Network Segmentation: Everything You Need To Know (FAQs)
What Is Network Segmentation?
Network segmentation is the process of controlling network traffic to limit the risk of cybersecurity breaches. Segmentation is a critical security concept: it reduces your attack surface area by creating barriers between valuable data in your organization.
This means that if one area of your organization is breached, attackers do not have unrestricted access to all of the data held in your organization. For example, if you are a healthcare organization with multiple branches, the accounting department should be blocked from accessing sensitive healthcare records. This means if an employee in this department is breached or infected with ransomware, the attacker would not be able to access any confidential data. Not only does this make your network more secure, it ensures you comply with relevant frameworks like GDPR, ensuring that PII is protected.
Organizations should be able to manage and control their network segmentation policies to limit traffic flows by type, source, destination, and many other options. Network admins should be able to edit and enforce these segmentation policies.
Traditionally, hardware-based technologies placed inside branches have been used to enforce network segmentation policies. These include network firewalls and configurations on network equipment. Today, network segmentation is more commonly associated with software-defined access technologies, which uses traffic tags to segment and group network traffic.
This new category of network segmentation solutions also encompasses microsegmentation technologies, which provide granular network access controls based around principles of least privileges and zero trust. For example, in a healthcare setting, this may include configuring policies to govern data sharing between endpoint devices to help reduce the risk of data breach and ransomware attack.
How Does Microsegmentation Work?
There are two stages in the microsegmentation process. First, your network areas are divided up into segments, with firewalls preventing free access across segments. This can be carried out at any scale, right down to individual workloads. When a user attempts to access one of these areas, their identity is verified. Microsegmentation enforces more frequent checks, ensuring users are only accessing areas that they are permitted to, as opposed to only verifying their identity once and granting access to the entire network.
If an attacker was able to gain access to one of the network areas, they would not be able to extend the attack laterally, into other segments. Instead, they would be restricted to a single segment before remediation efforts could take place. This reduces the potential blast radius of an attack, thereby limiting the potential damage.
With microsegmentation, you can spread a single customer’s information across segments. This increases security by preventing any user from having access to all the information regarding a specific customer. In a medical setting, for instance, you may store a customer’s financial and banking details within a segment that can be accessed by the accounts department but store their medical details in a different segment. This means that medical professionals can’t access their clients’ banking details, and the accounts department can’t access their medical details.
Who Should Have A Microsegmentation Security Solution?
Microsegmentation is an important part of an enterprise’s security infrastructure. Enterprises often have large network environments that can be difficult to manage and monitor. You want to ensure that only valid users are accessing your data and accounts. With microsegmentation, you can automate this verification process and ensure that sensitive areas aren’t breached.
Any organization could be adversely impacted if an attacker were to gain access to their network. However, some sectors that handle particularly sensitive data, such as PII or PHI, are required to implement more strict data protection processes. For these sectors – including government, financial, healthcare, retail, and aviation = micro-segmentation is particularly useful.
Alternatively, if you are operating technology that does not have sufficient patches, microsegmentation can add that critical security layer to protect your network.
What Are The Benefits Of Network Segmentation?
Within the umbrella benefit of “improving your cyber security”, there are two specific ways that network segmentation improves your posture: they reduce your attack surface area and help prove regulatory compliance.
Reduce Attack Surface
With network segmentation in place, your attack surface is lowered as each network system can be walled off from other, more vulnerable systems. Your most secure network systems, that contain the most sensitive data, can be entirely walled off from harmful internet traffic.
Network segmentation will also ensure internal users can only access the network systems they need to for their roles, enforcing the principles of least privilege and reducing the risk of account compromise leading to harmful data breaches. Combined with authentication and identity management technologies, this can be a powerful step toward implementing a Zero Trust security model.
Effectively Contain Breaches
Network segmentation contains breaches by putting secure barriers in place between different traffic flows in your network. This means that a ransomware attack in one area of your network could not spread to different network systems, and, in many cases, can be contained and remediated against very efficiently.
Ensure And Strengthen Regulatory Compliance
Network segmentation and Zero Trust segmentation approaches are highly recommended by many regulatory and compliance bodies and mandated in many regulated industries. Implementing network segmentation policies is an important way to strengthen and demonstrate regulatory compliance.
What Is Zero Trust Segmentation?
Zero Trust as a concept was first coined by John Kindervag, a Forrester analyst in 2010, with the basic premise that organizations should seek to, wherever possible, continuously verify and never trust network connections, assuming a breach has already occurred.
It’s important to note that Zero Trust is a security philosophy, and not a static set of products with a consistent feature set. Segmentation is one aspect of Zero Trust, but not the whole picture. Zero Trust is also associated with the identity management space, and remote access.
With that said, segmentation is a key pillar of a Zero Trust strategy. When assuming a breach has occurred, it is important to throw up as many barriers as possible between the breached endpoint or server, and your organizations’ important data.
As organizations move away from traditional network approaches towards dynamic and hybrid cloud environments and segmented cloud applications delivered via API integrations, traditional network segmentation approaches have become very difficult to manage. This has led to the emergence of a new category of software-defined micro-segmentation technologies which are designed to help organization move to a Zero Trust model.
Explaining Zero Trust Segmentation
One of the leading providers in the Zero Trust segmentation space is Illumio, who have featured in both the Forrester Wave for Zero Trust and Micro-segmentation. In a recent interview with Expert Insights, Illumio’s’ co-founder and CTO PJ Kirner explained the concept of Zero Trust with the following metaphor:
“Think about how we build submarines. How does the submarine have physical resiliency in its environment? Well number one, it has redundancy. But the other thing is that it is built with a set of watertight components inside so, when there is a breach—and they plan for the inevitability of a breach—they can seal off the watertight compartment. And the breach might have an impact, but the submarine doesn’t sink.”
“That’s what Illumio does with Zero Trust Segmentation. It’s like putting those watertight walls up inside the submarine, so that your organization has cyber resiliency. You still need that outer wall; you still need to be able to defend yourself. But having that way to contain something so it does not become a disaster is what we’re focused on and is where Zero Trust Segmentation comes into play.”
