Links on microsegment.io

Implementing Sensible Network Segmentation

Fri, 18 Oct 2019 00:00:00 +0000

Packet Pushers Tech Bytes about Network Segmentation with Tufin

A new week, a new Tech Bytes Packet Pushers podcast. This time Tufin markets their policy management, which was a interesting show, but i have some comments.

i think it’s a valid point to say that automated firewall policy management can make a business more agile, especially considering how long the change process normally takes and how we do it today
the whole point about understanding the topology sounds like this is really very slow to implement
it’s hard to get any visibility from what i hear and how i understand the Tufin platform
Zoning or very wide segmentation is nice, but what you really want is to be able to do finer grained segmentation without modifying or rearchitecting the network
relying on hardware firewalls will never be able to free you from the constraints of those devices, especially throughput limits, the hardware cycle that will just happen every three or five years and the inability of a firewall to really be point to point and not zone to zone
i would assume that the integration of this is very hard, thanks god it is usually owned by just one team, but what about outsourcers and system integrators?

Sage Data Security on why network segmentation is important

Mon, 14 Oct 2019 00:00:00 +0000

Nice article from Sage Data Security on why network segmentation is important.

8 Microsegmentation pitfalls to avoid

Mon, 30 Sep 2019 00:00:00 +0000

I read a nice article by Ericka Chickowski on Darkreading the other day. The article gives some great guidance on what to do and not to do when starting your segmentation journey. Here are some comments.

The practice of microsegmentation takes the principles of least privilege to their logical conclusion by atomizing the isolating techniques of network segmentation. Security architects use microsegmentation to create security boundaries that can extend all the way into individual workloads by controlling East-West, or server-to-server, traffic flows between applications. The bulkheads put up through microsegmentation make it possible to better limit lateral movement of attackers, even in a cloudy world with no perimeter.

Undivided We Fall: Decoupling Network Segmentation from Micro-Segmentation

Thu, 12 Sep 2019 00:00:00 +0000

@alissaknight has published a great article on LinkedIn that talks about the history of segmentation and the use-cases and differences of network segmentation and micro-segmentation.

What i like about the article is that Alissa shows that network segmentation and micro-segmentation can be mutually exclusive, but can also co-exist. They do different things and they have different use-cases, which are also highlighted in the article.

The conclusion though is what i wouldn’t agree to, a Software Defined Perimeter does not solve a lateral movement problem nor will it implement Micro-Segmentation. The underlying problem of having no visibility into what to segment and how to structure your policy so it does not break applications is not solved by moving to another solution.

ACT IAC on Zero Trust trends

Sun, 25 Aug 2019 00:00:00 +0000

The American Council for Technology-Industry Advisory Council (ACT-IAC), a non commercial organisation for creating a more innovative government published a paper on Zero Trust

I would recommend this paper for anybody remotely thinking about Zero Trust, be it because you start thinking about introducing it or because it is just one of those trends that you want to catch up on.

There is a huge amount of truth and knowledge in this document and it is not having any marketing in it. I read it and thought this is sound advice for anyone that looks to improve their security posture with the ultimate, long term Zero Trust goal in mind.

Microservices and microsegmentation

Wed, 07 Aug 2019 00:00:00 +0000

Microsegmentation and microservices

found this article on DZone and wanted to quickly share my thoughts on it.

“Micro is big these days” - This statement is from a article showing the similarities and differences between microservices and microsegmentation. Of course we all know the differences, but we might have never thought about the similarities between the two approaches.

Microservices are about dissecting applications to smaller units and run those units independently instead of running them in a monolithic application. This creates the ability to decouple those functions and makes the service more scalable, independent from the other services and easier to maintain a single functionality. Often one team is responsible for one microservice. They maintain their interface, but consumers of the service do not have to worry about the inner workings as long as they stick to the public interface.