An ninh mạng phân tầng (Tiered / Layered Network Security): Kiến trúc, Triển khai & Best Practices

Tiered Network Security (An ninh mạng phân tầng) là gì?

Tiered Network Security (còn gọi Layered Security hoặc Defense in Depth - Phòng thủ chiều sâu) là chiến lược triển khai nhiều lớp kiểm soát bảo mật chồng chéo nhau trên toàn bộ hạ tầng công nghệ thông tin. Mục tiêu: Không có điểm thất bại đơn lẻ (Single Point of Failure) – nếu một lớp bị vượt qua, các lớp khác vẫn bảo vệ tài sản.

Ba tầng kiến trúc mạng truyền thống (3-Tier Network Architecture)

Khác với "Tiered Security" (phân tầng bảo mật), "3-Tier Network" là topology mạng:

Tầng	Vai trò	Thiết bị	Bảo mật đặc thù
Core Layer (Lõi)	High-speed backbone, kết nối Distribution layers, WAN/Internet Edge	Core Switch (Chassis: Catalyst 9600, Nexus 9000, Arista 7500), Router Edge	High-throughput encryption (MACsec/IPsec), BGPsec, RPKI, DDoS Scrubbing, Flow Telemetry
Distribution Layer (Tổng hợp/Phân phối)	Policy enforcement, Routing giữa Access & Core, Aggregation, QoS, Security Boundary	Distribution Switch (Catalyst 9500/9400, Nexus 9300), Firewall (NGFW)	Inter-zone Firewalling (NGFW), Micro-segmentation Gateway, IPS, SSL Decrypt, Policy-based Routing
Access Layer (Truy cập)	Kết nối End-user, IoT, Server, AP, IoT/OT	Access Switch (Catalyst 9200/9300, Meraki MS, Aruba CX), Wireless AP/Controller	802.1X/NAC, Port Security, DAI, IP Source Guard, BPDU Guard, MACsec, Wireless Security (WPA3/802.1X)

Mô hình Tiered Security (Phân tầng bảo mật) – 7 Lớp (Mapping OSI + Zero Trust)

Ba yếu tố cốt lõi của Layered Security (3 Elements)

Prevention (Ngăn chặn): Hardening, Patch, Config, Firewall, App Control, MFA, Encryption, Secure Coding – Stop attack before execution
Detection (Phát hiện): EDR, NDR, SIEM, UEBA, CTI, Deception, Honeytoken, Cloud Trail, Audit Log – See attack in progress
Response (Đáp ứng): SOAR Playbook, Isolation, Block, Rollback, Forensics, Notification, Recovery, Lessons Learned – Contain & Remediate

Quan trọng: 3 yếu tố phải có ở TỪNG TIER. Không chỉ Tier 7 có Detection/Response.

Tại sao Tiered Security quan trọng?

Giảm Blast Radius: Compromise Tier 4 (Endpoint) → Không tự động compromise Tier 6 (Data) nhờ DLP, Encryption, Access Control
Tăng MTTD (Mean Time to Detect) & Giảm MTTR: Multiple detection points (EDR + NDR + SIEM + Cloud) → Correlation → Faster Detection
Thwart "Living off the Land": Attacker dùng tool hợp pháp (PowerShell, WMI, RDP, SSH) → Cần Behavioral Detection (Tier 4, 5, 7) chứ không chỉ Signature
Tuân thủ (Compliance): PCI DSS, NIST 800-53, ISO 27001 yêu cầu Defense in Depth
Cloud & Hybrid Support: Tiered model extend tự nhiên sang Cloud (CSPM=CSPM Tier, CWPP=Tier 4, CIEM=Tier 6, ZTNA=Tier 3/6)

Ví dụ Multi-Layer Security trong thực tế (Attack Scenario: Phishing → Ransomware)

Tier/Layer	Tên gọi	Kiểm soát chính	Công nghệ/Ví dụ
Tier 1	Physical & Environmental	Physical Access Control, Asset Tracking, Cable Security, TEMPEST, Power/Cooling Redundancy	Biometric/Badge/Mantrap, DCIM, OTDR, UPS/Generator
Tier 2	Perimeter & Edge (Ranh giới)	Edge FW, DDoS Protection, DNS Security, Threat Intel Feed, BGPsec, RPKI	Palo Alto, FortiGate, Cloudflare, AWS Shield, Arbor, Infoblox
Tier 3	Network Segmentation & Transport (Phân đoạn & Truyền)	Micro-segmentation (Zero Trust), NGFW Inter-zone, IPsec/MACsec, NDR, NetFlow, SSL Decrypt	Illumio, Cisco ACI/NSX, Palo Alto, Corelight, Vectra, Cisco Stealthwatch
Tier 4	Endpoint & Workload (Đầu cuối & Tải العمل)	EDR/XDR, App Control, Hardening (CIS/STIG), Patch Mgmt, Vuln Mgmt, TPM/Secure Boot	CrowdStrike, SentinelOne, Defender for Endpoint, Tanium, Automox, Qualys
Tier 5	Application & API (Ứng dụng & API)	DevSecOps (SAST/DAST/SCA/Secret/IaC), WAF/WAAP, API Security, Bot Mgmt, RASP	GitLab/CodeQL/Semgrep, Snyk, Checkov, Cloudflare/WAF, Traceable/Noname, Datadog RASP
Tier 6	Data & Identity (Dữ liệu & Danh tính)	Classification, DLP, Encryption (At-rest/In-transit/In-use), Tokenization, Key Mgmt (HSM/KMS), IAM/PAM/IGA, ZTNA	Purview/Varonis, Vault/KMS, CyberArk/BeyondTrust, Okta/Entra ID, Zscaler/Prisma Access
Tier 7	Operations & Governance (Vận hành & Quản trị)	SOC/SIEM/SOAR, CTI, IR Plan/Playbook, Tabletop/Red/Purple Team, GRC Auto, TPRM, Awareness, Metrics/KRI	Splunk/Sentinel/Elastic, MISP/OpenCTI, ServiceNow SecOps, AuditBoard/Vanta, KnowBe4, SecurityScorecard

Attack Step	Tier phòng thủ	Control chặn / Phát hiện	Kết quả nếu Tier đó fail
1. Phishing Email sent	Tier 7 (Ops)	Email Security Gateway (Proofpoint/Mimecast/Defender for Office 365) – Block/Quarantine	Email đến Inbox
2. User click link → Credential Harvest	Tier 6 (Identity)	MFA (Phish-resistant FIDO2) – Block login ngay cả khi có password. Conditional Access (Risk-based)	Attacker có Credential
3. Attacker VPN/ZTNA login	Tier 3 (Network) + Tier 6	ZTNA: Device Posture Check (Compliance, Cert, MDM) → Block unmanaged device. Geo-impossible travel alert.	Attacker truy cập Network
4. Lateral Movement (SMB/PSRemoting/SSH)	Tier 3 (Network) + Tier 4 (Endpoint)	Micro-segmentation: Default Deny East-West. EDR: Detect PsExec, WMI, SMB admin$, Pass-the-Hash → Block/Alert	Attacker lan rộng Domain
5. Privilege Escalation (Kernel Exploit / Misconfig)	Tier 4 (Endpoint)	EDR Kernel Callback, LSASS Protection (RunAsPPL), Credential Guard, App Control	Attacker có SYSTEM/Root / Domain Admin
6. Data Staging & Exfiltration	Tier 6 (Data) + Tier 3 (Network)	DLP (Endpoint/Network/Cloud) detect PII/IP upload. NDR detect anomalous large transfer. Egress FW block unknown cloud.	Data Exfiltrated
7. Ransomware Encryption	Tier 4 (Endpoint) + Tier 7 (Ops)	EDR Ransomware Rollback (SentinelOne/CrowdStrike/Defender). Immutable Backup (Tier 7) → Restore.	Data Encrypted, Ransom Paid, Downtime

Triển khai Tiered Security – Roadmap 3 Giai đoạn

Phase 1: Foundation (0-6 tháng) – "Get the Basics Right"
- Asset Inventory (IT/OT/Cloud/SaaS) – 100% visibility
- MFA Everywhere (Admin, Remote, Critical App,.Email)
- Patch Management (KEV 72h, Critical 14d, High 30d)
- Offline/Immutable Backup + Test Restore (3-2-1-1-0)
- Email Security (DMARC p=reject, Sandbox, URL Rewrite)
- Perimeter NGFW (App-ID, SSL Decrypt, IPS, Threat Intel)
- Centralized Logging (SIEM) + Critical Alert Tuning
Phase 2: Segmentation & Detection (6-18 tháng) – "Limit Blast Radius"
- Network Segmentation (Zero Trust: Identity-based, Micro-seg)
- EDR → XDR (Network + Cloud + Identity telemetry)
- PAM (JIT, Session Recording, Vault) cho All Privileged Access
- DevSecOps Pipeline (SAST/SCA/Secret/IaC/Container Scan)
- WAF/WAAP cho Critical Apps/API
- Data Classification + DLP (Endpoint/Network/Cloud)
- Threat Intel Integration (TIP) + MITRE ATT&CK Mapping
Phase 3: Maturity & Resilience (18-36+ tháng) – "Continuous Improvement"
- Zero Trust Architecture Full (ZTNA, Continuous Verification, Policy Engine)
- Cloud-Native Security (CNAPP, CIEM, K8s Runtime, Serverless, eBPF)
- AI/ML Detection (Behavioral, User/Entity Analytics, Automated Response)
- Purple Team Continuous (Automated Attack Simulation + Detection Validation)
- Cyber Resilience: Crisis Sim, War Gaming, Board Reporting, Cyber Insurance Optimization
- Supply Chain Security (SBOM, SLSA, Vendor Continuous Monitor)

Sai lầm thường gặp (Anti-patterns)

Mua tool "Next-Gen" mà không có process/people vận hành (Shelfware)
Tập trung Perimeter (Tier 2) nhưng bỏ qua Internal (Tier 3,4,5,6) → "M&M Security" (Hard outside, Soft inside)
Log everything nhưng không alert / không investigate (Data swamp, Alert fatigue)
Exception management kém: Exception thành permanent, không review, không compensating control
Không test Restore từ Backup – Backup ≠ Recovery
Security Team hoạt động trong Silo, không partner với IT/Dev/Business

Kết luận: Tiered Network Security = Defense in Depth hiện đại = 7 Tiers (Physical → Perimeter → Network Seg → Endpoint → App/API → Data/Identity → Ops/Governance) mỗi tier có Prevention/Detection/Response. Triển khai theo Roadmap Phased, Risk-based, Measurable. Không phải mua tool – là xây dựng Security Program bền vững.