Why Thinking Small is the Key for Network Security

On the 15^th August 2020, cruise company Carnival Corporation fell victim to a cyberattack that may have resulted in the loss of personal data belonging to millions of passengers and crew.

Carnival is the world’s largest travel leisure business, hosting around 13 million passengers per year which equates to a lot data. The company has not revealed how many customers or which brands were targeted, but what we do know is that law enforcement agencies were notified after one of its brands detected a ransomware attack that breached an encrypted portion of its network.

This isn’t the first time that Carnival has been breached by hackers. In 2019, a cyberattack on Princess Cruises and Holland America Line resulted in the personal data of hundreds of passengers and crew being compromised. The criminals stole passenger names, Social Security numbers, passport numbers and credit card information.

Whilst many of us would presume that thinking about the big picture is the best way to look for ways to protect large companies, the answer actually lies in something much smaller – network micro-segmentation.

Damage limitation with micro-segmentation

Hackers are never going to give up targeting large corporations, and ransomware attacks like that on Carnival are not going to disappear. As cybercrime becomes more sophisticated, it is not going to be easy to completely defend your network from malicious hackers. What companies can do, however, is limit the potential damage hackers can cause if they do gain access to sensitive company or customer data.

One way to do this is through network micro-segmentation, which is regarded as one of the most effective methods to reduce an organization’s attack surface. A lack of it has often been cited as a contributing factor in some of the largest data losses in ransomware attacks.

Micro-segmentation minimizes the damage that hackers can do if they gain access, by stopping lateral movement across your networks. Just as the watertight compartments in a ship should contain flooding if the hull is breached, segmentation isolates servers and systems into separate zones to contain intruders or malware as well as insider threats, limiting the potential security risks and damage.

Controlling your borders

Although micro-segmentation is recognized as an effective method to enhance security, some businesses have been slow to adopt it because it can be complex and costly to implement, especially in traditional on-premise data centers.

However, as more organizations move to virtualized data centers using Software-Defined Networking (SDN), some of the barriers associated with micro-segmentation have been eliminated. 

SDN’s flexibility enables more advanced, granular zoning, allowing networks to be divided into hundreds of microsegments, delivering a level of security that would be prohibitively expensive and complicated to implement in a traditional data center.

It’s important to recognize that the opportunity presented by virtualized data centers does not eliminate all the challenges. Enforcing successful micro-segmentation policies still requires deploying a filtering policy that the micro-segmented fabric will enforce, and writing this policy is the first, and largest, hurdle that must be cleared.

We have published a new eBook to help guide you through the process of implementing and managing your micro-segmentation strategy.

Simplifying micro-segmentation with AlgoSec Security Management Suite

The AlgoSec Security Management Suite (ASMS) employs the power of automation to make it easy for businesses to define and enforce their micro-segmentation strategy, ensure that it does not block critical business services, and also meet compliance requirements.

AlgoSec supports micro-segmentation by:

• Providing application discovery based on netflow information
• Identifying unprotected network flows that do not cross any firewall and are not filtered for an application
• Automatically identifying changes that will violate the micro-segmentation strategy
• Automatically implementing network security changes
• Automatically validating changes

Although network segmentation used to be a costly manual process, the arrival of SDN data centers, combined with the automation capabilities of the AlgoSec Security Management Suite, mean that implementing an effective network micro-segmentation strategy is now possible.

Find out more about how micro-segmentation can help you boost your security posture, or request your personal demo.