Chapter 7: Supporting Systems

Identity management, DNS, NTP, PKI, IPAM, backup, change management, and monitoring — the eight supporting systems that make segmentation operationally sustainable.

---

A segmentation architecture is only as strong as its supporting systems. The core security appliances enforce the policy, but without reliable identity management, accurate time synchronization, trusted certificate infrastructure, and disciplined change management, the policy enforcement will degrade over time. This chapter describes the eight supporting systems that must be designed and operated alongside the core segmentation infrastructure. The integrated diagram below shows how all supporting systems connect to the core security architecture.

7.1 Identity and Access Management Integration

Every security appliance in the segmentation architecture must integrate with the enterprise identity provider (IdP) for authentication and authorization. Local accounts should be used only for break-glass emergency access. The IdP integration ensures that when a user account is disabled in the directory, access to all security appliances is revoked simultaneously — a critical control for offboarding scenarios.

7.2 NTP Time Synchronization Hierarchy

Accurate time synchronization is a foundational requirement for security operations. Log correlation, certificate validity, Kerberos authentication, and forensic investigation all depend on all devices having consistent, accurate timestamps. A time drift of more than a few seconds can cause Kerberos authentication failures and make log correlation unreliable. The NTP hierarchy must be designed with redundancy and must be monitored continuously.

7.3 PKI and Certificate Management

A private PKI is required for issuing certificates for TLS inspection, device authentication (802.1X EAP-TLS), admin authentication, and inter-service communication. The PKI must be designed with a two-tier hierarchy — an offline root CA and one or more online issuing CAs. The root CA private key must be stored in a hardware security module (HSM) and the root CA system must be kept offline except during issuing CA certificate renewal operations.

7.4 DNS Architecture

The DNS architecture must be designed to support the zone model. Each zone should have its own DNS resolver configuration, and DNS queries from higher-security zones should not be forwarded to resolvers in lower-security zones. The DNS architecture must prevent DNS-based data exfiltration through query monitoring and response policy zones (RPZ).

• Split-Horizon DNS: Internal DNS resolvers return internal IP addresses for internal service names; external DNS returns public IPs. This prevents internal IP address disclosure.
• DNS Filtering: All DNS queries from Office and DMZ zones must pass through a DNS security service that blocks queries to known malicious domains using threat intelligence feeds.
• Response Policy Zones (RPZ): Configure RPZ on internal resolvers to block DNS resolution of known C2 domains, phishing domains, and newly registered domains matching suspicious patterns.
• DNS Query Logging: All DNS queries must be logged and forwarded to the SIEM. DNS logs are one of the most valuable data sources for detecting lateral movement and data exfiltration.
• DNSSEC: Implement DNSSEC for all internally authoritative zones to prevent DNS spoofing attacks within the network.

7.5 IP Address Management (IPAM)

An IPAM system is essential for maintaining an accurate, up-to-date record of all IP address allocations across all zones. Without IPAM, firewall rules based on IP addresses will drift from reality as addresses are reassigned, and security incidents will be harder to investigate because the mapping between IP addresses and devices will be unknown. The IPAM system must be integrated with DHCP servers, DNS, and the CMDB to provide a single source of truth for IP address assignments.

7.6 Backup and Recovery

Configuration backups for all security appliances must be taken automatically before any change and on a scheduled daily basis. Backups must be stored in a location that is accessible even if the primary management network is unavailable — typically an out-of-band management network with separate storage. Recovery procedures must be documented and tested at least annually to verify that a device can be restored to a known-good state within the RTO.

7.7 Change Management Integration

All changes to security appliance configurations — including firewall rule additions, modifications, and deletions — must go through the formal change management process. Emergency changes that bypass the standard approval process must be documented within 24 hours and reviewed at the next CAB meeting. The change management integration ensures that every configuration change is traceable to a business requirement and an approved ticket.

7.8 Monitoring and Alerting

The monitoring system must provide real-time visibility into the health, performance, and security posture of all segmentation components. Monitoring must cover both infrastructure health metrics (CPU, memory, throughput, session count) and security metrics (blocked connections, policy violations, authentication failures). Alerts must be routed to the appropriate team based on severity and category.