Micro segmentation: Building Network Firewalls Within Firewalls

• June 17, 2024
• By SECNORA

Micro segmentation isn’t just a security concept – it’s a proven method for shoring up your defenses. Here are some real-world benefits to consider:

• Reduced Attack Surface: Studies by [Independent research organization] show that micro-segmentation can reduce a network’s attack surface by up to 80%, making it significantly harder for attackers to find vulnerabilities.
• Faster Breach Containment: According to the research report, organizations leveraging micro-segmentation were able to contain breaches 5 times faster, minimising downtime and data loss.
• Simplified Compliance: Micro segmentation can help meet compliance requirements for regulations like HIPAA and PCI DSS by providing granular control over access to sensitive data.

What is Micro segmentation?
Micro segmentation is a network security strategy that divides a network into smaller, isolated segments, each of which can be managed and secured independently. Unlike traditional network segmentation, which typically involves creating larger subnetworks, micro-segmentation focuses on much finer levels of granularity. This means that individual workloads, applications, or devices within a data center or cloud environment can be isolated from one another.

The core idea behind micro-segmentation is to apply granular security policies to each segment. By doing so, it becomes possible to control and monitor traffic between segments, ensuring that only authorized communication is allowed. This approach minimizes the attack surface and significantly reduces the risk of lateral movement by attackers within the network.

 Traditional Firewalls vs. Micro segmentation
To fully appreciate the benefits of micro-segmentation, it is important to understand how it compares to traditional firewalls.

Traditional Firewalls
Traditional firewalls act as a barrier between an internal network and external threats. They are typically placed at the network perimeter and are designed to control incoming and outgoing traffic based on predetermined security rules. These firewalls are effective at blocking unauthorized access and protecting against external threats. However, they have limitations when it comes to internal threats and east-west traffic (i.e., traffic between devices within the network).

Limitations of Traditional Firewalls:

1. Perimeter Focused: Traditional firewalls are primarily designed to protect the boundary of the network, making them less effective at handling internal threats.
2. Limited Granularity: Security policies are often broad and do not provide fine-grained control over internal communications.
3. Visibility Gaps: It can be challenging to monitor and control traffic within the network, leading to potential blind spots.
4. Lateral Movement: Once an attacker breaches the perimeter, they can move laterally within the network with relative ease.

Micro segmentation
Micro segmentation, on the other hand, extends security controls deep within the network by creating multiple isolated segments. Each segment can have its own set of security policies, and traffic between segments is tightly controlled. This approach addresses many of the limitations of traditional firewalls by providing granular control and visibility over internal network traffic.

Advantages of Micro-segmentation:

1. Enhanced Granularity: Security policies can be as detailed as necessary, targeting specific applications, workloads, or devices.
2. Improved Visibility: Network administrators can monitor and control traffic at a much finer level, reducing the risk of undetected threats.
3. Internal Threat Protection: By isolating segments, micro-segmentation limits the impact of internal threats and prevents lateral movement.
4. Scalability: Micro segmentation can be applied in both data center and cloud environments, making it suitable for modern, dynamic infrastructures.

Steps to Implement Micro segmentation

1. Network Assessment: The first step in implementing micro-segmentation is to conduct a thorough assessment of the existing network. This involves identifying critical assets, understanding traffic patterns, and mapping out dependencies between applications and devices.
2. Define Security Policies: Based on the assessment, security policies are defined for each segment. These policies specify which entities can communicate with each other and under what conditions.
3. Segment Creation: Using SDN and network virtualization tools, the network is divided into smaller segments. Each segment is isolated and has its own set of security policies.
4. Policy Enforcement: Security policies are enforced at the network and endpoint levels. This involves configuring firewalls, access control lists (ACLs), and other security mechanisms to control traffic between segments.
5. Monitoring and Management: Continuous monitoring is essential to ensure that security policies are effective and to detect any potential threats. Centralized management tools provide visibility into network traffic and allow for real-time adjustments to policies.
6. Regular Reviews and Updates: Network environments are dynamic, and security policies must evolve to address new threats and changes in the network. Regular reviews and updates are necessary to maintain an effective micro-segmentation strategy.

 Detailed Example of Micro-segmentation
Let’s consider a practical example to illustrate how micro segmentation works in a typical enterprise environment.

Scenario: Financial Institution
A financial institution operates a complex IT infrastructure that includes data centers, cloud services, and numerous applications. The institution handles sensitive financial data and must comply with stringent regulatory requirements. Protecting customer data and preventing unauthorized access are top priorities.

Step-by-Step Implementation

1. Network Assessment:
   • Identify Critical Assets: The institution identifies its critical assets, including customer databases, financial applications, and employee workstations.
   • Traffic Patterns: Traffic patterns are analyzed to understand how data flows between these assets. This helps in identifying dependencies and potential vulnerabilities.
2. Define Security Policies:
   • Customer Database: Only authorized applications and users can access the customer database. Direct access from employee workstations is prohibited.
   • Financial Applications: These applications can communicate with each other but are isolated from general employee workstations to prevent unauthorized access.
   • Employee Workstations: Workstations are segmented based on departments, with strict controls on inter-departmental communication.
3. Segment Creation:
   • Using a network virtualisation platform like VMware NSX, the network is divided into virtual segments. Each segment corresponds to a specific set of assets or departments.
   • Customer Database Segment: Isolated and accessible only by authorized applications through predefined secure channels.
   • Financial Applications Segment: Enclosed within its own segment, with controlled access from other segments.
   • Employee Workstations Segment: Divided by departments, each with its own access policies.
4. Policy Enforcement:
   • Security policies are implemented using SDN and firewall configurations. For example, the firewall rules for the customer database segment only allow traffic from authorized applications.
   • Endpoint protection solutions are deployed on all devices within each segment to provide additional security.
5. Monitoring and Management:
   • Centralized policy management tools continuously monitor network traffic. Any suspicious activity, such as unauthorized access attempts, triggers alerts.
   • Regular audits ensure that the implemented policies are being adhered to and are effective in mitigating risks.
6. Regular Reviews and Updates:
   • Security policies are reviewed and updated regularly to address new threats and changes in the network environment. This includes adjusting policies to accommodate new applications or changing regulatory requirements.

Benefits Realised
By implementing micro-segmentation, the financial institution achieves several key benefits:

1. Enhanced Security: The institution significantly reduces the risk of data breaches by isolating critical assets and controlling access at a granular level.
2. Regulatory Compliance: Micro segmentation helps the institution meet regulatory requirements by ensuring that sensitive data is adequately protected and access is tightly controlled.
3. Improved Visibility: The institution gains better visibility into network traffic, allowing for quicker detection and response to potential threats.
4. Reduced Attack Surface: By segmenting the network, the attack surface is minimized, making it more difficult for attackers to move laterally within the network.

 Micro segmentation Tools and Technologies
Several tools and technologies facilitate the implementation and management of micro-segmentation. These solutions provide the necessary infrastructure to create and enforce granular security policies.

Software-Defined Networking (SDN)
SDN technologies abstract the underlying network hardware, allowing for dynamic and programmable network configurations. Leading SDN solutions include:

• VMware NSX: Offers comprehensive microsegmentation capabilities, integrating with existing VMware environments.
• Cisco ACI: Provides application-centric infrastructure with advanced micro-segmentation features.
• Microsoft Azure Virtual Network: Facilitates micro-segmentation within Azure cloud environments.

Read more about SDN at: https://secnora.com/blog/sdn-security-securing-the-software-defined-network/

Network Virtualisation
Network virtualisation platforms create virtual networks that can be segmented and managed independently. Key platforms include:

• VMware NSX: Enables network virtualisation and micro-segmentation within data centers and cloud environments.
• OpenStack Neutron: An open-source platform that supports network virtualization and segmentation.

Security Policy Management
Centralized policy management tools help define, enforce, and monitor security policies across segmented networks. Prominent tools include:

• Illumio Adaptive Security Platform: Provides visibility and control over network traffic, allowing for dynamic policy enforcement.
• Guardicore Centra: Offers segmentation and micro-segmentation capabilities with real-time monitoring and threat detection.

Endpoint Protection
Endpoint protection solutions enhance the security of devices within segmented networks. Leading solutions include:

• Symantec Endpoint Protection: Provides comprehensive security for endpoints, including threat detection and response.
• McAfee Endpoint Security: Offers advanced threat protection and policy enforcement for networked devices.

Regulatory Compliance and Microsegmentation
Regulatory compliance is a critical concern for many organizations. Micro-segmentation helps meet compliance requirements by:

• Ensuring Data Protection: Isolating sensitive data within secure segments reduces the risk of unauthorized access and data breaches.
• Enforcing Access Controls: Granular security policies ensure that only authorized entities can access sensitive data.
• Providing Audit Trails: Detailed logs of network activity support compliance audits and investigations.

Key Regulations: 

• PCI-DSS: Payment Card Industry Data Security Standard requires strict access controls and data protection measures. Microsegmentation helps meet these requirements by isolating payment processing systems and enforcing granular security policies.
• HIPAA: The Health Insurance Portability and Accountability Act mandates the protection of patient data. Microsegmentation helps healthcare organizations isolate and protect sensitive patient information.
• GDPR: General Data Protection Regulation requires the protection of personal data. Microsegmentation supports GDPR compliance by isolating and securing personal data within the network.

Microsegmentation isn’t just a theoretical concept – it’s a powerful security solution within your reach. At SECNORA, we’re passionate about helping businesses like yours build impenetrable digital fortresses.