How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached.

In April 2019, there were 140 new security vulnerabilities identified by the Zero Day Initiative (ZDI). Additionally, AV-TEST, an independent research institute for IT security, reports it identifies more than 350,000 malware programs every day. Security teams today are simply overwhelmed by the volume and variety of attacks on enterprise networks, applications, and data.

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached. Rather than trying to keep ahead of an infinite number of threats and vulnerabilities, enterprises should focus on hardening their network environments and controlling something far more finite – access. Controlling access into the network, on the network, and between applications, hosts, and services is accomplished through microsegmentation. Microsegmentation can be further strengthened with zero trust.

Zero trust is a cybersecurity concept based on the principle that organizations should not automatically trust anything on the network. Instead, the internal network should be treated like the internet—rife with cyber threats. A zero trust methodology requires organizations to verify all applications, workloads, hosts, devices, and processes before access and permission to communicate are granted.

Considering the foundation of zero trust and its intended purpose, it makes perfect sense to couple it with microsegmentation. Microsegmentation creates secure micro-perimeters directly around organizations’ most sensitive data and applications. By creating “secure zones” tied to the identity of communicating assets, microsegmentation adds a layer of protection on the internal network which prevents unauthorized access. Microsegmentation built on zero trust further hardens network controls because no communication is trusted until it’s verified. Controlling east-west access through microsegmentation and zero trust is an extremely effective prevention strategy against modern-day threats, especially considering the “not if, but when” cyber attack theory held by most organizations. Protecting the network from external threats isn’t enough; microsegmentation gives organizations a way to protect applications and services by eliminating the unfettered communication allowed on flat (i.e., un-segmented) networks.

Historically, microsegmentation has been a complex, expensive, and lengthy process. Most traditional microsegmentation solutions repurpose firewalls, which, while they serve an important purpose in perimeter protection, are unsuited for controlling lateral movement within the network. Firewalls rely on trusted IP addresses, which change frequently in auto-scaling networks. As a result, policies need to be constantly updated, and any changes that are missed can leave critical data and applications vulnerable to exploit.

The new way – reducing the network attack surface

Microsegmentation gives organizations an auditable way to isolate workloads and secure them individually. Before microsegmentation can be implemented, however, a network map that visiualizes the number of open communication pathways between network resources must be created. Using automation, companies can quickly see the thousands upon thousands of potential communication paths between applications, workloads, and data sources. The vast majority of these paths are unnecessary for normal business operations and only serve to increase the attack surface area.

The key to creating an effective microsegmentation plan is shutting down unnecessary pathways and leaving open only the ones necessary for operation. Reducing the number of pathways gives the organization the ability to restrict access and reduce the potential avenues of attack to a manageable volume.

Once the organization has mapped the network and removed unnecessary attack surface, it can start to build segments of data, applications, or workloads based on business requirements. These “collections” are protected by policies determined by the identities of communicating entities. As opposed to traditional microsegmentation that repurposes firewalls and uses IP addresses as its primary control mechanism, modern — and effective — microsegmentation divorces the control plane away from the network.

Because today’s cloud and container networks are dynamic and auto-scaling, the only way to ensure consistent, manageable protection for business-critical applications is to move the control plane to what’s communicating instead of how it’s communicating. This way, when the underlying network changes, policies remain enforced. Identity-based microsegmentation provides gap-free coverage and ensures that only applications and services verified through zero trust-controls are communicating on the network. This means that, regardless of the volume and variety of vulnerabilities and threats against enterprise networks, applications, and data, companies can be certain cyber attacks are prevented from causing a breach.

The five most common threats

Once deployed, zero trust- and identity-based microsegmentation can help security teams defend against five of the most common types of threats:

● Nation-state attacks

● Advanced persistent threats (APTs)

● Ransomware

● Misconfigurations

● Malicious insiders

The first three types are essentially three different flavors of the same attack. It is commonly assumed that many of the recent high-profile ransomware attacks have been backed by nation-state bad actors. As with any APT, the attackers will relentlessly probe a targeted network and eventually gain entry, typically through the first compromised host. They then patiently "live off the land" using administrative tools already on the system or elevated permissions via stolen credentials to infiltrate deeper and infect more hosts on the network.

In the case of misconfiguration, the zero trust approach to security prevents a careless mistake from turning into a costly data exposure. Because modern microsegmentation policies are based on an analysis of actual network traffic, it is a "catch-of-last-resort" for misconfiguration of infrastructure, servers, and workloads, preventing anomalous communications.

As for insider threats, just as zero trust prevents anomalous network traffic caused by human error, it also prevents anomalous traffic caused by human malfeasance.

Cybersecurity threats such as nation-state attacks, APTs, ransomware, misconfigurations, and malicious insiders are not to be taken lightly. They can inflict enormous damage on organizations. However, with microsegmentation and a zero trust approach, companies can prevent unauthorized software (such as malware) from communicating on the network, restrict access to critical applications to only the verified resources requesting access, and reduce the network attack surface without adding complexity. While traditional microsegmentation has historically provided little provable ROI, zero trust, identity-based microsegmentation is easy to implement and manage, and it delivers immediate, demonstrable results. Modern microsegmentation doesn’t just eliminate flat networks by adding a layer of protection directly around applications. It removes the reliance on the network elements — which are unstable and unreliable in cloud and containers — and guarantees that cyber criminals can’t cause a breach.

Featured

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

  • ISC West Announces Keynote Lineup

    ISC West, in collaboration with premier sponsor the Security Industry Association (SIA), announced this year’s dynamic trio of speakers that will headline the Keynote Series at ISC West 2024. Read Now

    • Industry Events
  • Government is Top Targeted Industry for DDoS Attacks in Q4 2023

    The government sector experienced a surge of DDoS attacks in Q4 according to Lumen Technologies (NYSE: LUMN), a global leader in integrated network and cybersecurity solutions. The Lumen Quarterly DDoS & Application Threat Report for Q4 2023 analyzes data from its DDoS mitigation platform and application protection partner, ThreatX, to provide an overview of the DDoS and application-layer attacks that targeted organizations in the last quarter of 2023. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3