Microsegmentation is a method of heightening network security by logically splitting up workloads and data centers by implementing granular segmentation policies. Typically, organizations invest the majority of their resources in securing their network from external attacks through the use of firewalls or intrusion prevention systems (IPS). However, if a breach occurs in this system, intruders will have access to all of the information in the entire data system. In addition, actors who already have internal access would be able to access the entire data system, while they should only have access to parts of the system relating to their responsibilities.
A prominent example of this danger was the 2019 Quest Diagnostics data breach. Hackers gained access to the website of the American Medical Collection Agency (AMCA) and executed a man in the middle attack. AMCA is the billing collections vendor for Quest Diagnostics, and this breach allowed hackers to access the payment and personal information of 11.9 million Quest Diagnostics patients. If Quest Diagnostics had employed microsegmentation to protect their servers, this data security incident could have limited the misappropriation of data and patient records as it allows for greater internal protection of information by reducing potential server-to-server threats by securely isolating networks from each other. Cyberattacks can lead to actual damage as well. In 2015, hackers attacked an unnamed steel mill in Germany and disrupted control systems to the extent that a blast furnace malfunctioned and caused massive damage. Hackers entered the system using a spear-phishing attack, and due to the lack of internal security, the hackers were able to compromise numerous company systems, including the production network. Microsegmentation could have reduced the intensity of the attack, limiting the hacker’s control to the initially infected system, and thus could have prevented the blast furnace from malfunctioning.
Microsegmentation is different from network segmentation in that microsegmentation is optimal for increasing security for server-to-server traffic, which is found within a data center. Network segmentation is optimal for increasing security for client-to-server traffic, which is the transfer of data between a data center and a network external to the overall data center network. With companies using and processing more and more data, amounts of internal server-to-server traffic are increasing and becoming more vital to the daily functions of all organizations. Securing this traffic is crucial, and microsegmentation is one of the best methods for doing so.
Ultimately, the optimal method of securing a data system is not just network segmentation or microsegmentation, but an effective combination of both. The internal security that microsegmentation provides would be worthless without the perimeter defenses contributed by network segmentation, and vice-versa.
The implementation of microsegmentation varies depending on the situation. In organizations where security is of the utmost importance, more zones of control may be implemented to provide for additional protection. In a hospital, for example, certain medical technologies such as X-rays or MRIs contain and process important regulated information that must be kept secure. Thus, each of these machines may be given its own segment to ensure that the data is kept safe, even in the event of a security breach. However, devices that do not hold essential data do not have to be assigned their own segment. Those devices would likely be assigned to segments with several other devices, given that they do not contain regulated data. But, users, not just devices, must be segmented as well, to protect the network from external threats such as phishing emails. Besides, systems should be segmented based on their purposes too — for example, there are hospitals that have networks dedicated to IoT devices. The same principles would apply to other organizations as well. The importance of the data contained and analyzed on a server or device dictates the level and intensity of microsegmentation that should be implemented. Users should have limited access, as well. Also, specific networks should be segmented based on the permissions or purposes of the devices within them.
You can conduct a security risk assessment of your networks and devices to prepare a comprehensive segmentation strategy. Your segmentation strategy should always be driven by the criticality of your assets and the data they manage.
At 24By7Security, we are Cybersecurity & Compliance Specialists with extensive hands on experience helping businesses build a defensive IT Infrastructure against all cyber security threats. We are your first line of defense against a cyber attack. Schedule a consultation with us today.