Establish and Maintain a Secure Network Architecture
Description
Establish and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Enterprise firewall with application visibility, IPS, malware defense, and encrypted traffic analytics
Cisco · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Lateral Movement Through Flat Network Architecture
ConfidentialityAttackers who compromise a single endpoint move freely across the entire network because no segmentation exists, accessing databases, file servers, and critical systems that should be isolated from general user traffic.
Widespread Ransomware Propagation Across Unsegmented Network
AvailabilityRansomware spreads to every reachable system on the network because the lack of segmentation provides no barriers to propagation, turning a single-host infection into an enterprise-wide encryption event.
Privilege Escalation via Network Architecture Flaws
IntegrityA network architecture that does not enforce least privilege allows users and systems to access network resources far beyond their operational needs, enabling attackers to reach high-value targets from any compromised entry point.
Vulnerabilities (When Safeguard Absent)
Flat Network with No Segmentation
The network architecture provides no segmentation between user workstations, servers, databases, management interfaces, and critical infrastructure, allowing unrestricted lateral communication between all network zones.
No Network Architecture Based on Least Privilege
Network access rules do not enforce least privilege principles, allowing systems and users to communicate with any network resource rather than only those required for their specific business function.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |