the microsegment

segment all the things

Mitre ATT&CK and Segmentation

When people think about their strategic IT security projects, they often think of the last incident they were affected of and try to mitigate that, often by using technology only. This is a valid approach and probably is not so wrong, because we often see waves of incidents rolling in, the wannacry wave, other ransomware waves, certain exploit kits or malware waves. So it makes some sense to concentrate on those threats when they happen.

Posted by Alexander Goller on Friday, November 8, 2019

The importance of outbound policy

Bill Cheswick, a pioneer in internet firewalls got, besides establishing what we today know as the perimeter firewall, famous for the below quote to describe his ideas on perimeter firewalls: A sort of crunchy shell around a soft, chewy center. The quote and metaphor is still used a lot by security professionals around the world, to describe the state of the internal network behind the perimeter firewall. A crunchy shell in the 1990s was exactly the thing you needed to be more secure from the threats found at that time.

Posted by Alexander Goller on Tuesday, November 5, 2019

Implementing Sensible Network Segmentation

Packet Pushers Tech Bytes about Network Segmentation with Tufin A new week, a new Tech Bytes Packet Pushers podcast. This time Tufin markets their policy management, which was a interesting show, but i have some comments. i think it’s a valid point to say that automated firewall policy management can make a business more agile, especially considering how long the change process normally takes and how we do it today the whole point about understanding the topology sounds like this is really very slow to implement it’s hard to get any visibility from what i hear and how i understand the Tufin platform Zoning or very wide segmentation is nice, but what you really want is to be able to do finer grained segmentation without modifying or rearchitecting the network relying on hardware firewalls will never be able to free you from the constraints of those devices, especially throughput limits, the hardware cycle that will just happen every three or five years and the inability of a firewall to really be point to point and not zone to zone i would assume that the integration of this is very hard, thanks god it is usually owned by just one team, but what about outsourcers and system integrators?

Posted by Alexander Goller on Friday, October 18, 2019

Ideas on Segmentation metrics (part three)

Please check out Part one and part two of this series Continuing our series about metrics for segmentation, there are a couple more angles how you can measure the effectiveness of your segmentation. Metrics from previous parts In the two previous parts, i introduced a couple of examples on how to measure your security segmentation. How many segments do you have? How exposed is something? How big is the blast radius if things go wrong?

Posted by Alexander Goller on Wednesday, October 2, 2019

Scaling up vs scaling out your security segmentation

If you follow discussion on running cloud native, monolithic or more traditional applications you may have stumbled over the terms “scale up“ and “scale out“. Don’t feel bad if you don’t know these, because they were formerly just “vertical scaling“ (scale up) and “horizontal scaling“ (scale out). What is scale up? Scale up means, if you have e.g. a server in your datacenter running your database, to make the database faster or have more concurrent client getting served, you would add more hardware to that server and just make it the biggest machine available.

Posted by Alexander Goller on Monday, September 9, 2019

Ideas on Segmentation metrics (part two)

Please check out Part one of this series of articles Metric One: Do you have more than one segment? This question is, of course, more of a rhetorical question, but there is a point about this one. Of course almost all companies have more than one segment. Most companies use VLANs extensively. We break out DMZs and internal data center LANs of course. Sometimes we use firewall interfaces between those VLANs or segments and treat them as zones.

Posted by Alexander Goller on Monday, September 2, 2019