Posted by: Greg Ness | February 15, 2018

Time for a New Look at Segmentation?

The perimeter protecting the network, once considered impregnable, has been degraded by advanced threats and an explosion in the number of connected devices (and apps running on them) and a new generation of predatory malware attacks.Does segmentation

Since the dawn of the networking era, enterprises built open (flat) networks to offer every user access to (almost) every application. Many of these networks are global, spanning business units and national boundaries with unprecedented connectivity. Amazing. Powerful. Everything and everyone is accessible.

Today that access is now available to adversaries.

Some enterprise networks have become a kind of playground for hackers that offers up everything to everyone with minimal effort, not even the need to wait in line. With a few easily available tools or tactics adversaries can penetrate business critical apps and data. They simply compromise one of a growing population of connected devices.

From a single compromised device, attackers can then access other devices, servers and even printers to establish a robust foothold inside the network. From there they search for privileged users to get privileged access to servers, applications and data. Even with traditional network segmentation this can be a problem. (see diagram)

DC segmentationblog

Because of the difficulty and expense required to protect the entire network from these types of attacks, CISOs are taking steps to segment (or isolate) applications so they cannot be easily reached by adversaries, yet still be reachable by employees.

The problem is too much access, stolen credentials, and the ability for compromised devices to access servers from inside the network.

Connect on LinkedIn

Segmentation is the new perimeter strategy, and it should begin with the protection of applications and servers from attacks from compromised endpoints.  Yet CISOs have been “educated” by PCI compliance to think of server segmentation as a priority, instead of protecting servers from the most common threats.

It’s Time to Think Differently about Segmentation

A recent paper, Segmentation for Security by Silicon Valley veteran Brent Bilger, takes you through the various hops, attack vectors and approaches to effective isolation and access and reviews common approaches for security and business impacts. I highly recommend it if you have an open network and are looking for where to start.

Advertisements

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Categories

%d bloggers like this: