Step 2: Design Segmentation Zones

```bash
node scripts/agent.js --action segment --topology topology.json --output zones.json
```

### Step 3: Generate Firewall Rules

```bash
node scripts/agent.js --action rules --zones zones.json --output fw-rules.json
```

### Step 4: Validate Connectivity

```bash
node scripts/agent.js --action validate --rules fw-rules.json --flows expected-flows.json
```

## Detection

```yaml
title: Designing Secure Network Architecture Detection
id: fc45ad90-fa07-40a6-81ae-99542dd68208
status: experimental
description: Detects suspicious activity related to designing secure network architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1046
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```

## Verification

- [ ] All network zones defined with explicit trust levels
- [ ] Default-deny policy enforced at every segmentation boundary
- [ ] East-west traffic inspected between application tiers
- [ ] Management plane isolated from data plane
- [ ] Micro-segmentation applied to workload-level communication
- [ ] Network flow logs enabled for all inter-zone traffic
- [ ] Firewall rules reviewed for overly permissive entries

## References

- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8 — Control 12: Network Infrastructure Management](https://www.cisecurity.org/controls/v8)
- [AWS VPC Security Best Practices](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-best-practices.html)
