Flat Networks, Fast Breaches, and How Shared Services Undermine Internal Segmentation

Cyber Millennial
in ,

In full posture assessments and incident response engagements I often found internal networks still flat. VLANs separated users, servers, management, or wireless, but without internal firewalls these zones offered little resistance and attackers could move freely. Even where segmentation existed, shared services like storage, Citrix, or management platforms spanned environments and bridged production with non-production. This was usually a trade-off between cost, complexity, and legacy design. Cloud stood out more positively, with Azure vNets, AWS VPCs, and GCP VPCs applying ACLs to segment traffic, though gaps remained around shared infrastructure. On paper segmentation looked effective, yet in practice it left broad paths open.

Read More

Perimeter Firewalls: Strong Technology, Weak Defences

in ,

Perimeter firewalls in most enterprises start strong, but in a number of assessments I found organisations not getting the full value of what they paid for. A few had intrusion prevention enabled only in monitor mode, others skipped SSL inspection altogether, some allowed servers to reach the internet as if they were laptops, and many carried forward undocumented rules that no one could fully explain. I also encountered firewalls without application-aware rules, IPv6 left enabled where the business did not support it, exposed management planes reachable from the internet, and VPN web portals like GlobalProtect that have been exploited repeatedly. Features such as user identification, which can provide valuable context, were often left unused. On their own, these gaps may seem manageable, but in combination they create blind spots and pathways that adversaries can exploit. The result is a firewall estate that looks modern and capable on paper yet delivers less defence than the investment should provide.

Read More