Applying Network Microsegmentation Maturity Levels in Critical Infrastructure using NSA Guidelines

Category

Level

NSA Recommendation

Byos Capability

Micro-

segmentation

Preparation

Define different security levels on the network based on identity and application access.

The Byos Management Console is the central control plane by which Administrators do the following:

• Set Security and Access Policies
• Determine which ports and services can be accessed from the the SDN Overlay network
• Determine which Edges and Guests can access other Edges. Granular control over the directionality of the requests

Basic

Organizations begin to transition toward service-specific interconnections and the isolation of critical data flows.

External Routing Rules as set and configured in the Byos Management Console allow administrators to control various routing parameters of their protected assets: 

• Does the asset have access to the internet?
• Does the asset have access to the SDN overlay? 
• Is the traffic fully or split tunneled? 
• Can assets talk to other assets on the LAN?

This is for maximum control of critical data flows.

Intermediate

Organizations deploy endpoint and application isolation mechanisms to more of their network architecture with ingress/egress controls between micro segments. Controls are tested and refined as needed.

By deploying Byos Secure Edge™ devices, Assets are isolated and protected from the network.

• No ports and services are exposed, therefore Assets cannot be discovered by bad actors.
• Malicious attempts to fingerprint, enumerate, and exploit Assets are dropped by the Edge.
• Assets cannot communicate to the network without going through the Edge.
• No packet leakage or DNS leakage from the Assets.

Advanced

Organizations employ extensive micro segmentation based on application profiles and data flows, with continuous authentication of connectivity for service specific interconnections.

Central management platforms are refined to provide automated and optimal visibility and security monitoring, including alerting on anomalous behavior.

• Admins can pre-load asset templates for specific types of communications. 
• There are several levels of authentication within the Byos solution
  • Edges authenticate to the Cloud upon activation and boot
  • Users must authenticate via TOTP to access the Edge locally
  • MFA access to the Management Console for administration of the solution
  • Unique Sessions and Keys are killed and created dynamically via changes in policies
• Alerts for activity in the Byos solution are aggregated in the Byos Management Console for simple 

Category

Level

NSA Recommendation

Byos Capability

Software-Defined Networking

Preparation

Organizations map network segments within their administrative purview and identify a roadmap for SDN component integrations

With the Byos Secure Secure Lobby™ Overlay, all SDN capabilities come standard out of the box; there is no manual configuration or ongoing management of SDN components needed for the underlying network and devices. You plug in the Byos Edges, set the policies, and boom, the SL™ Overlay is operational.

Basic

Integrate SDN components and develop a central control plane, along with management policy, network configuration rules, and task schedule (such as updates).

Map SDN APIs, establish roles, and configure the SDNC to make API calls using encryption and authentication.

With the Byos solution, there is no need to maintain any SDN APIs or the SDN controller, as this is done automatically by the platform. 

Byos has automated everything related to the operation of its SDN including encryption, key management, authentication, updating policy rulesets, etc. It is point and click for any changes, which are automatically applied at the Edge.

Intermediate

Test interconnectedness and set configurations to employ segmentation rules at the optimal level of granularity.

Create alert systems to notify administrators of anomalous or suspicious behavior.

Admins have maximum control over which Assets talk to which Assets, all while denying any non-approved traffic. The level of granularity employed is a choice made, not a limitation of the platform.

1. Creating Policy Groups with different external routing rules for Edges (read more here),
2. Zones with different Layer 2 and Layer 3 logical routing permissions,
3. Layer 4 control over visible ports and services in the SDN Overlay,

For example: if there is a compromised asset, talking over a non-standard port or communicating to the internet, the Admin isolates traffic to the SDN overlay to a single port and service. This effectively kills the bad actor's ability to do any more damage via their C2, but gives the Admin the ability to remediate the asset, removing the infection.

The Byos platform alerts Administrators about the state of the network, so they can remediate and troubleshoot as necessary.

Advanced

Employ advanced analytics and controls.

Test the network to determine which network paths would allow an intruder to move between segments laterally or otherwise. Restrict the paths as appropriate with strict access controls.

The Byos platform is the easiest solution for Software-defined Networking for Assets that are typically difficult to manage or protect. It was built for OT networks in critical infrastructure where networking needs to be high assurance - high security, high reliability, strict access.

Category

Level

NSA Recommendation

Byos Capability

Data flow mapping

Preparation

Identify locations where data is stored and processed and in which state the data components are stored.

Every Asset connected to a Byos Edge is auto-discovered, showing the exact ports and services that are exposed through the Asset's firewall. This gives the Administrator a high-level view of all of the Assets in their protected-Byos network.

Basic

Organizations begin the mapping of both physical and logical data flows. Mapping is primarily manual at this level.

Unencrypted data flows are transitioned to encrypted data flows or within encrypted network tunnels or protocols

The Byos Network Map displays all Edges and Assets within the SDN Overlay, showing which Assets are accessible through the Overlay. Every data flow in the network is autogenerated - Zone and Guest connections, discovered Assets, accessible re, etc. Every tunnel is encrypted with TLS1.3 on the outside and AES256 on the inside, with unique keys per tunnel.

Intermediate

Organizations have a complete list of applications and have identified critical data flows.

Some automation has been implemented to maintain the accuracy of mappings. Any anomalous data flows identified should be isolated or eliminated at this level.

Byos is the secure plumbing for all data flows in a micro-segmented architecture. Byos gives the administrator the foundation for setting up upper layer automation rule sets.

Advanced

Organizations have a complete inventory of data flows.

Automation monitors for controls, and mitigates all current, new, or anomalous data flows.

Unless an asset is connected to a Byos device, it won’t be discovered.