D3fend Isolate

D3FEND — Isolate

When to Use

• Implementing access mediation (network, file, web session, physical)
• Configuring content filtering and validation (format, metadata, magic bytes)
• Isolating execution (process sandboxing, allowlisting, denylisting)
• Segmenting networks (VLANs, micro-segmentation, broadcast isolation)
• Managing DNS/IP allowlists and denylists
• Setting system call filtering and I/O port restrictions

When NOT to Use

• Building detection rules or monitoring → d3fend-detect
• System hardening or encryption → d3fend-harden
• Honeypots or deception → d3fend-deceive
• Network architecture design → infrastructure-engineer
• Zero-trust implementation → cybersecurity

Core Workflows

1. Access Mediation

See `references/access_mediation.md`

2. Content Filtering & Validation

• Content filtering (email, web, DLP)
• Content modification, excision, rebuild, substitution
• Format verification (magic bytes, metadata, internal structure)
• Decompression checking and quarantine

See `references/content_filtering.md`

3. Execution Isolation

• Application-based process isolation (containers, app sandbox)
• Kernel-based isolation (seccomp, namespaces, cgroups)
• Hardware-based isolation (TEE, TPM, enclaves)
• Executable allowlisting and denylisting

See `references/execution_isolation.md`

4. Network Isolation

• Broadcast domain isolation (VLANs, private VLANs)
• Directional network links (one-way gateways)
• DNS/IP allowlisting and denylisting
• Encrypted tunnels (VPN, TLS, IPsec)
• Traffic filtering (inbound, outbound, email)

See `references/network_isolation.md`

When to load references

• Access mediation → references/access_mediation.md
• Content filtering → references/content_filtering.md
• Execution isolation → references/execution_isolation.md
• Network isolation → references/network_isolation.md

Access Mediation

Technique Coverage

Implementation

Network Access Control

802.1X: Port-based auth (device + user)
NAC: Posture checking before access
Zero Trust: Verify every request, assume breach

System Call Filtering

Linux: seccomp, seccomp-bpf
Containers: Docker default seccomp profile
Custom: Allowlist only required syscalls

Access Policy Administration

Physical Controls

Content Filtering & Validation

Technique Coverage

Filtering Layers

File Validation

def validate_file(upload):
    # Magic bytes
    if not magic_bytes_match(upload, declared_type):
        reject("Magic bytes mismatch")
    
    # Metadata consistency
    if metadata_inconsistent(upload):
        reject("Metadata inconsistency")
    
    # Decompression check
    if is_archive(upload) and not valid_archive(upload):
        reject("Invalid archive")
    
    # Quarantine for deep inspection
    return quarantine(upload)

Content Modification

Execution Isolation

Technique Coverage

Isolation Methods

Application-based

Containers: Docker, containerd
Sandbox: Chrome sandbox, Firejail
App containers: Windows AppContainer

Kernel-based

Hardware-based

Allowlisting

Default deny: Only approved executables run
Paths: C:\Program Files\*, /opt/approved/
Validation: Hash or signature check
Update: Through managed deployment

Denylisting

Antivirus signatures
Known malware hashes
User-reported bad files

Network Isolation

Technique Coverage

Segmentation Strategies

VLAN Segmentation

VLAN 10: Management (restricted access)
VLAN 20: Production servers
VLAN 30: Development
VLAN 40: Guest (internet only)
VLAN 50: IoT (isolated, monitored)

Micro-segmentation

Per-workload policies: Allow only required flows
Implementation: Host-based firewall, SDN, service mesh
Example: App A → DB B only, all else denied

DNS Controls

Traffic Filtering

Encrypted Tunnels