Network Security and Segmentation Guide

1. Introduction and Scope

1.0 Normative Language (Mandatory Keywords)

The following keywords are used to express requirement strength in this standard:

• SHALL / MUST: Mandatory requirement. Non-compliance requires an approved exception.
• SHOULD: Recommended requirement. If not implemented, rationale should be documented.
• MAY: Optional requirement.
• MUST NOT / SHALL NOT: Prohibited requirement.

1.1 Purpose

The purpose of this standard is to define how the Government of Malawi designs, operates, and secures its networks. It covers network architecture (segmentation, DMZ, internal zones), perimeter and internal firewalling, intrusion detection and prevention, secure Wi-Fi, and network monitoring. It does not replace host-level security (Government Server Security Hardening Standards) but complements it so that both network and host controls contribute to defence in depth.

1.2 Scope of Application

This standard applies to all government ministries and departments; state-owned enterprises and parastatals; local government authorities; and government contractors when they operate or manage government networks. It covers wired and wireless networks used for government data and services, whether on-premises, in government cloud, or in hybrid arrangements where the government retains responsibility for network security policy.

1.3 Definitions and Key Terms

Network segmentation – The division of a network into distinct zones or segments (e.g. DMZ, internal, management) so that traffic between segments is controlled and the impact of compromise is limited.

DMZ (Demilitarized Zone) – A network zone that sits between untrusted networks (e.g. internet) and internal trusted networks; used to host services that must be reachable from the internet while isolating them from internal systems.

Firewall – A device or software that enforces access control between network segments by allowing or denying traffic based on rules (source, destination, port, protocol); default-deny is the recommended policy.

Intrusion Detection System (IDS) – A system that monitors network or host traffic for signs of malicious or anomalous activity and generates alerts; it does not block traffic.

Intrusion Prevention System (IPS) – A system that monitors traffic and can block or mitigate detected threats in addition to alerting; deployed where blocking does not unduly disrupt legitimate traffic.

Zero Trust – A security model that assumes no implicit trust based on network location; access is verified per session and per resource, with least privilege and continuous verification.

Network Access Control (NAC) – Mechanisms (e.g. 802.1X) that ensure only authorised and compliant devices can connect to the network before granting access.

2. Core Objectives and Success Metrics

2.1 Primary Objectives

Defence in depth – Network security complements host-level controls; perimeter and internal firewalling, segmentation, and IDS/IPS work together to contain and detect threats.

Segmentation – Critical and high-impact systems are placed in defined zones with firewall policy so that lateral movement is limited and blast radius is reduced.

Controlled access – Only necessary traffic is allowed between zones; default-deny and documented rules with business justification; NAC where feasible so only authorised devices connect.

Detection and response – IDS/IPS deployed at perimeter and key internal boundaries; alerts integrated with incident response and SIEM for correlation and timely action.

Consistency and compliance – All government networks follow this standard so that inter-ministerial and citizen-facing services are protected and controls align with law and related standards.

2.2 Key Performance Indicators (KPIs)

2.3 Minimum Baseline and Prohibitions

Minimum controls (floor): Critical and high-impact systems SHALL be in defined zones with firewall policy; perimeter and internal firewalling with default-deny. Critical and internet-facing segments SHALL have IDS/IPS. Firewall rules SHALL be reviewed at least annually; allow rules SHALL have documented business justification and owner. Network alerts SHALL be integrated with incident response. All exceptions SHALL be in the exception register. Prohibitions: MUST NOT place critical/high systems in untrusted or undocumented zones without exception. MUST NOT grant exception without recording in exception register.

3. Governance and Compliance Framework

3.1 Governance Structure

Document Owner – The Ministry of Information and Communication Technology (MoICT), Department of eGovernment, owns this standard and is responsible for its maintenance, interpretation, and coordination with other government standards (including the Government Server Security Hardening Standards and Malawi Government Incident Response Standards).

System Owner – Accountable for systems in each zone; approves network access requirements and exception requests within their remit.

Security Officer – Validates that network security controls meet this standard and governs exceptions.

Network or Security Administrator – Implements and maintains firewall rules, IDS/IPS, segmentation, and NAC; documents rules and supports audit and incident response.

3.2 Compliance Framework

Network security must align with: Government Server Security Hardening Standards (host firewall, encrypted access); NIST SP 800-41 (Guidelines on Firewalls and Firewall Policy); NIST SP 800-53 Rev. 5 (e.g. SC-7 boundary protection, SC-5 denial of service); CIS Benchmarks for network devices (e.g. CIS Cisco, CIS firewall) where applicable; DoD STIGs for network devices where mandated for internet-facing or classified systems; Electronic Transactions and Cybersecurity Act (2016) and Data Protection Act (2024) where network security protects government data and systems.

3.3 System and Zone Categorisation

Internet-facing zone (DMZ): Highest scrutiny; strict firewall rules; IDS/IPS mandatory; logging and monitoring. Internal zones: Segmented by function or sensitivity (e.g. user segment, server segment, management segment); traffic between zones controlled. Critical/sensitive: Shortest rule sets, strongest monitoring, alignment with High Impact system requirements from server hardening.

3.4 Safe Exception Process

Exceptions to mandatory network security requirements (e.g. legacy segment not yet segmented, temporary rule for migration) SHALL be requested, documented, and reviewed as follows. Exception requests must include: system or segment name; specific requirement(s) from which an exception is sought; business or technical justification; compensating controls and timeline for remediation; proposed end date; and sign-off from the System Owner and Security Officer.

• Request: The System Owner submits an exception request (government form or template), stating the requirement(s) from which an exception is sought, justification, and proposed compensating controls.
• Documentation: Each exception SHALL document: justification; compensating controls and timeline for remediation; risk acceptance by the System Owner and validation by the Security Officer; maximum exception duration (not to exceed 12 months unless re-approved).
• Review: Exceptions SHALL be reviewed at least quarterly; extensions require re-approval.
• Register: All exceptions SHALL be recorded in an exception register and made available for audit.

4. Network Architecture and Segmentation

4.1 Design Principles

Networks are designed with a clear separation between untrusted (e.g. internet), semi-trusted (e.g. DMZ), and trusted (internal) zones. Traffic flows are documented (what may talk to what, and on which ports/protocols). Single points of failure are avoided where feasible (e.g. redundant firewall or path). Network diagrams and data flow documentation are maintained and updated when topology or policy changes.

Implementation: (1) Produce and maintain an up-to-date network diagram showing zones, key assets, and permitted flows. (2) Document each permitted flow with source zone, destination zone, port/protocol, business justification, and owner. (3) Review and update diagrams and flow documentation whenever new systems are deployed, zones are re-segmented, or firewall rules change. (4) For critical and internet-facing segments, ensure redundant paths or failover are documented and tested.

4.2 DMZ and Perimeter

Services that must be reachable from the internet (e.g. web, email gateway) are placed in a DMZ. The DMZ is isolated from internal zones by firewall; only necessary traffic (e.g. from DMZ to specific internal systems for backend data) is allowed. No direct internet-to-internal access is permitted for user or sensitive systems without strong authentication and control (e.g. VPN, per IAM). Perimeter firewall enforces default-deny; allow rules are documented with business justification and reviewed periodically.

4.3 Internal Segmentation

Internal networks are segmented so that user workstations, servers, management systems, and (where applicable) IoT or operational technology are in separate segments or VLANs. Traffic between segments is controlled by firewall or ACL. Server and database segments do not allow direct access from user segments except through application tiers where designed. Management traffic (e.g. admin access to servers) is restricted to management segment and encrypted (per Government Server Security Hardening Standards).

5. Firewall and Access Control

5.1 Firewall Policy

Firewall rules follow least privilege: only the minimum required traffic is allowed. Rules are documented (source, destination, port/protocol, business justification, owner). Default action is deny. Rule review is performed at least annually; obsolete rules are removed. Change management (Malawi Government Change Management Standards) applies to firewall rule changes.

Procedure – annual firewall rule review: (1) Export current rule set with last-used or hit-count data where available. (2) For each rule, confirm business justification and owner; flag rules with no recent use for removal or justification. (3) Remove obsolete rules via change request; document any rule retained without recent use with renewed justification. (4) Ensure default-deny is explicit and that allow rules are ordered and scoped to minimise unintended allow. (5) Record review date and outcome in the exception or compliance register.

5.2 Network Access Control

Where feasible, network access control (NAC) or 802.1X is used so that only authorised and compliant devices (e.g. domain-joined, patched) can connect to government networks. Guest or BYOD access (if permitted) is isolated in a separate segment with no access to internal government systems. Alignment with Malawi Government Endpoint and Mobile Device Security Standards and IAM support device and user authentication at the network layer.

5.3 Remote Access Baseline (VPN / Zero Trust Access)

Where users or administrators access government systems remotely:

Remote access SHALL require strong authentication (MFA per IAM).

Administrative remote access SHOULD be restricted to managed and compliant devices (Endpoint/Mobile Standards).

Access SHALL be least-privilege and time-bound where feasible for privileged activities.

Remote access events SHALL be logged and monitored (Monitoring + Logging/Evidence).

5.4 DNS and Naming Security (Baseline)

To reduce common attack paths:

Authoritative DNS for government domains SHOULD be monitored and protected from unauthorised change.

DNS changes SHALL follow Change Management and be evidenced (request, approval, implementation).

Where available, DNS security controls (e.g. access controls, change logging, multi-person approval) SHOULD be implemented for high-impact domains.

6. Intrusion Detection and Prevention

6.1 IDS/IPS Deployment

IDS or IPS is deployed at perimeter and (where feasible) at key internal segment boundaries. Signatures and rules are kept up to date. Tuning reduces false positives while retaining detection of real threats. For critical and internet-facing segments, IPS (blocking) is preferred where it does not disrupt legitimate traffic; otherwise IDS (alerting) with rapid response is required.

6.2 Monitoring and Tuning

Network traffic and IDS/IPS alerts are monitored. Alerts are prioritised and investigated; critical alerts are escalated per incident response procedures. Integration with SIEM (per Malawi Government Monitoring and Observability Standards) supports correlation and analysis. IDS/IPS logs are retained per policy (e.g. 90 days online, longer archived) and are available for incident investigation and audit.

7. Secure Wi-Fi and Wireless

7.1 Government Wi-Fi

Government-provided Wi-Fi uses strong encryption (WPA3 or WPA2 with strong passphrase or 802.1X). SSIDs and passwords are not default; they are managed and rotated per policy. Guest Wi-Fi (if offered) is segregated and does not allow access to government internal resources. Rogue access point detection is considered for sensitive sites.

7.2 Wireless Security

Wireless controllers and access points are secured (change default credentials, firmware updated, management interface not exposed to user VLAN). Wireless traffic to internal resources is treated as untrusted unless encrypted and authenticated (e.g. VPN, 802.1X).

8. Verification and Evidence Baseline (Audit-Ready Network Security)

To make this standard auditable, ministries and network administrators SHOULD maintain evidence that demonstrates: segmentation and zone mapping; firewall policy and rule documentation; IDS/IPS coverage; firewall review and alert integration; exception register. What internal audit checks: Sample of zones and firewall rules; IDS/IPS coverage; exception register. Sampling: Quarterly sample; annual firewall review. Escalation: Non-compliance → System Owner and Security Officer → remediation plan; repeated → Document Owner and senior management.

8.1 Compliance Reporting

9. Legal Compliance and Training

8.1 Legal and Related Standards

The Electronic Transactions and Cybersecurity Act (2016) requires appropriate cybersecurity measures; network security is a core control. The Data Protection Act (2024) requires protection of personal data; network segmentation and access control support that. Related standards: Government Server Security Hardening Standards; Malawi Government IAM Standards; Malawi Government Incident Response Standards; Malawi Government Monitoring and Observability Standards; Malawi Government Endpoint and Mobile Device Security Standards.

8.2 Training

Network and security staff are trained on this standard, on firewall and IDS/IPS administration, and on incident response for network alerts. System owners are aware of zone design and their responsibilities for systems in each zone.

10. Framework Alignment

This standard contributes to compliance with international frameworks:

• ISO/IEC 27001:2013 – control families A.13, A.9, A.12
• NIST SP 800-53 Rev. 5 – families SC, AC, CA, CM
• Benchmarks – CIS Network Devices Benchmark

Refer to `ISO27001_Mapping.md` and `Multi_Framework_Mapping.md` for the complete mapping tables.

11. Appendices

Appendix A: Related Standards

Government Server Security Hardening Standards. Malawi Government IAM Standards. Malawi Government Incident Response Standards. Malawi Government Monitoring and Observability Standards. Malawi Government Endpoint and Mobile Device Security Standards.

Appendix B: Control and Legal Mapping

• Appendix C: Evidence and Artifact Checklist
• Architecture: Network and data flow diagrams; zone definitions; firewall rule base with business justification.
• Policy review: Evidence of annual (or more frequent) firewall rule review; IDS/IPS coverage for critical and internet-facing segments.
• Monitoring: Evidence that network alerts are integrated with incident response; exception register with requirement, justification, compensating controls, and review/expiry dates.
• Appendix D: Templates (Minimum)

D.1 Firewall Rule Documentation (Template)

• Rule identifier
• Source zone/IPs/users
• Destination zone/IPs/service
• Port/protocol
• Business justification and owner
• Change record ID and approval
• Expiry/review date
• Logging requirement (yes/no) and monitoring notes

References

Government Server Security Hardening Standards.

NIST SP 800-41, Guidelines on Firewalls and Firewall Policy.

NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (SC-7, SC-5).

CIS Benchmarks (network devices).

DoD STIGs (network devices).

Electronic Transactions and Cybersecurity Act (2016) (Malawi).

Data Protection Act No. 3 of 2024 (Malawi).