Security experts continue to promote micro-segmentation as an essential tool for risk reduction in hybrid cloud environments. If you’re ready to make 2019 the year you get your micro-segmentation journey off the ground, make sure you can identify the roadblocks you should be looking to avoid.
The irreversible movement of critical workloads into virtualized, hybrid cloud environments demands new security solutions that go further than traditional firewalls or endpoint controls. Audits and industry compliance requirements make it an imperative. News stories of the continued fallout of data center breaches in which attackers have caused severe brand and monetary damage, such as the Equifax breach, make it even more important to move to the top of your to-do list.
East-west data center traffic now accounts for most enterprise traffic — and has been said to “dwarf traditional client-server traffic which moves north-south.” As a result, traditional network and host-based security, even when virtualized, doesn’t provide the visibility, security controls, or protection capabilities to secure what has become the largest attack surface of today’s enterprise computing environments. Furthermore, point solutions offered by cloud and on-premises vendors come up short and add layers of complexity most enterprises can’t afford.
Attackers know this and are exploiting it. Today’s attacks are smarter and more straightforward, often launched to covertly harness portions of an enterprise’s compute power to commit other crimes. A good example of this is the rise in crypto-jacking, growing faster than ransomware as the means by which attackers attempt a pay-out. Alongside APTs, these types of threats take advantage of zero day vulnerabilities or weaknesses in existing security and launch attacks that are direct against the data center or cloud.
As IT environments continue to grow increasingly dynamic and complex, attackers can accomplish their ends more quickly and efficiently. This is especially true in a hybrid ecosystem, given the lack of native security controls and the average length of dwell time before detection.
The responsibility to ensure that you are protected against these threats lies squarely in your court – it is on you to safeguard your business. Security is ultimately — and contractually — a shared responsibility between the provider and the user. Enterprises must continue to work on securing the workloads and applications themselves, not merely rely on intrusion prevention tools.
The Micro-Segmentation Dilemma
In view of this sense of urgency, micro-segmentation has become a popular solution to address the reality of todays data centers. We’ve had conversations with people at dozens of organizations that have tried to implement micro-segmentation. By identifying some of the more common pitfalls, we can lay out the tips and tricks that will help you make your implementation a success.
Lack of visibility: Without deep visibility into east-west data center traffic, any effort to implement micro-segmentation is thwarted. Even with lengthy analysis meetings, traffic collection, and manual mapping processes, security professionals will be left with blind spots. Despite the strength of automated mapping, too many efforts lack process-level visibility and critical contextual orchestration data. The ability to map out application workflows at a very granular level is necessary to identify logical groupings of applications for segmentation purposes.
All-or-nothing segmentation paralysis: Too often, executives think they need to micro-segment everything decisively, which leads to fears of disruption. The project looks too intimidating, so they never begin. They fail to understand that micro-segmentation must be done gradually, in phases. The right provider will be able to identify use cases that will provide quick time to value for your unique business context.
Layer 4 complacency: Some organizations believe that traditional network segmentation is sufficient. But ask them, “When was the last time your perimeter firewalls were strictly Layer 4 port forwarding devices?” Attacks over the last 15 years often include port hijacking – taking over an allowed port with a new process for obfuscation and data exfiltration. Attackers can exploit open ports and protocols for lateral movement. Layer 4 approaches, typical of most point solutions, can in some cases be equal to under-segmentation. Of course, effective micro-segmentation must strike a balance between application protection and business agility, delivering strong security without disrupting business-critical applications, so it’s important not to enforce such tight policy that you lose flexibility. However, there are certain examples in dynamic infrastructures where workloads are communicating and often migrating across segments where you will want to enforce more granular policy down to Layer 7.
Lack of multi-cloud convergence: The hybrid cloud data center adds agility through autoscaling and mobility of workloads. However, it is built on a heterogeneous architectural base. Each cloud vendor may offer point solutions and security group methodologies that focus on its own architecture. They have their own best interests at heart, and multiple solutions can result in unnecessary complexity. Successful micro-segmentation requires a solution that works in a converged fashion across the entire architecture. On top of this, a converged approach can be implemented more quickly and easily than one that must account for different cloud providers’ security technologies.
Inflexible policy engines: Point solutions often have poorly thought-out policy engines. Most include “allow-only” rule sets. Most security professionals would prefer to start with a “global-deny” list, which establishes a base policy against unauthorized actions across the entire environment. This lets enterprises demonstrate a security posture directly correlated with the compliance standards they must adhere to, such as HIPAA for health organizations or PCI-DSS for anyone who takes payments.
Moreover, point solutions usually don’t allow policies to be dynamically provisioned or updated when workflows are autoscaled, services expand or contract, or processes spin up or down — a key reason enterprises are moving to hybrid cloud data centers in the first place. Without this capability, micro-segmentation is virtually impossible.
Given these obstacles, it’s understandable that most micro-segmentation projects suffer from lengthy implementation cycles, cost overruns, and excessive demands on scarce security resources, ultimately failing to achieve their goals.
So, how can you increase your chances of success?
Winning Strategies for Successful Micro-Segmentation
When intelligently planned and executed, reducing risk with micro-segmentation is very achievable. It starts with discovery of your applications and a visual map of their communications and dependencies within your network. With granular visibility into your entire environment, including network flows, assets, and orchestration details from various third-party platforms and workloads, you can more easily identify critical assets that can logically be grouped via labels to use in policy creation. Process-level (Layer 7) visibility accelerates your ability to identify and label workflows, and to achieve a more effective level of protection.
Converged micro-segmentation strategies that work seamlessly across your entire heterogeneous environment, from on premises to the cloud, will simplify and accelerate the rollout. When a policy can truly follow the workload, regardless of the underlying platform, it becomes easier to implement and manage, and delivers more effective protection.
Autoscaling is one of the major features of the hybrid cloud terrain. The inherent intelligence to understand and apply policies to workloads as they dynamically appear and disappear is key.
Finally, take a gradual, phased approach to operationalizing micro-segmentation. Start with critical assets, or applications that need to be secured for compliance. What is most likely to be targets of attackers? Which assets contain sensitive customer data or are most vulnerable to compute hijacking? Create policies around those groups first. Over time, you can gradually build out increasingly refined policies, whether this is for increased risk reduction, the principle of least privilege, wider compliance needs, or any other specific end goals for your business needs.
Want to learn more about best practices for micro-segmentation? Read more.