How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

How Organizations Can Leverage Microsegmentation to Create a Zero Trust Environment

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached.

In April 2019, there were 140 new security vulnerabilities identified by the Zero Day Initiative (ZDI). Additionally, AV-TEST, an independent research institute for IT security, reports it identifies more than 350,000 malware programs every day. Security teams today are simply overwhelmed by the volume and variety of attacks on enterprise networks, applications, and data.

No matter how good an organization’s perimeter defenses and threat detection systems are, it really is just a matter of when it will get breached. Rather than trying to keep ahead of an infinite number of threats and vulnerabilities, enterprises should focus on hardening their network environments and controlling something far more finite – access. Controlling access into the network, on the network, and between applications, hosts, and services is accomplished through microsegmentation. Microsegmentation can be further strengthened with zero trust.

Zero trust is a cybersecurity concept based on the principle that organizations should not automatically trust anything on the network. Instead, the internal network should be treated like the internet—rife with cyber threats. A zero trust methodology requires organizations to verify all applications, workloads, hosts, devices, and processes before access and permission to communicate are granted.

Considering the foundation of zero trust and its intended purpose, it makes perfect sense to couple it with microsegmentation. Microsegmentation creates secure micro-perimeters directly around organizations’ most sensitive data and applications. By creating “secure zones” tied to the identity of communicating assets, microsegmentation adds a layer of protection on the internal network which prevents unauthorized access. Microsegmentation built on zero trust further hardens network controls because no communication is trusted until it’s verified. Controlling east-west access through microsegmentation and zero trust is an extremely effective prevention strategy against modern-day threats, especially considering the “not if, but when” cyber attack theory held by most organizations. Protecting the network from external threats isn’t enough; microsegmentation gives organizations a way to protect applications and services by eliminating the unfettered communication allowed on flat (i.e., un-segmented) networks.

Historically, microsegmentation has been a complex, expensive, and lengthy process. Most traditional microsegmentation solutions repurpose firewalls, which, while they serve an important purpose in perimeter protection, are unsuited for controlling lateral movement within the network. Firewalls rely on trusted IP addresses, which change frequently in auto-scaling networks. As a result, policies need to be constantly updated, and any changes that are missed can leave critical data and applications vulnerable to exploit.

The new way – reducing the network attack surface

Microsegmentation gives organizations an auditable way to isolate workloads and secure them individually. Before microsegmentation can be implemented, however, a network map that visiualizes the number of open communication pathways between network resources must be created. Using automation, companies can quickly see the thousands upon thousands of potential communication paths between applications, workloads, and data sources. The vast majority of these paths are unnecessary for normal business operations and only serve to increase the attack surface area.

The key to creating an effective microsegmentation plan is shutting down unnecessary pathways and leaving open only the ones necessary for operation. Reducing the number of pathways gives the organization the ability to restrict access and reduce the potential avenues of attack to a manageable volume.

Once the organization has mapped the network and removed unnecessary attack surface, it can start to build segments of data, applications, or workloads based on business requirements. These “collections” are protected by policies determined by the identities of communicating entities. As opposed to traditional microsegmentation that repurposes firewalls and uses IP addresses as its primary control mechanism, modern — and effective — microsegmentation divorces the control plane away from the network.

Because today’s cloud and container networks are dynamic and auto-scaling, the only way to ensure consistent, manageable protection for business-critical applications is to move the control plane to what’s communicating instead of how it’s communicating. This way, when the underlying network changes, policies remain enforced. Identity-based microsegmentation provides gap-free coverage and ensures that only applications and services verified through zero trust-controls are communicating on the network. This means that, regardless of the volume and variety of vulnerabilities and threats against enterprise networks, applications, and data, companies can be certain cyber attacks are prevented from causing a breach.

The five most common threats

Once deployed, zero trust- and identity-based microsegmentation can help security teams defend against five of the most common types of threats:

● Nation-state attacks

● Advanced persistent threats (APTs)

● Ransomware

● Misconfigurations

● Malicious insiders

The first three types are essentially three different flavors of the same attack. It is commonly assumed that many of the recent high-profile ransomware attacks have been backed by nation-state bad actors. As with any APT, the attackers will relentlessly probe a targeted network and eventually gain entry, typically through the first compromised host. They then patiently "live off the land" using administrative tools already on the system or elevated permissions via stolen credentials to infiltrate deeper and infect more hosts on the network.

In the case of misconfiguration, the zero trust approach to security prevents a careless mistake from turning into a costly data exposure. Because modern microsegmentation policies are based on an analysis of actual network traffic, it is a "catch-of-last-resort" for misconfiguration of infrastructure, servers, and workloads, preventing anomalous communications.

As for insider threats, just as zero trust prevents anomalous network traffic caused by human error, it also prevents anomalous traffic caused by human malfeasance.

Cybersecurity threats such as nation-state attacks, APTs, ransomware, misconfigurations, and malicious insiders are not to be taken lightly. They can inflict enormous damage on organizations. However, with microsegmentation and a zero trust approach, companies can prevent unauthorized software (such as malware) from communicating on the network, restrict access to critical applications to only the verified resources requesting access, and reduce the network attack surface without adding complexity. While traditional microsegmentation has historically provided little provable ROI, zero trust, identity-based microsegmentation is easy to implement and manage, and it delivers immediate, demonstrable results. Modern microsegmentation doesn’t just eliminate flat networks by adding a layer of protection directly around applications. It removes the reliance on the network elements — which are unstable and unreliable in cloud and containers — and guarantees that cyber criminals can’t cause a breach.

Featured

  • The Need for a Comprehensive Strategy Addressing Cybersecurity and Quantum Technology

    The Need for a Comprehensive Strategy Addressing Cybersecurity and Quantum Technology

    Over the past two years, the Biden Administration has taken a series of steps centered on quantum and cybersecurity. Read Now

  • IoT Saves the Day

    IoT Saves the Day

    Today, creating a safe environment across schools, hotels, office buildings, housing complexes and other facilities has become a necessity. There are so many dangers lurking in buildings of all sizes and shapes from fire hazards, vaping issues, chemical/air quality issues, intruders and so much more. Read Now

  • One Pane, Less Pain

    One Pane, Less Pain

    Just because a solution is built on an open-standards platform doesn’t ensure that all the vendors’ systems will work together as promised. Some features may not be supported, or not supported to their fullest potential. Read Now

  • Revamping Wrigley Field

    Revamping Wrigley Field

    When talking about baseball in the United States, it’s hard not to think of the Chicago Cubs and Wrigley Field. With a history spanning more than 100 years, the Chicago Cubs are one of the most recognized teams in professional sports. Read Now

Featured Cybersecurity

Webinars

New Products

  • Videoloft Cloud Video Surveillance VSaaS Solution

    Videoloft Cloud Video Surveillance VSaaS Solution

    Videoloft focuses on transforming traditional professional surveillance systems into cloud connected solutions via the Videoloft Cloud Adapter. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3