Several recent high profile attacks and the executive order signed by the Biden administration make it clear that conventional network security practices are unable to provide effective protection for today’s networks. In place of those perimeter-based models, microsegmentation has emerged as a best practice for modern security. As organizations spread their distributed teams across the world and device fleets become increasingly diverse, security professionals must be prepared to protect against an evolving world of increasing threats.
In this guide, we will introduce the principles of microsegmentation and examine how the strategy has earned its place as an effective security strategy to make networks more secure against malware, ransomware, and other security threats that have become common in the new world of work.
Jump to a section…
Attack Surface Reduction Through Microsegmentation
How To Prevent & Detect Lateral Movement
Develop internal network intelligence
Implement edge microsegmentation
What Is Zero Trust Networking?
What Is Microsegmentation?
Microsegmentation is the practice of strengthening an organization’s security posture by dividing its network into distinct protected zones. By creating zones with granular precision, microsegmentation makes it easier not just to prevent cyber attacks, but also to detect and remediate any security incidents that do occur.
Edge microsegmentation is a particularly powerful variation of this practice that combines network-based and host-based microsegmentation. Applying microsegmentation at the edge of a single endpoint allows for visibility into and control over all ingress and egress traffic. The endpoint sits within its own protected microsegment in the network, eliminating the need for an agent on the device operating system.
In a perimeter-based approach, security professionals focus on monitoring north-south traffic crossing the network firewall into the organization. But edge microsegmentation enables visibility into traffic as it travels both north-south across the perimeter and east-west within the network hierarchy. This increased visibility empowers network administrators to design the specific policies governing the flow of traffic in and out of each microsegment, eliminating the threat of lateral movement and strengthening overall network security.
Learn more about the fundamentals of this security strategy in our complete primer: “What Is Microsegmentation?”
Attack Surface Reduction Through Microsegmentation
Attack surface reduction — another primary benefit of edge microsegmentation — allows administrators to secure individual endpoints and protect against the various attack vectors that emerge in modern networks. These attack vectors form your organization’s attack surface, and each one represents a point where someone can exploit or compromise your network.
Vulnerabilities arise wherever users can either enter or extract information, since attackers can also use those same entry points to gain access to the network undetected. Some common attack vectors include:
- Unpatched software
- Insecure APIs
- Unprotected access
- Weak encryption protocols
- Users and employees
- Weak, reused, or default passwords
- Exposed internal network resources.
Edge microsegmentation reduces the available attack surface by protecting endpoints inside dedicated microsegments. That allows security administrators to control the traffic flowing in and out of the microsegment, eliminating endpoint exposure and preventing lateral movement, which is common during ransomware attacks.
Ready to reduce your organization’s attack surface? Learn how in our “Guide To Attack Surface Reduction Through Microsegmentation”.
What Is Lateral Movement In Network Security?
Lateral movement is a specific technique that attackers can use to explore a network, locate additional resources to help in their attacks, and gain access to sensitive data. One of the most threatening elements of lateral movement is that it allows attackers to avoid detection while maintaining their network access and escalating privileges in search of valuable data.
Although lateral movement technically refers to the tactics that unfold after gaining access to a network, there are a few crucial preliminary steps that enable attackers to eventually use lateral movement in service of their attack goals:
- Disable security tools: Today’s modern security researchers have automated the process of searching for and identifying existing security software running on a network. Unhooking AV and EDR solutions effectively disables them, allowing attackers to persist in their activities undetected.
- Internal reconnaissance: Attackers first familiarize themselves with the inner workings of a network by observing legitimate network traffic. By studying network hierarchies, learning naming conventions, and identifying high-value information, attackers can map out network architectures and set their plan of attack.
- Credentials and privileges: Sometimes, attackers manage to obtain network credentials (and the privileges they are allowed) from legitimate users through brute force attacks, social engineering, phishing attacks, typosquatting, and other means.
- Gaining and escalating access: This is the stage when lateral movement occurs. As attackers move deeper into the network, they repeat the internal reconnaissance and credentials and privileges steps in a cyclical process that allows them to escalate access until the attack is complete.
Dive deeper into this specific type of attack tactic in our full article: “What Is Lateral Movement?”
How To Prevent & Detect Lateral Movement
One of the reasons lateral movement is such a dangerous tactic is that it can often go undetected by disguising itself as legitimate network activity. Even so, effective strategies do exist to make it easier for security teams and network administrators to prevent lateral movement from happening and help them detect it sooner if it does occur.
Audit your security hygiene
The first way to prevent lateral movement is to strengthen the fundamentals of your security posture. Map out the entire network architecture, data flows, and devices connected, so that you can identify, isolate, and eliminate vulnerabilities at every level of your organization.
Develop internal network intelligence
Visibility and control help network administrators develop the internal network intelligence needed to establish a benchmark of regular traffic. The deeper your understanding of what qualifies as verified and permitted activity on the network, the easier it will be to identify outliers and trigger meaningful security alerts.
Assess your endpoint security
In today’s modern, distributed workforce, individuals connect to untrustworthy home and public networks from a variety of devices located all around the world. It’s critical for organizations with distributed teams and remote-friendly policies to secure each individual endpoint
Implement edge microsegmentation
Edge microsegmentation is one of the strongest ways to prevent and detect lateral movement. Isolating each individual endpoint through edge microsegmentation decreases security risks by reducing the available attack surface and increasing your control over the endpoint
Read our article on “How To Prevent & Detect Lateral Movement” in order to protect your network from the dangers of this attack tactic.
What Is Zero Trust Networking?
Zero Trust is a model of security that eliminates the implicit trust once granted to entities operating within a network perimeter. Instead, Zero Trust architecture defaults to denying all requests and provides access only after it can establish confidence in the user, the device, and the network context. Then it continuously verifies those connections and identities, even if they have been verified in the past.
One of the key principles of Zero Trust thought is that attacks can originate either inside or outside a corporate system. Based on that tenet, Zero Trust takes the adage “never trust, always verify” as its guiding motto. To implement security strategies that support a Zero Trust approach, security architects must combine the benefits of a variety of different tools and techniques.
Learn more about how to use Zero Trust principles in your security strategy in our primer: “What Is Zero Trust Networking?”
Microsegmentation eliminates complexity, decreases risk, and strengthens security postures. At the same time, microsegmentation also empowers security administrators to more quickly and effectively detect, contain, and remediate attacks that do occur. As today’s gold standard of Zero Trust networking, edge microsegmentation is a critical security component for modern organizations operating across distributed and remote workforces around the world.
We created the patented Byos μGateway to offer a plug-and-play hardware-enforced microsegmentation solution to those organizations. Are you ready to implement this modern approach to security architecture and protect your corporate endpoints regardless of device type or location? Get in touch with us here