Level 4 with one computer (Privileged Access Workstation) about network-segmentation-cheat-sheet HOT 7 OPEN

@C0FFEEC0FFEE interesting.
I need time to analyze.

from network-segmentation-cheat-sheet.

@C0FFEEC0FFEE Do you have experience using this technology if so?

from network-segmentation-cheat-sheet.

Yes

from network-segmentation-cheat-sheet.

https://docs.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms

from network-segmentation-cheat-sheet.

@C0FFEEC0FFEE what if an attacker takes over the Guarded host after PAW was started, what prevents him from using the PAW virtual machine?

from network-segmentation-cheat-sheet.

I did not have time to read the article you linked. In my case I put the untrusted workload (e-mail, browsing the web, office work) into a VM running on the PAW with a vNIC bridged onto the physical NIC. The PAW itself has an always-on VPN connection into the data centre. In this case the only attack vector would be to break out of the hypervisor, which is the tradeoff to using two physical devices. The OS on the PAW is hardened und watched closely by EDR.

from network-segmentation-cheat-sheet.

That would not pass Australia IRAP, you would need 2 physically separate hosts if you were to have separation

from network-segmentation-cheat-sheet.