The Top 11 Network Segmentation (Microsegmentation) Solutions
Network segmentation (microsegmentation) solutions allow you to protect your network by controlling traffic flow and limiting the risk of security breaches.
Written by Alex Zawalnyski
Technical Review by Laura Iannini
-
1.
Akamai Guardicore Segmentation
-
2.
Appgate SDP
-
3.
Cisco Secure Workload
-
4.
ColorTokens XShield
-
5.
Palo Alto Networks Prisma Cloud
Network segmentation (or microsegmentation) is a means of reducing the impact of an attack by logically splitting your network into multiple areas. These solutions essentially place firewalls within your network, requiring users to be validated before being granted access to another area. This means that if an attacker breaches one area of your network, there are barriers in place to prevent them from extending the attack laterally and breaching more of your network.
Microsegmentation solutions are often part of a wider access management or network security solution. These tools continuously verify traffic based on user behavior and tags to ensure that your networks are not accessed by improper users. If a user is displaying abnormal behavior, the platform prevents them from accessing further areas of the network and notifies an admin so they can investigate the activity. This filtration can happen at a granular level – traffic flow can be monitored between applications, thereby allowing you to create micro-policies and security automations to reduce attack surface and contain network breaches.
In this article we’ll explore the top network segmentation solutions that help reduce your attack surface and improve your security posture. We’ll give a brief overview of each product and its key specifications, before providing our expert opinion on the solution and suggesting who it would benefit most.
Akamai Guardicore Segmentation
Akamai acquired Guardicore in 2021, strengthening its own line of zero trust network access solutions. Their segmentation solution grants you visibility into network activity and provides security alerts as well as enforcing precise segmentation policies. The tool is able to enforce microsegmentation across multi-cloud environments, data centers, and endpoints. This platform uses agent-based sensors as well as network-based data collectors and virtual private cloud flows to understand the details and complexities of your network.
Expert Insights’ Comments: Akamai Guardicore Segmentation allows you to label your assets, thereby improving the solution’s ability to analyze traffic and create relevant rules. The solution is easy to manage; you can visualize your network through graphs and infographics in the dashboard. We would recommend Akamai Guardicore Segmentation for medium to large sized organizations that need a reliable solution that offers users extensive visibility and granular control over their policy implementation.
Akamai Guardicore Segmentation
Appgate SDP
Founded in 2020, Appgate is a cyber technology company focused on risk-based authentication and zero trust access. Appgate SDP is a Zero-Trust Network Access (ZTNA) solution that creates micro-perimeters to segment your network and prevent lateral attacks. These perimeters can be individualized based on each user and their normal behavior and activities. Appgate SDP runs off a completely decentralized, distributed, and stateless network architecture.
Expert Insights’ Comments: Appgate SDP is an effective and easy to use solution that provides robust authentication and context-based access. The solution will reduce your organization’s attack surface through cloaking all ports. The API and UI is straightforward to use, allowing technicians and admins to have granular control over how the solution is deployed. We would recommend Appgate SDP for organizations of all sizes that need a reliable and effective solution for managing access to secure network areas.
Appgate SDP
Cisco Secure Workload
Technology and communications company Cisco has been developing enterprise solutions since 1984. Secure Workload allows you to safeguard applications by implementing microsegmentation controls. This tool can be implemented as a SaaS or on-premises solution, allowing you to use a manged service, or to take full control when needed. Cisco’s solution will continually monitor baselines to ensure that processes are occurring as they should.
Expert Insights’ Comments: Cisco Secure Workload effectively reduces attack surface area whilst extending admin visibility and allowing granular access controls. One of Cisco’s standout features is the way that it adapts and learns over time. This ensures that insights are accurate, and that policies are implemented effectively. The tool has a wide range of technical capabilities that ensure your network is adequately protected. The solution does, however, require a good deal of technical knowledge to deploy and configure. We would, therefore, recommend Cisco Secure Workload for large enterprise organizations that have the resource and expertise to customize the solution to meet their requirements.
Cisco Secure Workload
ColorTokens XShield
ColorTokens is a dedicated zero trust organization that has developed a series of products to manage network access, as well as reduce your attack surface area. XShield is ColorToken’s dedicated microsegmentation solution. It has an intuitive user dashboard that allows you to gain an insight into your assets and traffic to understand network events. From this dashboard, you can implement microsegmentation policies based on the principle of least privilege. This means that an asset’s metadata and grouping will determine the specific security settings applied to it. The solution will also automatically extend security controls to new workloads and applications, ensuring there are no gaps in coverage.
Expert Insights’ Comments: ColorTokens’ XShield is quick to implement, without sacrificing the ability to customize or configure any of the settings. ColorTokens offers an exceptional level of customer service and engagement; this ensures that you can tailor the solution to suit your needs and that any issues are quickly resolved. We would recommend ColorTokens XShield for medium sized organizations that need a configurable and reliable microsegmentation solution, with the added benefit of an experienced customer service team.
ColorTokens XShield
Palo Alto Networks Prisma Cloud
Palo Alto Networks is a Santa Clara based cybersecurity provider that has developed several proficient and advanced technology solutions including firewalls, SASE solutions, and SD-WAN tools. Prisma Cloud is a cloud-native application protection platform (CNAPP). Prisma Cloud uses identity-based segmentation to identify how applications communicate and enforce identity-based defences to prevent the lateral movement of attacks.
Expert Insights’ Comments: Prisma Cloud is a reliable and proactive cloud-native security posture solution that offers all the features that you might need. The platform ensures that your security infrastructure and posture is maintained, as well as implementing effective microsegmentation policies. When creating microsegmentation policies, Palo Alto’s solution allows you to use native attributes such as image, namespace, clusters, and labels. Due to the granular and comprehensive feature set, we would recommend it to larger organizations that need a fully featured and robust security tool.
Palo Alto Networks Prisma Cloud
Illumio Core
Illumio is based in Sunnyvale, CA, and is focused on preventing threats from spreading laterally across your networks. Illumio Core is a microsegmentation solution for complex on-premises and cloud data center workloads. Their agentless solution provides extensive visibility of workloads across your network. Illumio Core identifies, evaluates, and correlates data from across your organization to ensure that segmentation policies are applied effectively. You can easily block unnecessary connections, without needing to set up whole firewalls, and the platform can effectively and efficiently automate security protocols, helping you meet compliance requirements.
Expert Insights’ Comments: It is easy to deploy Illumio in ‘visibility-only’ mode to gain an understanding of your network, before rolling out a full deployment. This ensures that any implementation issues do not have adverse consequences. We would recommend this solution for organizations of all sizes that need an effective segmentation solution that is easy to roll out and deploy.
Illumio Core
Nutanix Flow Network Security
Nutanix provides a comprehensive platform to run apps and data across cloud environments. Flow Network Security is a platform that focuses on securing networks against cyber threats. The solution virtually maps your workflows at a port level to gain visibility. From here, microsegmentation, firewalls, and access management features ensure that your network areas are secured. Flow Network Security also ensures that you are operating in accordance with regulatory compliance frameworks.
Expert Insights’ Comments: Nutanix is a straightforward and effective network security solution that offers a range of useful features. You are able to implement effective microsegmentation through the solution, allowing you to mitigate the spread of a cyberattack. We would recommend this solution for small to medium organizations that need a microsegmentation tool that can also provide extended visibility into network events.
Nutanix Flow Network Security
Fortinet FortiPolicy
Fortinet is a network security and operations organization based in Sunnyvale, CA. FortiPolicy is a platform to manage and implement security policies across your networks. It uses ML technology to implement microsegmentation and firewalls, as well as automating the creation and implementation of custom security policies. Microsegmentation allows you to limit the spread of an attack, whilst reducing the potential blast radius. FortiPolicy conducts continuous discovery and analysis across multi-tiered applications to eliminate blind spots.
Expert Insights’ Comments: FortiPolicy is a powerful, agentless solution that provides continuous monitoring of your environment to identify security threats at the earliest opportunity. The platform gives you end-to-end visibility of your network and it can map connections to give greater insight. We would recommend Fortinet FortiPolicy for organizations of all sizes that are looking for a comprehensive solution to manage and administer accurate security policies across their environments.
Fortinet FortiPolicy
TrueFort
TrueFort is a dedicated lateral movement protection platform offering microsegmentation, file integrity analysis, account protection, and workload hardening. The solution provides automated and continuous monitoring against a host of threats. By using behavioral analytics, TrueFort creates baseline profiles of process, user, and network behaviors and events. These are then used to identify any anomalous or suspicious activity. The solution also discovers and maps applications to understand their relationships and dependencies – this information is used during microsegmentation to reduce attack surface.
Expert Insights’ Comments: The TrueFort Platform provides effective risk and security management that can help you comply with data protection frameworks such as CMMC 2.0, CIS benchmarks, NIST, PCI, and NYDFS. This is a technically advanced solution that will only be able to operate at full capacity if it is fully integrated with an organization’s infrastructure. This means that the solution is best suited to a mid-to-large enterprise that has the technical resource to implement it effectively.
TrueFort
VMware NSX
Based in Palo Alto, VMware is a provider of cloud management solutions, hypervisors, and digital workspaces. VMware NSX allows you to apply context-aware policies per-workload, alongside microsegmentation to limit the potency of ransomware. There are a range of security features to strengthen the solution; these include layer 2 and 7 overlay services and extensive visibility to eliminate blind spots and gain deep insights. VMware NSX is used in the data centers of 91% of the Fortune 100.
Expert Insights’ Comments: VMware is an effective and sophisticated solution that gives organizations extensive levels of configurability and control over their network security. NSX is predominantly a network virtualization solution – this ensures that it is flexible and can be scaled as your organization’s needs expand. As the solution can be complex to deploy, it should be adopted by an organization that has the technical resource and knowledge to do this effectively. We would recommend this solution for large enterprises that need a sophisticated and robust tool, but also have the technological expertise to match.
VMware NSX
Zscaler Workload Segmentation
Zscaler is a San Jose, CA, based cloud security company that ensures users can access networks and accounts while limiting security risks. Their workload segmentation solution automatically splits your network into manageable, logically separated areas. The solution maps data flows and measures exposure risk, then deploys relevant policies to ensure best practices are maintained. Zscaler uses ML technology to generate and suggest the most appropriate polices to implement. This takes a range of factors into account, including exposure, reputation, behaviors, and software identity.
Expert Insights’ Comments: ZScaler gives administrators access to a cloud portal where they can configure deployment and monitor network events. This allows you to access policy configuration from anywhere, making it suitable for remote security teams. The platform also offers easy integrations with third-party IdP solutions. We would recommend Zscaler Workload Segmentation for large enterprises that need to roll out the solution over a large area, whilst maintaining configurability, and granular policy controls.
Zscaler Workload Segmentation
FAQs
Everything You Need To Know About Network Segmentation (FAQs)
Network segmentation is the process of controlling network traffic to limit the risk of cybersecurity breaches. Segmentation is a critical security concept: it reduces your attack surface area by creating barriers between valuable data in your organization.
This means that if one area of your organization is breached, attackers do not have unrestricted access to all of the data held in your organization. For example, if you are a healthcare organization with multiple branches, the accounting department should be blocked from accessing sensitive healthcare records. This means if an employee in this department is breached or infected with ransomware, the attacker would not be able to access any confidential data. Not only does this make your network more secure, it ensures you comply with relevant frameworks like GDPR, ensuring that PII is protected.
Organizations should be able to manage and control their network segmentation policies to limit traffic flows by type, source, destination, and many other options. Network admins should be able to edit and enforce these segmentation policies.
Traditionally, hardware-based technologies placed inside branches have been used to enforce network segmentation policies. These include network firewalls and configurations on network equipment. Today, network segmentation is more commonly associated with software-defined access technologies, which uses traffic tags to segment and group network traffic.
This new category of network segmentation solutions also encompasses microsegmentation technologies, which provide granular network access controls based around principles of least privileges and zero trust. For example, in a healthcare setting, this may include configuring policies to govern data sharing between endpoint devices to help reduce the risk of data breach and ransomware attack.
There are two stages in the microsegmentation process. First, your network areas are divided up into segments, with firewalls preventing free access across segments. This can be carried out at any scale, right down to individual workloads. When a user attempts to access one of these areas, their identity is verified. Microsegmentation enforces more frequent checks, ensuring users are only accessing areas that they are permitted to, as opposed to only verifying their identity once and granting access to the entire network.
If an attacker was able to gain access to one of the network areas, they would not be able to extend the attack laterally, into other segments. Instead, they would be restricted to a single segment before remediation efforts could take place. This reduces the potential blast radius of an attack, thereby limiting the potential damage.
With microsegmentation, you can spread a single customer’s information across segments. This increases security by preventing any user from having access to all the information regarding a specific customer. In a medical setting, for instance, you may store a customer’s financial and banking details within a segment that can be accessed by the accounts department but store their medical details in a different segment. This means that medical professionals can’t access their clients’ banking details, and the accounts department can’t access their medical details.
Microsegmentation is an important part of an enterprise’s security infrastructure. Enterprises often have large network environments that can be difficult to manage and monitor. You want to ensure that only valid users are accessing your data and accounts. With microsegmentation, you can automate this verification process and ensure that sensitive areas aren’t breached.
Any organization could be adversely impacted if an attacker were to gain access to their network. However, some sectors that handle particularly sensitive data, such as PII or PHI, are required to implement more strict data protection processes. For these sectors – including government, financial, healthcare, retail, and aviation = micro-segmentation is particularly useful.
Alternatively, if you are operating technology that does not have sufficient patches, microsegmentation can add that critical security layer to protect your network.
Within the umbrella benefit of “improving your cyber security”, there are two specific ways that network segmentation improves your posture: they reduce your attack surface area and help prove regulatory compliance.
Reduce Attack Surface
With network segmentation in place, your attack surface is lowered as each network system can be walled off from other, more vulnerable systems. Your most secure network systems, that contain the most sensitive data, can be entirely walled off from harmful internet traffic.
Network segmentation will also ensure internal users can only access the network systems they need to for their roles, enforcing the principles of least privilege and reducing the risk of account compromise leading to harmful data breaches. Combined with authentication and identity management technologies, this can be a powerful step toward implementing a Zero Trust security model.
Effectively Contain Breaches
Network segmentation contains breaches by putting secure barriers in place between different traffic flows in your network. This means that a ransomware attack in one area of your network could not spread to different network systems, and, in many cases, can be contained and remediated against very efficiently.
Ensure And Strengthen Regulatory Compliance
Network segmentation and Zero Trust segmentation approaches are highly recommended by many regulatory and compliance bodies and mandated in many regulated industries. Implementing network segmentation policies is an important way to strengthen and demonstrate regulatory compliance.
Zero Trust as a concept was first coined by John Kindervag, a Forrester analyst in 2010, with the basic premise that organizations should seek to, wherever possible, continuously verify and never trust network connections, assuming a breach has already occurred.
It’s important to note that Zero Trust is a security philosophy, and not a static set of products with a consistent feature set. Segmentation is one aspect of Zero Trust, but not the whole picture. Zero Trust is also associated with the identity management space, and remote access.
With that said, segmentation is a key pillar of a Zero Trust strategy. When assuming a breach has occurred, it is important to throw up as many barriers as possible between the breached endpoint or server, and your organizations’ important data.
As organizations move away from traditional network approaches towards dynamic and hybrid cloud environments and segmented cloud applications delivered via API integrations, traditional network segmentation approaches have become very difficult to manage. This has led to the emergence of a new category of software-defined micro-segmentation technologies which are designed to help organization move to a Zero Trust model.
Explaining Zero Trust Segmentation
One of the leading providers in the Zero Trust segmentation space is Illumio, who have featured in both the Forrester Wave for Zero Trust and Micro-segmentation. In a recent interview with Expert Insights, Illumio’s’ co-founder and CTO PJ Kirner explained the concept of Zero Trust with the following metaphor:
“Think about how we build submarines. How does the submarine have physical resiliency in its environment? Well number one, it has redundancy. But the other thing is that it is built with a set of watertight components inside so, when there is a breach—and they plan for the inevitability of a breach—they can seal off the watertight compartment. And the breach might have an impact, but the submarine doesn’t sink.”
“That’s what Illumio does with Zero Trust Segmentation. It’s like putting those watertight walls up inside the submarine, so that your organization has cyber resiliency. You still need that outer wall; you still need to be able to defend yourself. But having that way to contain something so it does not become a disaster is what we’re focused on and is where Zero Trust Segmentation comes into play.”
Written By
Alex is an experienced journalist and content editor. He researches, writes, factchecks and edits articles relating to B2B cyber security and technology solutions, working alongside software experts. Alex was awarded a First Class MA (Hons) in English and Scottish Literature by the University of Edinburgh.
Technical Review
Laura Iannini is an Information Security Engineer. She holds a Bachelor’s degree in Cybersecurity from the University of West Florida. Laura has experience with a variety of cybersecurity platforms and leads technical reviews of leading solutions. She conducts thorough product tests to ensure that Expert Insights’ reviews are definitive and insightful.