Micro-segmentation

Blog, IT Solutions, Security, Technology, Uncategorized

The New Hero of Cyber Security; Zero Trust


No Comments

The ability to work from anywhere, on any device, has quickly become one of the greatest developments in the workspace of all time. It’s not an exaggeration either. In the UK, 4.2 million people were working from home in 2015. In fact, between 2012 and 2016, the mobile workforce increased by 12.35%, and that percentage is growing exponentially year on year. It’s widely predicted that by 2020, half of the UK workforce will no longer be plonked in an office all day. That means that it’s time to invest in nice shoes and/or new pj bottoms. And while that’s an amazing turn of events, it will cause some significant security concerns for everyone concerned. With so much of your workforce wandering the plains of the UK, your network is no longer secure by actual brick and mortar perimeter.

Today’s increasingly decentralised enterprises have become a bit of a headache for IT, who now have to keep you secure even when you’re not potentially clicking on some dodgy email phishing links. Zero trust has evolved to answer the issue. Back when cybercrime was still all the way at Gen III, most organisations assumed that their security protection was robust enough to keep them safe. Those few who did err on the side of caution deployed security operations centres or other cyber monitoring solutions, but for the most part IT departments assumed that anything inside the perimeter was safe. Oh, but those were far simpler times.

By working on the assumption that any resource in the network might be compromised, zero trust puts monitoring solutions in place so that you have the power to take remedial action if it’s needed. With this new solution, no one service or server is considered more secure than the next. It’s basically a data-centric network design that puts micro-perimeters around specific data or assets, giving you the flexibility to apply more-granular rules can be enforced. It solves the ‘flat network’ problem of hackers infiltrating your network and scurrying around undetected. With the right guidance (you’re welcome in advance) and a little bit of know-how, it only takes a couple of steps to get started with zero trust.

Identifying your sensitive data is the obvious first step. It sounds like an easy way to start the process, but it’s a little more challenging than you’d think. You can’t possibly protect data that you can’t see or know about. You need to know where your employees store their data, exactly who uses it, how sensitive it is and how they, your partners and customers use it. Without knowing all of this, you’re putting your data and your organisation at risk. And you can’t exactly start investing in security controls until you know what it is you’re actually trying to protect. When you have a better idea of what you’re dealing with, it’s time to classify it all. I suggest procuring the help of your most organised member of staff before moving onto mapping your data.

To understand how you’re going to employ zero trust, and therefore micro-segmenting specific sensitive data, you need to know how it flows across your network as well as between users and resources. This is a fun (probably not) exercise to have with your stakeholders, such as application and network architects, to fully understand how they approach information. To give yourself a bit of a springboard, security teams should streamline their flow diagrams by leveraging existing models. A zero trust network is based on how transactions flow across a network, and how users and applications access data. Optimising the flow to make it simpler, and start identifying where micro-perimeters will be placed and segmented with physical or virtual appliances. In a network where the compute environment is physical, the segmentation gateway will usually be physical as well, whereas a virtualised compute environment will deploy a virtual segmentation gateway.

Micro-segmentation is the name of the game after you determine the optimum traffic flow, by determining how to enforce access control and inspection policies at the segmentation gateway. The point of zero trust is to enforce identity rights, so that you can control who has the privileges to access specific data, so it’s important to know exactly which users need to access what data. You need to know more than the source address, port and protocol for zero trust to work, since security teams need to understand the user identity as well as the application to establish access rights. Having created your ecosystem, it’s important to ‘Big Brother’ it to identify malicious activity and areas of improvement. There’s no point only logging traffic if it comes from the internet- god only knows what kind of infectious diseases your network could contract from a wild-spirited USB. With your shiny new zero trust network, the segmentation gateway can send all of the data flowing through it, which includes traffic destined for both internal and external network segments, straight to a security analytics tool that inspects it properly.

Now that you’re the proud owner of a zero trust network, you can rest easy knowing that your network is being monitored effectively. Here at Cetus, we believe that building the best architecture is just as important as keeping it safe. We’re experts in all things datacentre and cloud, so make sure to have a chat with one of our specialists who can help you through all of your security challenges. And while you’re at it, book yourself in for our complimentary security posture review to identify where your organisation is being exposed to the nasty things that lurk on the outside of your perimeter.

Speak to an expert

Directors-9619Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.

 

Blog, Our Upcoming Events, Security, Technology, Uncategorized, VMware

Micro-segmentation; As Easy as Stealing Candy From a Baby


1 Comment

I often feel that trying to come up with a good metaphor is a bit like herding cats. I know; I’ve used a simile to describe the difficulty of creating a metaphor; but that’s kind of my point. As is the case with my latest blog requirement: Micro-segmentation. You see; VMware have already nailed it with their ‘Hotel & Castle’ metaphor for VMware NSX.
It just works…

It goes like this:

1. Think of your perimeter security as your ‘castle’. A solid wall of impenetrable protection with only one way in and out (your firewall). This is your ‘North/South’ traffic protection.

2. Think of what happens when your castle walls are breached: burning, pillaging, looting; all sorts of terrible things. That’s because your protection is facing ‘outwards’. Once in; your internal (East/West) traffic is unprotected and susceptible to pillaging. Now I’m not sure what ‘pillaging’ is, but the metaphor implies that your servers are now vulnerable.

3. Now think of a hotel. You can stroll in without being challenged (usually). But once you’re in you can only access public areas. If you need to get into staff areas, rooms, gyms or whatever; you’re going to need a keycard that grants you access to a particular subset of private areas.

That’s what micro-segmentation does – well, metaphorically at least. In theory, I now only need a short statement to align the metaphor with your data centre; so here goes: Micro-segmentation provides hypervisor level, layer 4 protection for east/west traffic within your data centre; preventing cyber threats from spreading once they’ve breached your perimeter security. Clever stuff!

I think it’s fair to say that my description above is somewhat simplistic. The good news is that our VMware NSX certified experts can explain it properly to you. Our free-of-charge security posture review will provide you an opportunity to discuss your endpoint security challenges, as well as your wider cyber security posture with regards to perimeter, data centre and cloud components.

Speak to an expert