Modern Microsegmentation: Zero Trust Through Software Identity
July 16, 2019

Tom Hickman
Edgewise Networks

Security teams face a never-ending, ever-growing onslaught of attacks. According to the 2019 Verizon Data Breach Investigations Report , 88% of data breaches involve malware or hacking. What's more, the average cost of a malware attack is $2.4 million USD, making any breach against a company's networks a costly operational ordeal. These facts create a compelling call to action — there has to be a better way!

Managing the sprawl and complexity of even an average-sized company's technology ecosystem is a monumental challenge. Modern networks span on-premises data centers, containers, and multiple clouds; new applications and technologies are constantly being deployed; and dozens of new vulnerabilities that need to be patched arise daily. It takes just one weak point in an organization's network to allow a damaging compromise.

The potential damage is far greater when the organization is operating flat networks — those without any internal security checks and balances on communicating software and services. Flat networks have the advantage of making it easy for people, software, and machines to access resources. This increases efficiency but also makes lateral movement easy for attackers if they're able to bypass perimeter defenses. As a result, security teams must prepare for the certainty that, eventually, something malicious will gain a foothold in the network. In response, security teams are refocusing their work on the need to harden internal network security. And the methodology they're turning to is zero trust.

In a zero trust environment, all communications are treated as potentially hostile by default. Through microsegmentation, the network is divided into many smaller, secure segments. Anytime a device, host, service, or application wants to communicate across these segments, both sides of the communication must be authenticated and authorized — a process that needs to take place continuously.

Step 1: Understand everything that's on the network

Before security teams can set up policies to govern which communications are authorized, they must first establish an accurate, up-to-date inventory of all network assets and map data flows and dependencies between them. The inventory and map must be updated in real time to capture network changes as they happen.

Today's networks change too often for manual updates to reliably capture all the changes, which could leave vital assets unprotected. Managing that dynamism is a task best suited for automation and machine learning.

Step 2: Verify all network communication

The next consideration is how communications will be verified. Historically, microsegmentation policies have relied on network address-based information, but this method is difficult to implement, even harder to maintain, and completely unsuited for containers or the cloud.

IP addresses change frequently, which necessitates the constant updating of policies. That upkeep is somewhere between impractical and impossible in autoscaling environments, where addresses are ephemeral and always in flux. Further, addresses can only tell an operator where a communication is coming from and going to, not the character of what's trying to communicate; in other words, if the communication is authorized or malicious.

Therefore, verification should be based on software identity. It's a concept similar to user identity, but much more rigorous because it includes far more factors, such as a SHA-256 hash of a binary, executable signings, and portable executable (PE) headers. These identities are complex, relying on immutable and often cryptographic properties that, unlike an IP address, cannot be spoofed.

By using software identity, security is drawn closer to the assets themselves, and the control plane is decoupled from the network. As a result, applications can be moved to autoscaling clouds or containers without breaking policies, which makes identity-based microsegmentation a more secure methodology than microsegmentation based on network addresses. Another added benefit is the increased flexibility provided to DevOps teams. With policies that are constructed with the application at the core, developers can build and secure applications at once.

Stepv3: Microsegment to achieve a zero trust posture

Finally, a zero trust environment should operate according to the principle of least privilege, which grants no more rights than are necessary to accomplish required tasks, minimizing the number of network assets and potential attack paths that can access sensitive data and applications.

With the zero trust framework in place and up-to-date visualization of all network entities and communication pathways identified, security teams can now microsegment their networks and begin building policies. The policies should be designed to shrink the attack surface by eliminating unnecessary pathways, and should be based on software identity instead of ports and addresses. The process of building policies should be automated using machine learning and advanced analytics.

Once complete, this recipe yields great benefits: bad actors will have much less space in which to maneuver. Even when malware gains access to an endpoint or a host, the damage stops there. The security team gains fine-grained control over the most vital data and applications, and can apply the security best practice of least privilege all the way down to the level of individual applications on individual hosts or workloads.

The days of flat networks are coming to an end. No responsible security team can afford to leave the entire environment exposed to any attacker that penetrates the perimeter. Thankfully, by leveraging software identity-based microsegmentation and automation powered by machine learning, achieving zero trust is now within reach of every organization.

Tom Hickman is VP of Engineering at Edgewise Networks
Share this

Industry News

October 17, 2019

Acquia announced the availability of its new Developer Studio, a suite of tools designed to improve the productivity of Drupal developers.

October 17, 2019

Talend announced Talend Cloud is now available on Microsoft Azure, offering a secure and scalable Integration Platform-as-a-Service for collecting, transforming and cleaning data.

With embedded data quality and native integration performance, Talend Cloud on Microsoft Azure delivers the trusted data companies need to make real-time business decisions, accelerate advanced analytics, and meet regulatory compliance requirements.

October 17, 2019

Cognizant entered into an agreement to acquire Contino, a privately-held technology consulting firm.

October 16, 2019

Red Hat announced Red Hat OpenShift 4.2, the latest version of Red Hat’s enterprise Kubernetes platform designed to deliver a more powerful developer experience.

October 16, 2019

Gluware announced Gluware Automation v3.6, which extends the platform API capabilities including integrations with the Mist and Ansible platforms and introduces lifecycle management and infrastructure integration enhancements.

October 16, 2019

XebiaLabs announced that Wipro has renewed and extended its partnership with XebiaLabs as their Strategic Enterprise DevOps Partner across the globe.

October 15, 2019

Puppet announced enhancements to its current product portfolio and the public beta of a new project focused on providing a simplified continuous deployment workflow.

October 15, 2019

DBmaestro expanded its database automation platform to enable CI/CD and release automation for MySQL, MariaDB and Amazon RDS with DBmaestro DevOps Platform v2019.4.

October 15, 2019

Radware announced the launch of Radware Kubernetes Web Application Firewall (WAF), a comprehensive and highly scalable application security solution for Kubernetes-based environments.

October 10, 2019

CloudBees launched a new partner program that expands ISV partners’ ability to align with CloudBees offerings and the global Jenkins community.

October 08, 2019

Nureva announced a key update to the Jira Software integration with Span Workspace, Nureva’s cloud-based digital canvas for visual planning and collaboration.

October 08, 2019

Fugue announced support for Open Policy Agent (OPA), an open source general-purpose policy engine and language for cloud infrastructure.

October 03, 2019

Redgate announced the launch of SQL Compare v14, the latest version of its industry standard tool for quickly and accurately comparing and deploying SQL Server databases.

October 03, 2019

Harness announced the release of Continuous Insights, a new capability of its CD platform that enables organizations to see clearly into software delivery performance across their engineering and development teams without needing to manually collect, correlate, and report metrics that might take days or weeks.

October 03, 2019

OutSystems and Workato announced a partnership aimed at allowing organizations to rapidly realize innovation, time to value, productivity, and mission-critical objectives through readily available application connectors.