How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached.

In April 2019, there were 140 new security vulnerabilities identified by the Zero Day Initiative (ZDI). Additionally, AV-TEST, an independent research institute for IT security, reports it identifies more than 350,000 malware programs every day. Security teams today are simply overwhelmed by the volume and variety of attacks on enterprise networks, applications, and data.

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached. Rather than trying to keep ahead of an infinite number of threats and vulnerabilities, enterprises should focus on hardening their network environments and controlling something far more finite – access. Controlling access into the network, on the network, and between applications, hosts, and services is accomplished through microsegmentation. Microsegmentation can be further strengthened with zero trust.

Zero trust is a cybersecurity concept based on the principle that organizations should not automatically trust anything on the network. Instead, the internal network should be treated like the internet—rife with cyber threats. A zero trust methodology requires organizations to verify all applications, workloads, hosts, devices, and processes before access and permission to communicate are granted.

Considering the foundation of zero trust and its intended purpose, it makes perfect sense to couple it with microsegmentation. Microsegmentation creates secure micro-perimeters directly around organizations’ most sensitive data and applications. By creating “secure zones” tied to the identity of communicating assets, microsegmentation adds a layer of protection on the internal network which prevents unauthorized access. Microsegmentation built on zero trust further hardens network controls because no communication is trusted until it’s verified. Controlling east-west access through microsegmentation and zero trust is an extremely effective prevention strategy against modern-day threats, especially considering the “not if, but when” cyber attack theory held by most organizations. Protecting the network from external threats isn’t enough; microsegmentation gives organizations a way to protect applications and services by eliminating the unfettered communication allowed on flat (i.e., un-segmented) networks.

Historically, microsegmentation has been a complex, expensive, and lengthy process. Most traditional microsegmentation solutions repurpose firewalls, which, while they serve an important purpose in perimeter protection, are unsuited for controlling lateral movement within the network. Firewalls rely on trusted IP addresses, which change frequently in auto-scaling networks. As a result, policies need to be constantly updated, and any changes that are missed can leave critical data and applications vulnerable to exploit.

The new way – reducing the network attack surface

Microsegmentation gives organizations an auditable way to isolate workloads and secure them individually. Before microsegmentation can be implemented, however, a network map that visiualizes the number of open communication pathways between network resources must be created. Using automation, companies can quickly see the thousands upon thousands of potential communication paths between applications, workloads, and data sources. The vast majority of these paths are unnecessary for normal business operations and only serve to increase the attack surface area.

The key to creating an effective microsegmentation plan is shutting down unnecessary pathways and leaving open only the ones necessary for operation. Reducing the number of pathways gives the organization the ability to restrict access and reduce the potential avenues of attack to a manageable volume.

Once the organization has mapped the network and removed unnecessary attack surface, it can start to build segments of data, applications, or workloads based on business requirements. These “collections” are protected by policies determined by the identities of communicating entities. As opposed to traditional microsegmentation that repurposes firewalls and uses IP addresses as its primary control mechanism, modern — and effective — microsegmentation divorces the control plane away from the network.

Because today’s cloud and container networks are dynamic and auto-scaling, the only way to ensure consistent, manageable protection for business-critical applications is to move the control plane to what’s communicating instead of how it’s communicating. This way, when the underlying network changes, policies remain enforced. Identity-based microsegmentation provides gap-free coverage and ensures that only applications and services verified through zero trust-controls are communicating on the network. This means that, regardless of the volume and variety of vulnerabilities and threats against enterprise networks, applications, and data, companies can be certain cyber attacks are prevented from causing a breach.

The five most common threats

Once deployed, zero trust- and identity-based microsegmentation can help security teams defend against five of the most common types of threats:

● Nation-state attacks

● Advanced persistent threats (APTs)

● Ransomware

● Misconfigurations

● Malicious insiders

The first three types are essentially three different flavors of the same attack. It is commonly assumed that many of the recent high-profile ransomware attacks have been backed by nation-state bad actors. As with any APT, the attackers will relentlessly probe a targeted network and eventually gain entry, typically through the first compromised host. They then patiently "live off the land" using administrative tools already on the system or elevated permissions via stolen credentials to infiltrate deeper and infect more hosts on the network.

In the case of misconfiguration, the zero trust approach to security prevents a careless mistake from turning into a costly data exposure. Because modern microsegmentation policies are based on an analysis of actual network traffic, it is a "catch-of-last-resort" for misconfiguration of infrastructure, servers, and workloads, preventing anomalous communications.

As for insider threats, just as zero trust prevents anomalous network traffic caused by human error, it also prevents anomalous traffic caused by human malfeasance.

Cybersecurity threats such as nation-state attacks, APTs, ransomware, misconfigurations, and malicious insiders are not to be taken lightly. They can inflict enormous damage on organizations. However, with microsegmentation and a zero trust approach, companies can prevent unauthorized software (such as malware) from communicating on the network, restrict access to critical applications to only the verified resources requesting access, and reduce the network attack surface without adding complexity. While traditional microsegmentation has historically provided little provable ROI, zero trust, identity-based microsegmentation is easy to implement and manage, and it delivers immediate, demonstrable results. Modern microsegmentation doesn’t just eliminate flat networks by adding a layer of protection directly around applications. It removes the reliance on the network elements — which are unstable and unreliable in cloud and containers — and guarantees that cyber criminals can’t cause a breach.

Featured

  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.