Downloaded 28 times
Uploaded byAlgoSec
Create and Manage a Micro-Segmented Data Center – Best Practices
The document outlines the importance of micro-segmentation in securing data centers against lateral movements by attackers. It discusses the challenges of implementing segmentation, including the need for hardware and zoning, as well as the necessity of maintaining filtering policies that adapt to evolving application connectivity requirements. The focus is on creating a structured approach to network segmentation that enhances security without compromising essential business operations.
More Related Content
Similar to Create and Manage a Micro-Segmented Data Center – Best Practices
Create and Manage a Micro-Segmented Data Center – Best Practices
- 1. LESSONS FROM THEVAULT HOW MICRO-SEGMENTATION PROTECTS YOUR DATA CENTER’S PRECIOUS JEWELS Avivi Siman-Tov Senior Product Manager
- 2. Welcome Have a question?Submit it via the chat This webinar is being recorded! Slides and recording will be sent to you after the webinar
- 4.
- 5. LEGACY DATA CENTERARCHITECTURE Users Servers Outside World, Business partners Perimeter Firewall East-West traffic North-South traffic
- 6. WHY THIS ISRISKY • No filtering capabilities controlling east-west traffic • Allows unrestricted traffic • Between internal users’ desktop/laptops and servers • Between servers in different segments ONCE ATTACKERS GAIN A FOOTHOLD – FREE LATERAL MOVEMENT
- 7. SEGMENTED DATA CENTER ARCHITECTURE Users Zone Server Zone2 Outside World, Business partners, Perimeter Firewall Server Zone 1 East-West traffic North-South traffic
- 8. SEGMENTED MORESECURE • Introduce filtering choke-points between zones • Allows control of east-west traffic • Lets organizations restrict lateral movement between zones • How can we make this a reality?
- 9.
- 10. CHALLENGE #1: INTRODUCINGCHOKE POINTS A major effort involving: • Hardware • Cabling • Reconfigure switching and routing TRADITIONAL DATA CENTER • Built-in firewalls as part of the infrastructure • No extra hardware needed VIRTUALIZED NETWORK / SDN
- 11. Challenge #2: Zoning •How many zones to define? • Which subnets should reside in each zone?
- 12. A ZONING TRADE-OFF BetterSecurity Micro- segmentation Define many small zones Maintenance - Define the right policy N zones N*N traffic directions
- 13. CHALLENGE #3: FILTERINGPOLICY BETWEEN ZONES • Traffic between zones must be explicitly allowed by policy • No critical business traffic will be blocked by accident • Challenge: discover and characterize this traffic Did you know: VMware NSX’s default policy is “allow all”
- 14.
- 15. The business-application perspective •East-West traffic is generated by business applications • Each business application has: • Servers supporting it • Clients accessing it • Business application connectivity requirements: • Server-to-server traffic flows • Client-to-server traffic flows
- 16. § Segmentation for businessapplications Human-accessible systems Application Servers Infrastructure servers
- 17.
- 18. Is your organizationdisciplined? Yes if: • All applications are documented • Applications’ connectivity requirements are documented • Documentation is machine readable Then “discovery” is easy! What if documentation is missing / outdated ?
- 19. Discovery from traffic NetFlow/ sFlow • Routers • VMWare virtual switch • NetFlow statistics broker Full capture traffic • Switches • Network TAP devices • Packet broker Summarize Analyze Correlate
- 20.
- 21.
- 22.
- 25.
- 26.
- 27.
- 28.
- 29. Maintaining the segmentation Zoningremains stable over time but: • application connectivity requirements evolve • filtering policies need to change over time • Application-aware and change V management processes • Visibility filtering policies comply with zoning
- 30. Change management processes •Hybrid network: • Software-defined data center • traditional networking outside data center • Application connectivity is also north-south GOAL: SINGLE CHANGE WORKFLOW FOR ALL FILTERING TECHNOLOGIES
- 31. • Identical forNorth-South and East- West • Indifferent to network technology • Abstracts away filtering device details
- 32. • Outside datacenter (traditional)
- 33. • Inside datacenter (virtualized)
- 35. REMEMBER Focusing your securityon outsider threats isn’t enough
- 36. Plan • Discover • Design •Document Maintain • Visibility • Segmentation-aware change processes
- 37. What are yourplans for filtering east-west traffic? • Already implemented • Planning to implement over the next 6 months • Planning to implement over the next 6-12 months • No plans POLL Please vote using the “votes from audience” tab in your BrightTALK panel 37
- 38. More Resources www.algosec.com/resourc es WHITEPAPER SOLUTIONBROCHURE PPT PROF. WOOL EDUCATIONAL VIDEOS
- 39. July 24 Network securityat the speed of DevOps By: Anner Kushnir, VP Technology Aug 7 Network Security Policy Changes – Quickly & Safely By: Asher Benbenisty, Director of Product Marketing https://www.algosec.com/webinars
- 41.
- 42. THANK YOU! Questions canbe emailed to marketing@algosec.com