Building micro-segmentation policies around workloads to address compliance, reduce attack surfaces and prevent threat propagation between machines is on every organization’s security agenda and made it to the CISO’s 2019 shortlist. Many times, deploying segmentation policies in hybrid data centers proves harder than it looks. At Guardicore, we are very proud of our ability to assist customers segment and micro-segment their clouds and data centers quickly, protecting their workloads across any environment and achieving fast return on security investments.
But, we always think that there is room for improvement. Analyzing the different assignments that are involved with the task of micro-segmentation, we have identified several steps that can be accelerated with more sophisticated code. Using data that was collected from our customers and studied by Guardicore Labs, we added machine learning capabilities that accelerate micro-segmentation.
In order to properly micro-segment a large environment, one should discover all the workloads, create application dependency mappings, classify the workloads and label accordingly. Next, one is required to understand how the application is tiered and its behavior in order to set micro-segmentation policies both for its internal components as well as the other entities it is serving.
This is where our machine learning capabilities can assist.
We are taking advantage of the fact that in Guardicore deployments we collect information about every flow in the network. Discovery is automatic, creating a visualization of all application communications and dependencies. The visualized map shows how workloads are communicating. The algorithms use this data and model the network as an annotated graph and use our customized unsupervised machine learning technique to cluster similar workloads into groups, based on communication patterns. Then, Centra can perform the following tasks:
- Automatic classification of workloads
- Automatic label creation for applications and their tiers
- Automatic rule suggestion for flow level-segmentation and process level micro-segmentation
Here is an example of running classification from Reveal’s data center map:
Below is a visualization of results of automatic workload classification:
And this is how this looks in Reveal, at the application tier: