Business applications are the principal target of attackers seeking access to an organization’s most sensitive information, and as application deployment approaches become more dynamic and extend to the external cloud platforms, the number of possible attack vectors is multiplying. This is driving a shift from traditional perimeter security to increased focus on detection and prevention of lateral movement within both on-premises and cloud infrastructure.
Most security pros and industry experts agree that greater segmentation is the best step that an organization can take to stop lateral movement, but it can be challenging to parse the various available segmentation techniques. For example, IT pros and security vendors alike often use the terms application segmentation and micro-segmentation interchangeably. There is, in fact, some overlap between these two techniques, but selecting the right approach for a specific set of security and compliance needs requires a clear understanding of the different ways in which segmentation can be performed.
What is Application Segmentation?
Application segmentation is the practice of implementing Layer 4 controls that can both isolate an application’s distinct service tiers from one another and create a security boundary around the complete application to reduce its exposure to attacks originating from other applications.
This serves two purposes:
Enforcing clear separation between the tiers of an individual application, allowing only the minimum level of access to each tier required to deliver the application functionality
Isolating a complete application from unrelated applications and other resources that could be possible sources of lateral movement attempts if compromised
It is a longstanding IT practice to separate business applications into tiers to improve both scalability and security. For example, a typical business application may include a set of load balancers that field inbound connections, one or more application servers that deliver core application functionality, and one or more database instances that store underlying application data.
Each tier has its own distinct security profile. For example, access to the load balancer is broad, but its capabilities are narrowly limited to directing traffic. In contrast, a database may contain large amounts of sensitive data, so access should be tightly limited.
This is where intra-application segmentation comes into play, as security teams may, for example, limit access to the database to specific IP addresses (e.g., the application server) over specific ports.
The second important role that application segmentation can play is isolating an entire application cluster, such as the example above, from other applications and IT resources. There are a number of reasons that IT teams may wish to achieve this level of isolation.
One common reason is to reduce the potential for unauthorized lateral movement within the environment. Even with strong intra-application isolation between tiers in place, an attacker who compromises a resource in another application cluster may be able to exploit vulnerabilities or mis-configurations to move laterally to another cluster. Implementing a security boundary around each sensitive application cluster reduces this risk.
There may also be business or compliance reasons for isolating applications. For example, compliance with industry-specific regulations, such as HIPAA, PCI-DSS, and SWIFT security standards are simplified by establishing clear isolation of in-scope IT resources. This is also true for jurisdictional regulations like the EU General Data Protection Regulation (GDPR).
Application Segmentation vs. Micro-Segmentation
The emergence of micro-segmentation as a best practice has created some confusion for IT pros evaluating possible internal security techniques. Micro-segmentation is, in fact, a method of implementing application segmentation. However, micro-segmentation capabilities significantly improve an organization’s ability to perform application segmentation through greater visibility and granularity.
Traditional application segmentation approaches have relied primarily on Layer 4 controls. This does have value, but firewalls and other systems used to implement such controls do not give security teams a clear picture of the impact of these controls. As a result, they are time-consuming to manage and susceptible to configuration errors, particularly as environments evolve to include cloud services and new deployment models like containers.
Moreover, Layer 4 controls alone are very coarse. Sophisticated attackers are skilled at spoofing IP addresses and piggybacking on allowed ports to circumvent Layer 4 controls.
Micro-segmentation improves upon traditional application segmentation techniques in two ways. The first is giving security teams a visual representation of the environment and the policies protecting it. Effective visualization makes it possible for security teams to better understand the policies they need and identify whether gaps in policy coverage exist. This level of visibility rarely exists when organizations are attempting to perform application segmentation using a mix of existing network-centric technologies.
A second major advantage that micro-segmentation offers is greater application awareness. Leading micro-segmentation technologies can display and control activity at Layer 7 in addition to Layer 4. An application-centric micro-segmentation approach can do more than simply create a coarse boundary between application tiers or around an application cluster. It allows specific processes – and their associated data flows – to be viewed in an understandable way and serve as the basis for segmentation policies. Rather than relying solely on IP addresses and ports, micro-segmentation rules can white-list very specific processes and flows while blocking everything else by default. This enables far superior application isolation than traditional application segmentation techniques.
Balancing Application Segmentation with Business Agility
Application segmentation is more important than ever as dynamic hybrid cloud environments and fast-paced DevOps deployment models become the norm. The business agility that these advances enable are highly valuable to the organizations that adopt them. However, heterogeneous environments that are constantly evolving are also more challenging to secure. Security teams can easily find themselves facing a lose/lose proposition of either slowing down innovation or overlooking new possible security risks.
The granular visibility and control that application-centric micro-segmentation offers makes it possible to proactively secure new or updated applications at the time of deployment without added complexity or delay. It also ensures that security teams can quickly detect any abnormal application activity that slips through the cracks and respond rapidly to new security risks before they can be exploited.