How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached.

• By Tom Hickman
• Jun 06, 2019

In April 2019, there were 140 new security vulnerabilities identified by the Zero Day Initiative (ZDI). Additionally, AV-TEST, an independent research institute for IT security, reports it identifies more than 350,000 malware programs every day. Security teams today are simply overwhelmed by the volume and variety of attacks on enterprise networks, applications, and data.

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached. Rather than trying to keep ahead of an infinite number of threats and vulnerabilities, enterprises should focus on hardening their network environments and controlling something far more finite – access. Controlling access into the network, on the network, and between applications, hosts, and services is accomplished through microsegmentation. Microsegmentation can be further strengthened with zero trust.

Zero trust is a cybersecurity concept based on the principle that organizations should not automatically trust anything on the network. Instead, the internal network should be treated like the internet—rife with cyber threats. A zero trust methodology requires organizations to verify all applications, workloads, hosts, devices, and processes before access and permission to communicate are granted.

Considering the foundation of zero trust and its intended purpose, it makes perfect sense to couple it with microsegmentation. Microsegmentation creates secure micro-perimeters directly around organizations’ most sensitive data and applications. By creating “secure zones” tied to the identity of communicating assets, microsegmentation adds a layer of protection on the internal network which prevents unauthorized access. Microsegmentation built on zero trust further hardens network controls because no communication is trusted until it’s verified. Controlling east-west access through microsegmentation and zero trust is an extremely effective prevention strategy against modern-day threats, especially considering the “not if, but when” cyber attack theory held by most organizations. Protecting the network from external threats isn’t enough; microsegmentation gives organizations a way to protect applications and services by eliminating the unfettered communication allowed on flat (i.e., un-segmented) networks.

Historically, microsegmentation has been a complex, expensive, and lengthy process. Most traditional microsegmentation solutions repurpose firewalls, which, while they serve an important purpose in perimeter protection, are unsuited for controlling lateral movement within the network. Firewalls rely on trusted IP addresses, which change frequently in auto-scaling networks. As a result, policies need to be constantly updated, and any changes that are missed can leave critical data and applications vulnerable to exploit.

The new way – reducing the network attack surface

Microsegmentation gives organizations an auditable way to isolate workloads and secure them individually. Before microsegmentation can be implemented, however, a network map that visiualizes the number of open communication pathways between network resources must be created. Using automation, companies can quickly see the thousands upon thousands of potential communication paths between applications, workloads, and data sources. The vast majority of these paths are unnecessary for normal business operations and only serve to increase the attack surface area.

The key to creating an effective microsegmentation plan is shutting down unnecessary pathways and leaving open only the ones necessary for operation. Reducing the number of pathways gives the organization the ability to restrict access and reduce the potential avenues of attack to a manageable volume.

Once the organization has mapped the network and removed unnecessary attack surface, it can start to build segments of data, applications, or workloads based on business requirements. These “collections” are protected by policies determined by the identities of communicating entities. As opposed to traditional microsegmentation that repurposes firewalls and uses IP addresses as its primary control mechanism, modern — and effective — microsegmentation divorces the control plane away from the network.

Because today’s cloud and container networks are dynamic and auto-scaling, the only way to ensure consistent, manageable protection for business-critical applications is to move the control plane to what’s communicating instead of how it’s communicating. This way, when the underlying network changes, policies remain enforced. Identity-based microsegmentation provides gap-free coverage and ensures that only applications and services verified through zero trust-controls are communicating on the network. This means that, regardless of the volume and variety of vulnerabilities and threats against enterprise networks, applications, and data, companies can be certain cyber attacks are prevented from causing a breach.

The five most common threats

Once deployed, zero trust- and identity-based microsegmentation can help security teams defend against five of the most common types of threats:

● Nation-state attacks

● Advanced persistent threats (APTs)

● Ransomware

● Misconfigurations

● Malicious insiders

The first three types are essentially three different flavors of the same attack. It is commonly assumed that many of the recent high-profile ransomware attacks have been backed by nation-state bad actors. As with any APT, the attackers will relentlessly probe a targeted network and eventually gain entry, typically through the first compromised host. They then patiently "live off the land" using administrative tools already on the system or elevated permissions via stolen credentials to infiltrate deeper and infect more hosts on the network.

In the case of misconfiguration, the zero trust approach to security prevents a careless mistake from turning into a costly data exposure. Because modern microsegmentation policies are based on an analysis of actual network traffic, it is a "catch-of-last-resort" for misconfiguration of infrastructure, servers, and workloads, preventing anomalous communications.

As for insider threats, just as zero trust prevents anomalous network traffic caused by human error, it also prevents anomalous traffic caused by human malfeasance.

Cybersecurity threats such as nation-state attacks, APTs, ransomware, misconfigurations, and malicious insiders are not to be taken lightly. They can inflict enormous damage on organizations. However, with microsegmentation and a zero trust approach, companies can prevent unauthorized software (such as malware) from communicating on the network, restrict access to critical applications to only the verified resources requesting access, and reduce the network attack surface without adding complexity. While traditional microsegmentation has historically provided little provable ROI, zero trust, identity-based microsegmentation is easy to implement and manage, and it delivers immediate, demonstrable results. Modern microsegmentation doesn’t just eliminate flat networks by adding a layer of protection directly around applications. It removes the reliance on the network elements — which are unstable and unreliable in cloud and containers — and guarantees that cyber criminals can’t cause a breach.