It's time for a new approach to segmentation

Over the last 30 years, enterprises have deployed large, open, flat networks to provide convenient connectivity. These networks have been built to allow any device to potentially access any other resource on the network, including access from all branch offices and remote user PCs.  

Unfortunately, these networks provide the same “easy connectivity” for adversaries who successfully compromise any device on the global network. Most of an organization's sensitive apps and data are accessed via servers. In flat networks, adversaries can move through the network and directly connect to any server to find vulnerabilities or configuration errors that allow those servers to be compromised.

According to a recent Rapid7 research report, 96 percent of the company's pen tests of internal networks found at least one server with vulnerabilities that could be exploited to compromise the server.

Network segmentation does not solve the problem

To reduce the openness of such environments, network administrators typically segmented users from data center servers by putting each into different subnets and putting firewalls in between. Beyond that, they sometimes segmented the data center so that the servers of one application cannot connect to the servers of other applications. Combining this approach  with network segmentation in the access network puts users/devices into different subnets than servers, and then configures rules to manage the flow of traffic between the subnets. 

But configuring static and complex firewall rules based on network segmentation at the subnet level is a blunt instrument that is time consuming to create and maintain. Worse than that, it is ineffective. There are multiple reasons for this.

First, data center servers must connect to many other servers. For example, the web server needs access to the database server, but so does the business intelligence application that analyzes the contents of the database, the scanner that accesses the list of running processes in the server as well as the back-up server, patch servers, log servers, boot servers, etc. Any compromise of such servers can easily allow an adversary to traverse network segmentation boundaries to access other servers on any data center subnet.

And some of those servers may even use Domain Admin credentials to connect to other servers. If the adversary pops open one of those servers, it is game over. Such “shared services servers” are a prize find for adversaries because they provide a direct path to so many other internal servers. 

Second, while one tends to think of servers running only a few services each (like http/s and RDP), Windows Server 2016 can have over 100 different services listening on almost as many ports.  Each of those services could have a vulnerability or configuration error allowing an adversary to compromise it once a foothold is established.

Third, the corporate access network cannot be segmented in a manner where subnets in the corporate network clearly map to subnets in the data center. IP addresses might indicate where on the network a user or device connected, but they rarely can be correlated to user authorization, as users with very different access privileges are often operating on the same floor or the same branch office, and, therefore, are on the same subnet. 

Furthermore, source IP addresses have no value at all in assessing whether the user is who he or she claims to be, or whether the device the user is operating on is “clean.”  Compromised devices can have IP addresses that “pass the test” from a firewall’s point of view.

As a result, traditional network segmentation, both in the data center and the access network, is ineffective at thwarting adversaries’ ability to move laterally through the network to access valuable data, once they gain an internal foothold.   

A new approach to segmentation: Trust awareness

Network-based firewalls between users and servers create, at best, a speed-bump to protect against compromises moving from the corporate access network into servers and applications. At this is an interface between users and servers, organizations don’t need a speed bump, they  need a barrier that can execute trust-aware policies for controlling access to applications. Trust-aware means the access control system should act on deep and extensive knowledge about the user, the device being used, its location and the sanctity of the software on that device.  

Trust aware access uses multifactor authentication to verify that users are truly who they claim to be and confirms their authorization before they can interact with or even see protected servers and applications. It also verifies that the software running on an authorized users' devices is secure and that the devices have not been successfully compromised.  And by creating a zero-trust partition, trust aware access reduces the attack surface for servers to just the presently active authorized users, and then further reduces the attack surface so that even compromised devices of authorized users can’t interact with or see protected applications and servers.

Such a barrier between corporate access networks and servers enables trusted access control, which prevents adversaries who gain a foothold inside the network from proceeding any further.

It isolates servers from any users and devices that are not authorized to access them.  Because trusted access control uses application-layer tunnels to reach the servers, authorized users do not have access to a network of servers, they don’t even have access to the whole front-end server. Rather they only have access to the authorized port on the authorized server -- not all the open ports that server is likely to have. This defeats server exploitation by mitigating server vulnerabilities and configuration errors by removing access to them by unauthorized users.

Trusted access control also uses integrated multifactor authentication to defeat credential theft; it is transparent to users, easy to deploy to all applications and proven to work.

Traditional network segmentation still has a role

With such a powerful boundary between user devices and servers, do organizations need to do any traditional network segmentation at all?

The answer is, probably not in the corporate access network. But traditional network segmentation between servers in the data center can add a layer of security.

In the diagram above, user access to the green, blue and red servers is protected using trusted access control. And then traditional data center network segmentation is used to eliminate lateral paths between the groups of servers. If additional segmentation is needed within the server partitions described above, or to further hone the access of the shared servers to the rest of the data center, data center micro-segmentation or software-defined networking solutions can be deployed to achieve more granular control over the data center topology. 

Trusted access control and data center network segmentation can also be used to secure access to specific business-critical applications by creating a secure enclave that protects components of such applications from lateral movement from other servers in the data center that aren’t as well protected on the front end. 

There are many examples where data center segmentation itself may not be effective, but when combined trusted access control it becomes a very important component of an overall security-by-segmentation strategy.

Thinking differently about segmentation

Any device on the corporate access network can be successfully attacked and compromised by today’s sophisticated adversaries, creating a foothold for further attacks. In a flat network, it is nearly impossible to stop the adversary’s movement.

However, inserting a trust-aware boundary between corporate access networks and servers creates zero-trust partitions that strand adversaries before they can reach critical assets.

As enterprises embrace hybrid cloud operating models, the enterprise is exposed to new attack vectors, and traditional approaches to segmentation and access control introduce even more cost and complexity while becoming even less effective. Trusted access control is topology independent, making it ideal for protecting hybrid environments.