Skip to main content

A-003 - Network Security & Segmentation

Purpose​

Control network flows, enforce trust boundaries and limit exposure between systems in order to reduce attack surface and contain potential compromises.

Asset Type​

  • Business Capability

Description​

  • Defines how network traffic is filtered, routed and segmented across the Scheol environment
  • Covers both external exposure (Internet-facing services) and internal segmentation (zones, VLANs, trust boundaries)

At the current stage:

  • a firewall is deployed in the Hell environment to manage internal segmentation and traffic control
  • Heaven environments (VPS) rely primarily on host-level exposure and provider-level networking
  • segmentation between services is limited and varies depending on the environment

The overall network model is partially implemented and still evolving.

Criticality​

  • Critical
  • Network security directly impacts:
    • exposure of services
    • lateral movement potential
    • containment of compromised systems

Weak segmentation significantly increases systemic risk.

Sensitivity​

  • Sensitive
  • Involves:
    • network topology
    • filtering rules
    • exposure paths
    • trust boundary definitions

Exposure Level​

  • Exposed

This asset directly interfaces with:

  • external networks (Internet)
  • internal trust zones

Misconfiguration can lead to unintended exposure of internal services or administrative interfaces.

Trust Zone​

  • Hybrid

Covers:

  • Hell (internal segmentation, firewall control)
  • Heaven (public exposure, VPS networking)

Also defines the relationship between these zones.

Dependencies​

  • Firewall platform (pfSense / OPNsense)
  • Network infrastructure (virtual networks, VLANs)
  • VPS provider networking
  • Reverse proxy layer (traffic routing)
  • Administrative access (for configuration and maintenance)

Relationships​

  • Infrastructure Hosting (network foundation)
  • Application Security (service exposure)
  • Identity & Access Management (access control enforcement)
  • Monitoring & Detection (network visibility and logs)
  • Administrative Access (management plane exposure)

Security Position (Architecture Context)​

  • Primary enforcement layer for trust boundaries
  • Controls exposure between:
    • Internet ↔ Heaven
    • Heaven ↔ Hell (future evolution)
    • Internal zones within Hell

Key structural roles:

  • defines attack surface at network level
  • limits lateral movement between systems
  • supports separation between administrative, application and infrastructure planes

Current structural weaknesses:

  • limited segmentation within VPS environments
  • reliance on host-level exposure rather than network isolation
  • incomplete trust boundary formalization
  • lack of consistent network policy across all assets

Existing Protective Measures​

  • firewall-based filtering in Hell environment
  • restricted exposure of services (HTTP/HTTPS, controlled SSH access)
  • basic hardening of network access (non-standard ports, key-based authentication)

Limitations:

  • no unified segmentation model across all environments
  • limited isolation between co-hosted services
  • no advanced network-level detection or filtering (e.g. WAF, IDS not fully deployed)
  • incomplete visibility on inter-system traffic

Owner / Responsibility​

  • Operations Role (Ops)

Notes​

Network Security & Segmentation is a foundational element of the Scheol architecture.

Current implementation is functional but not fully mature.

Planned improvements include:

  • stronger internal segmentation (VLANs, zone separation)
  • better isolation of services in VPS environments
  • clearer definition of trust boundaries between Hell and Heaven
  • integration of network monitoring and detection capabilities (IDS/IPS)

This asset is central to reducing systemic risk and enabling a more resilient security architecture.