WIXLIB

W H I T E PA P E RSegmentationThat Isn’t HardSegmentation thatdoesn’t touch thenetwork, complicatewith firewalls, orsidetrack SDN.

W H I T E PA P E RToday’s ChallengesIt was an unfortunate triple whammy when a Floridamunicipality was hit with the Emotet trojan, thatdownloaded TrickBot, and later, downloadedRyuk ransomware.After being downloaded, TrickBot moved laterallythroughout the municipality calling on exploitationof SMB vulnerabilities, brute forcing RDP (RemoteDesktop Protocol), or via network shares.This lateral movement is how a security incident ona single infected endpoint or workload turned into adevastating breach that drove headlines and resultedin ransom payments.Why do we segment?An occasional security incident is inevitable. However,breaches do not have to be. Motivated attackers willeventually find their way in. It might be a piece of novelmalware attached to a well-written phishing email orcontainers left exposed to the internet.A submarine uses compartments to remainseaworthy in the face of a breach in onecompartment. The breach is contained to thatsingle compartment and the submarine doesnot sink – thanks to the compartmentalization(or segmentation) of the vessel.This is a moment of truth. Stopping attackers movinglaterally is in effect stopping attackers from pursuingtheir aim: a full-blown breach.A Tough Needle to ThreadHow have we sought to stop thislateral movement?However, balancing packet delivery and security on thesame network has been a tough needle to thread. Onone hand, we seek reliable, utility-like packet delivery torun the business and, on the other, segmentation thatblocks traffic to prevent lateral movement and breaches.As we attempt to thread this needle, the risk of mistakesor misconfigurations is very high.Segmentation is a concept that has been around aslong as we’ve been connecting networks. It offersbetter network performance through smaller broadcastdomains and better security through smallerattack surfaces.This holds true even for software-defined networking(SDN). Similar to traditional networks, SDN is primarilydesigned for reliable packet delivery – not for enforcingthe security of what should and shouldn’t be allowedbetween two points on the network.Let’s not forget the primary purpose of a network:reliable, utility-like packet delivery to support a businessand its applications. Segmentation, however, is aboutreliably separating and filtering to block unauthorizedtraffic from going where it should not.Segmentation to date has programmed a firewall orthe network infrastructure to understand what canconnect to what and block everything else. Like abouncer at the club, if you’re not on the guest list,you won’t make it past.2

W H I T E PA P E RHybrid and EphemeralSegmentation via the network:it’s very manualAlmost every organization has on-premises data centerworkloads. However, it turns out that most of thosesame companies also have cloud workloads working inconjunction. Naturally, many workloads in the cloud arecontainerized workloads given the speed and flexibilitythey offer for DevOps, coming and going as needed tosupport applications.Traditional segmentation began on the network,deployed through virtual LANs (VLANs) or subnets,relying on IP addresses to partition a network intosmaller subnets. When we want to filter traffic betweenVLANs or subnets for segmentation, we introduce accesscontrol lists (ACLs) in the network infrastructure.This approach will contain threats from spreadingbeyond a particular VLAN or subnet but creating ACLshas always been a manual effort requiring intimateknowledge of the traffic. If an ACL is added withoutproper scrutiny, a misconfiguration can inadvertentlybreak an application when traffic cannot traverse anetwork control point, ruining reliable packet deliveryand disrupting business.71%The time it takes to write, approve, and provision ACLsis too slow for business today. If a container is spunup and down in seconds, why does a new ACL on thenetwork take days or weeks? Did we mention thattroubleshooting misconfiguration of ACLs is quite anundertaking?“71% of organizations relyon data centers and cloudsworking together”If a container is spun up anddown in seconds, why does anew ACL on the network stilltake days or weeks?- The State of SegmentationEven if you can make segmentation work well enough onthe network, it must also account for public clouds, thirdparty services, and APIs, making segmentation morechallenging as we protect everything from attackers.Network segmentation does not adapt easily to changebecause networks are hard to re-architect to adjust.Reconfiguring a server or deploying a new subnet couldtake weeks due to the complexity of IP addresses.Approaches to Date: HardNow businesses always want IT to operate and deployfaster, but segmentation is often too unwieldy, leaving uswith security that slows down business.Why doesn’t every organization have segmentation inplace already? It is because there have been a number ofcommon ways to do it, and they have often proven hardto implement and manage.Segmentation via firewalls:wrong tool for the jobInstead of using the network to enforce segmentation,deploying firewalls inside the data center is another3

W H I T E PA P E Roption. Firewalls have been used to create useful coarsezones between areas like the campus user zone and thedata center, but are sometimes stretched to segmenttraffic inside data centers to filter traffic between hosts.Some network operators seek to coax segmentationfrom their SDN network overlay implementation byusing it to create policies to funnel packets through adistributed set of firewalls.On one hand, most IT teams are familiar with 5-tuplefirewall rules from being deployed at the perimeter.However, segmentation becomes considerably morecomplex when the same firewalls are used for granular,internal micro-segmentation between hosts – oftenrequiring a virtual firewall on every host, resulting inthousands of firewall rules overall. When we consider alandscape of static firewall rules trying to keep pace withdynamic cloud workloads and changing IP addresses, itreally gets complex.What about working from a map that shows what mustbe protected? Automated segmentation policies? Cloudworkloads? These are all shortcomings of SDN whenit comes to segmentation. It is challenged to delivervisibility and consistent segmentation policy withworkloads in multiple clouds without additional SDNtechnologies (or another segmentation solution) andmore elbow grease. To a large extent, SDN technologiesare useful up to the edge of their specific fabrics.Firewall misconfigurations, just like on the network ACLmisconfigurations, can break an application and harmbusiness. Firewalls are pricey, whether a virtual firewallfor every host or occasionally physical firewalls, boughtin pairs, usually for multiple sites and often costing in themillions of dollars.SDN’s segmentation promise:All of the complexity, none ofthe visibility?While firewalls are effective at separating trusted internalnetworks from the outside world and creating coarseinternal zones, this does not mean they are the best toolfor the job for granular, micro-segmentation.When we decide to push SDN beyond its corenetworking function, it is no longer in its element.SDN should focus on its day job, network automation,rather than taxing it with something it was not designedfor and is not adept at: segmentation across clouds anddata centers.We must wonder if it isn’t time to fire the firewall fromits attempts at micro-segmentation and leave it at theperimeter for threat protection or to create coarsezones inside organizations. At the very minimum, callin some help for the firewall if it must attempt microsegmentation to track workload to IP mappings.Micro-segmentation easily picks up the security that SDNisn’t equipped to handle, making for a very productiveco-existence of the two technologies.Let SDN focus on its day jobConscious Decouplingfrom the NetworkSoftware-defined networking (SDN) is relied on forgreater network automation and programmabilitythrough centralized controllers that are abstracted fromthe physical hardware of the network.To address these issues, we need a segmentationsolution that is close to what’s being protected: theworkload and its applications. This is why we mustintentionally decouple security from the network withmicro-segmentation (also referred to as host-basedsegmentation or security segmentation).With SDN, we can deploy applications rapidly withouthaving to think too much about the network.SDN adds another layer of complexity because it relieson underlays, overlays, and tunnels to work. But aswith traditional networks, SDN is ultimately tied to theinfrastructure it resides on – the hypervisor or routersand switches.Micro-segmentation protects by using host workloadcontrols, instead of the network, firewalls, or SDN.4

W H I T E PA P E REach workload operating system in the data center or cloud contains a native stateful firewall, such as IP tables inLinux or Windows Filtering Platform in Windows. Micro-segmentation manages and programs these at scale to enforcesegmentation. It first uses their telemetry to build a map of the entire compute environment to then build automatedsegmentation policies. It also calls on easy-to-understand labels for policy instead of IP address complexity.What happens when we segment without the network for enforcement? We get segmentation without complexity.Without expense. Without misconfigurations. Let’s look at advantages of a decoupled approach.Micro-Segmentation That Isn’t Hard: Enter IllumioIllumio has considered all of these challenges when approaching micro-segmentation, offering a modern solution thatmakes segmentation easier.Easier segmentation that starts with a mapAnother key difference is that micro-segmentation useshuman-readable labels – not IP addresses or firewallrules – to create policy. Illumio assigns four-dimensionallabels to workloads (bare-metal servers, VMs, containers,or processes running on hosts) to identify andprovide context for each workload: role, application,environment, and location.Host-based segmentation uses workload telemetryto create a real-time map of cloud and on-premisescompute environments and applications. This map isused to visualize application connectivity, allowing teamsto clearly see what they must protect.With those labels, segmentation policy becomes as fastas a few clicks.An advantage of using the host is the ability to see andenforce segmentation down to the process level, moregranular than just specific ports. Permitting only specificservices between particular workloads is truemicro-segmentation.5