There’s Nothing Micro About Microsegmentation

I started my exploration of the microsegmentation area by semantically deconstructing the title. The end result? Microsegmentation options assist outline community segments as small as a single entity. Whereas I consider it is a helpful strategy to intuitively perceive the know-how, my couple hundred hours of analysis revealed that the scope for microsegmentation is gigantic. It’s so massive that I’ve to invalidate the preliminary “single-entity community section” definition to seize the know-how as exhaustively as doable. Which means that microsegmentation shouldn’t be a single-entity train, and it’s not outlined solely utilizing community constructs.

Microsegmentation is a A number of-Entity Assemble

In absolute phrases, whenever you outline a microsegment, you dictate the insurance policies utilized to a single entity, such that it permits some site visitors or requests whereas blocking others. Nevertheless, site visitors all the time flows between two entities, so each endpoints have to be thought of.

On one finish, you have got the entity you wish to isolate—let’s say a container. On the opposite, you have got all the opposite entities that may talk with the container you wish to isolate. It’s value noting that these requests are possible bidirectional, however for the sake of simplicity, we are going to assume ingress site visitors solely.

When seeking to isolate a container, refined insurance policies (aside from enable/block) want to contemplate requests from a variety of entities, which embody different containers, digital machines, builders and directors, operate as a service (FaaS)-based microservices, exterior APIs, monolithic functions, IoT gadgets, and OT gadgets.

The underlying applied sciences that may outline insurance policies between containers and all these different varieties of entities embody container networking interfaces for container-to-container communication, service meshes for service-to-container communication, ingress controllers for cloud or information heart workload-to-container communication, safe shell for administrator-to-container communication, and so forth.

It shortly turns into apparent that defining these insurance policies includes a whole lot of elements that span throughout disciplines. Some options select to deploy brokers as a single level for managing insurance policies, however organizations more and more favor agentless options.

When working with a microsegmentation answer, the day-to-day actions of defining and managing these insurance policies won’t contain instantly working with all these applied sciences as a result of they summary all these features and supply an intuitive GUI.

The rationale I’m highlighting that is to judge an answer. Relying on the varieties of belongings you want protected, the supported entities are by far a very powerful analysis facet. If you wish to shield IoT gadgets, however an answer doesn’t help that, it must be instantly excluded.

Microsegmentation is Not Simply Community-Based mostly

These with a networking background, myself included, borrow the segmentation idea from firewall-defined community segments. It’s each helpful and related, and you’ll see this idea being carried over in distributed firewall options supplied by the likes of Aviatrix, VMware, and Nutanix.

However there are two extra methods of isolating entities apart from utilizing community constructs:

1. Utilizing identity-based coverage enforcement. This affords controls which are impartial of community constructs reminiscent of IPs. Entry could be ruled utilizing attributes reminiscent of working system sort, patch standing, VM title, Energetic Listing teams, and cloud-native identities like labels, tags, and namespaces. Options may assign labels or categorize entities natively to take away dependencies on third-party labeling methods.
2. Utilizing process-based coverage enforcement. For instance, the microsegmentation options can monitor the operating processes on each entity, capturing detailed context for every course of and its related libraries. Course of and library hashes could be assessed towards a risk information feed to determine malicious code execution and detect variation from recognized good processes. Processes can embody functions, providers, daemons, or scripts, and particulars reminiscent of course of title, path, arguments, person context, and mum or dad processes. If a malicious course of is detected, the entity is then remoted from speaking with the remainder of the community.

On the finish of the day, you possibly can’t lower off communications with out involving the community, however the microsegmentation coverage itself doesn’t need to be depending on networking constructs, reminiscent of 5-tuples.

Subsequent Steps

When evaluating microsegmentation options, I like to recommend you strategy them as extremely refined designers of safety insurance policies. Most frequently, an entity could be remoted simply by blocking ports. So, the effectiveness of the answer will rely on whether or not it will probably help all of the entities you have to shield and the way straightforward it’s to handle all of the coverage permutations.

To be taught extra, check out GigaOm’s microsegmentation Key Standards and Radar studies. These studies present a complete overview of the market, define the standards you’ll wish to take into account in a purchase order resolution, and consider how quite a lot of distributors carry out towards these resolution standards.

If you happen to’re not but a GigaOm subscriber, you possibly can entry the analysis utilizing a free trial.