Why Microsegmentation is Still a Go-To Network Security Strategy

Prof. Avishai Wool, AlgoSec co-founder and CTO, breaks down the truths and myths about micro-segmentation and how organizations can better secure their network before their next cyberattack

Network segmentation isn’t a new concept. For years it’s been the go-to recommendation for CISOs and other security leaders as a means of securing expansive networks and breaking large attack surface areas down into more manageable chunks. Just as we separate areas of a ship with secure doors to prevent flooding in the event of a hull breach, network segmentation allows us to seal off areas of our network to prevent breaches such as ransomware attacks, which tend to self-propagate and spread laterally from machine to machine.

Network segmentation tends to work best in controlling north-south traffic in an organization. Its main purpose is to segregate and protect key company data and limit lateral movement by attackers across the network.

Micro-segmentation takes this one step further and offers more granular control to help contain lateral east-west movement. It is a technique designed to create secure zones in networks, allowing companies to isolate workloads from one another and introduce tight controls over internal access to sensitive data.

Put simply, if network segmentation makes up the floors, ceilings and protective outer hull, micro-segmentation makes up the steel doors and corridors that allow or restrict access to individual areas of the ship. Both methods can be used in combination to fortify cybersecurity posture and reduce risk vulnerability across the security network.

How does micro-segmentation help defend against ransomware?

The number of ransomware attacks on corporate networks seems to reach record levels with each passing year. Ransomware has become so appealing to cybercriminals that it’s given way to a whole Ransomware-as-a-Service (RaaS) sub-industry, plying would-be attackers with the tools to orchestrate their own attacks. When deploying micro-segmentation across your security network, you can contain ransomware at the onset of an attack. When a breach occurs and malware takes over a machine on a given network, the policy embedded in the micro-segmented network should block the malware’s ability to propagate to an adjacent micro-segment, which in turn can protect businesses from a system-wide shutdown and save them a great financial loss.

What does Zero Trust have to do with micro-segmentation?

Zero trust is a manifestation of the principle of “least privilege” security credentialing. It is a mindset that guides security teams to not assume that people, or machines, are to be trusted by default. From a network perspective, zero-trust implies that “internal” networks should not be assumed to be more trustworthy than “external” networks – quotation marks are intentional. Therefore, micro-segmentation is the way to achieve zero trust at the network level: by deploying restrictive filtering policy inside the internal network to control east-west traffic. Just as individuals in an organization should only be granted access to data on a need-to-know basis, traffic should only be allowed to travel from one area of the business to another only if the supporting applications require access to those areas.

Can a business using a public cloud solution still use micro-segmentation?

Prior to the advent of micro-segmentation, it was very difficult to segment networks into zones and sub-zones because it required the physical deployment of equipment. Routing had to be changed, firewalls had to be locally installed, and the segmentation process would have to be carefully monitored and managed by a team of individuals. Fortunately for SecOps teams, this is no longer the case, thanks to the rapid adoption of cloud technology.

There seems to be a misconception associated with micro-segmentation where it might be thought of as a strictly private cloud environment network security solution, whereas in reality, micro-segmentation can be deployed in a hybrid cloud environment – public cloud, private cloud and on-premise. In fact, all public cloud networks, including those offered by the likes of Azure and AWS, offer “baked in” filtering capabilities that make controlling traffic much easier. This lends itself well to the concept of micro-segmentation, so even those businesses that use a hybrid cloud setup can still benefit enormously.

The Bottom Line

Micro-segmentation presents a viable and scalable solution to tighten network security policies, despite its inherent implementation challenges. While many businesses may find it hard to manage this new method of security, it’s nevertheless a worthwhile endeavor. By utilizing a micro-segmentation method as part of its network security strategy, an organization can immediately bolster its network security against possible hackers and potential data breaches.

To help you navigate through your micro-segmentation fact-finding journey, watch this webcast or read more in our resource hub.