This is part of a series of articles about IT Mapping
Microsegmentation is a network security technique designed to improve the security posture of enterprise networks. The idea behind microsegmentation is to segment the enterprise cloud based on workloads. This type of logical breakdown of workloads allows companies to define appropriate data security policies, security services, and data management based on the use cases and needs of each workload.
The microsegmentation methodology can classify the segments in different ways. Techniques include segmentation by application, environment, process, and user. Different enterprises can choose different angles for the segmentation based on their needs and the dominant approaches within their organization. (This is part of an extensive series of guides about information security.)
The Importance of Microsegmentation Today
With the move from monolithic development environments to API and microservices environments, enterprises are experiencing different forms of security vulnerabilities. As a result, microsegmentation is coming into play as one potential way to address security concerns in the more complex architectures most relevant today.
Zero Trust Security for Complex Network Architecture
Microsegmentation has been gaining momentum alongside the “zero trust” approach to data security. As hybrid and multi-cloud solutions have come to dominate enterprise cloud, companies recognize that they need a security approach that goes beyond perimeter security. Multi-cloud and hybrid cloud architectures add complexity to the network, and management becomes cumbersome.
Much of the software used in enterprise networks is not developed within the network. Today, enterprises rely on open-source code adapted to the organization, third-party APIs, and SaaS implementations. Microservices and API-based architectures open up new vulnerabilities as the microservices open up API interfaces that can potentially be exploited. As a result, it is important to implement security policies that respond to the complex and challenging reality of multiple, integrated software sources.
Remote Work: Adding to Network Complexity
Since the start of the COVID-19 pandemic, a substantial proportion of companies have moved to remote working environments or combined remote and on-site policies. Having employees working from around the world—whether in a coworking space, home, or a public space—adds another layer of uncertainty in terms of “internal” versus “external” threats. Adding another layer to this complexity, companies frequently work with contractors who have their own security policies. Microsegmentation provides a framework to address the security complications that can emerge with remote workforces.
Microsegmentation for Lateral Data Protection
The combination of hybrid networks, multiple software sources, and a remote workforce has broken apart the concept of “internal” versus “external” software and data. As a result, many companies are highlighting lateral data protection, also known as east-west data protection. Microsegmentation provides a framework for improving network security and zero-trust security policies.
How Microsegmentation Works
Microsegmentation works by identifying segments in a logical way. Rather than looking at a specific data center, server, or hyperscaler, microsegmentation identifies data flows and functional segments of an enterprise’s operations.
When implemented effectively, microsegmentation creates protected areas within the data centers or across data centers. These protected areas represent a specific function, application, or group that can be trusted internally. Each one of these microsegments is isolated from other areas of the data center, which means that if malware affects one area of the data center, the contagion is limited to that specific microsegment. By containing a threat, microsegmentation provides a safer overall enterprise environment, minimizing the potential damage that can be done by any one breach of security.
To illustrate how microsegmentation works, it can be helpful to examine the four subcategories of this practice, each of which presents different benefits and shortcomings.
Environment-Based Microsegmentation
Environment-based microsegmentation focuses on where the data is stored and access to the network. The environment-based approach differentiates between development, testing, and production environments. It can be quick to implement, using data management tools that identify the types of data stored in each environment. The downside of environment-based microsegmentation is that it doesn’t consider the actual workflows. Also, it doesn’t identify the software or API accessing the different network segments, so it provides less protection than application-level segmentation (discussed below). Finally, environment-based microsegmentation is static and requires more maintenance overhead compared to other microsegmentation approaches as business processes change.
User-Based Microsegmentation
User-based segmentation focuses on the endpoints to delineate workflow behavior. Microsegmentation based on users can be easier to implement because it does not require any infrastructure changes. However, it does not provide the highest level of protection because of the potential for infiltration to a user’s account, and situations in which an employee or contractor takes malicious action. User-based microsegmentation may also fail to identify cases where a user is regularly accessing data they don’t actually need, because security protocols generally work based on anomalies, which may not be obvious when analyzed on the basis of a particular user’s activity.
Application-Based Microsegmentation
Application-based microsegmentation focuses on the application, which means that the segment includes the data and services used by a particular application. To identify application flows, tools such as network sniffing can follow the logic of how the data flows within an application, including the ways in which the application accesses data from other services. Generally, application-level segmentation focuses on the applications which have the most exposure to sensitive data.
A more granular approach is application tier-level segmentation, which divides workflows by roles, separating tiers such as web apps, load balancer, data, and APIs. This approach passes only the minimum required data between microsegments.
Instead of using IP addresses and VLAN affiliations, microsegmentation tags the resources that host the workloads and applications. When applications are updated, policy changes are automatically propagated across the different resources serving those applications, instead of needing to be implemented on a location-based individual basis.
Nanosegmentation
The most granular form of microsegmentation is process-based nanosegmentation, which segments based on the processes within workloads. This level of segmentation is generally applied only to the most sensitive applications within a network. More information can be found in microsegmentation guide and our beginner’s guide to microsegmentation as well as our answer to “What is SNMP?“.
The Benefits of Microsegmentation
The security benefits of microsegmentation cover a large variety of potential problems that enterprises face today.
Cloud Workload Protection
Each workload is protected, using workflow-specific policies and controls that determine which data can be accessed and input into the workflow.
APT Defense
Sophisticated ongoing threats, known as advanced persistent threats (APT) often exploit small vulnerabilities in one area of the system in order to gain access to other areas of the network. By creating barriers between different areas, security teams reduce the amount of damage from APTs.
Improved Compliance
Microsegmentation forces better understanding and documentation of data flows, improving compliance with security standards. Microsegmentation provides risk analysis, as well as automated and auditable processes across the entire network.
Environment Separation
With microsegmentation, an organization can easily separate between testing, development, and production environments, even when they are hosted in the same cloud.
Simplified Security
Isolation of threats and careful assessment of data flows boosts a security team’s ability to understand the overall security posture. This facilitates the implementation of appropriate security policies for each type of application, environment, and function in the organization. Security teams can create templates that can be applied across similar applications; updating a template will update all of the relevant segmentations. You can also check SSL certificates more easily.
Secure Application Access
Both internal and external customers can feel confident that each application is secure and accepts only appropriate inputs to the system.
Breach Containment
In cases where an attacker finds a vulnerability within an enterprise’s software, microsegmentation limits the damage that can be done to the specific segment. Rather than assuming internal traffic is by nature safe, microsegmentation limits the lateral movement of users and data requests.
Simplified Policy Management
Security policies need to be strict enough to prevent attacks, but lenient enough to ensure efficient business workflows. Segmentation based on workflows enables policy management with an appropriate balance for each workflow.
Reduced Attack Surface
With every microsegment adding its own layer of security, the overall attack surface of an enterprise is significantly reduced.
Transparency of Network Flows
Microsegmentation makes network flows visible. Segmentation itself can bring to light potential vulnerabilities and indicate if the flows differ from expected behaviors. See VMware networking basics and network address translation for more information on those topics.
Flexibility
As a software-based approach, microsegmentation enables adjustment over time. Because the initial segmentation is based on workflows, business changes are less likely to alter the nature of the inputs and outputs to workflows, so microsegments may need less adjustment than other types of security implementations.
The Challenges of Microsegmentation
Microsegmentation offers powerful benefits, but comes with its share of drawbacks and implementation tradeoffs. The first challenge consists of mapping the communications flows for each application and user to be segmented. Documentation of these processes requires heavy lifting in the form of expertise, time, and money—which is why most companies turn to automated tools for mapping their communications flows.
When setting up the microsegments, more granular segmentation takes more time to implement but provides better security. High levels of microsegmentation can require specific security policies on a per-user or per-device basis, which is not just time consuming, but can lead to internal resistance or debates about departments’ capabilities and roles assigned to people. If poorly implemented, employees may be impaired in their ability to do their job due to restrictions on their access to company resources.
Some teams will discover compatibility issues if segmentation needs are difficult to impose on the existing infrastructure. In such a case, implementation may also include some form of cloud migration. Even for networks that are well-suited for microsegmentations, reconfiguration and architecture changes on the network takes a large amount of time and effort. Needless to say, re-architecting and configuring the network comes with implementation costs.
Finally, microsegmentation increases network complexity. By definition, the security team will be dealing with a large number of security policies applied to different applications, users, and environments. With this increased complexity come increased overheads. Improved security and transparency can lower overall costs once microsegmentation is fully implemented, but there may be an initial period of adjustment before the savings are seen.
Applications of Microsegmentation
The most obvious and straightforward implementation of microsegmentation is the creation of separate segments for development, testing, staging, and production systems in software development environments. At the development stage, software can be more vulnerable to attack compared to software that has been deployed and battle tested. Separating these systems creates a clean environment for the live software.
Another area where segmentation is useful is in identifying and differentiating from one another sensitive materials (soft assets), such as customer data, financial data, and intellectual property. Companies moving towards microsegmentation should start by identifying the most tempting processes for malicious actors, and setting up the security policies for the relevant workflows that handle sensitive data.
Network microsegmentation offers a boost for any hybrid cloud environment by creating a more logical representation of how the cloud is being used, rather than visualizing based on vendors and the location of the clouds. Applications typically access multiple cloud resources and data centers. Setting security policies based on an application-oriented microsegmentation mapping is an effective way to implement a uniform policy across multiple environments, based on the actual usage of the data. This type of policy improves the efficiency of the company by implementing more stringent policies only where they are necessary.
Network Architecture Mapping Made Easy
The first step in microsegmentation is mapping your network as it is today both on premise and in the cloud with agentless technology. Faddom makes this process painless with automated network mapping. Just start a free trial today!
Learn More About Microsegmentation
How Network Microsegmentation Can Protect Data Centers
Cloud migration comes with challenges, but sound strategy and planning will help overcome these obstacles in order to reap the benefits.
Read more: How Network Microsegmentation Can Protect Data Centers
A Beginner’s Guide to Network Microsegmentation
Those who might move to the cloud must start with full visibility of their applications and dependencies to get it right the first time.
Read more: A Beginners Guide to Network Microsegmentation
A Beginner’s Guide to Understanding Microsegmentation
Let’s take the complexity out of application migration. Here’s common approaches, and the application migration that they suit.
Read more: A Beginner’s Guide to Understanding Microsegmentation
What is SNMP?
Cloud implementation gives your organization an edge. Moving workload from on-premises to cloud is convenient and cost-effective.
Read more: What is SNMP?
How to Check SSL Certificates on Servers
What Is data center migration? Learn about the benefits, types of migrations, and best practices for migrating to a new data center.
Read more: How to Check SSL Certificates on Servers
VMware Networking Basics
Cloud trends to look out for in 2023: What you need to know about cloud computing, technology adoption, and market trends.
Read more: VMware Networking Basics
An Introduction to Network Address Translation
Migrating data between locations or applications? Here’s what you need to think about when starting a new data center migration project.
Read more: An Introduction to Network Address Translation
See Our Additional Guides on Key Information Security Topics
Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of information security.
User Management
Authored by Frontegg
Information Security Core Concepts
Authored by Exabeam
Disaster Recovery Guide
Authored by Cloudian
