NIST's work underpins most of today's top science and technology challenges, such as cyber-security, biometrics, voting equipment standards, and nanotechnology, just to name an important few. ~ Sherwood Louis "Sherry" Boehler. Former Member of the U.S. House of Representatives from New York and Chairman of the House Science and Technology Committee

1. PRESIDENT DONALD TRUMP
CYBERSECURITY
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
As cybersecurity attacks proliferate across corporate and government networks,
network segmentation and access control are becoming standard approaches
for addressing the vulnerabilities inherent in today’s connected enterprise. It
can be especially helpful for agencies with classifed or sensitive data sitting on
internal resources, but with connections through the network to uncontrolled
endpoints.
Network segmentation is an approach advocated by the National Institute
of Standards and Technology's Cybersecurity Framework (CSF). It involves
segmenting the network into smaller network systems and separating groups of
systems and networks from each other. Isolating or fltering to limit access
between network segments improves security and provides better access
control. [Emphasis Supplied]
Feds Can Achieve Better Security Through Network Segmentation
MeriTalk. July 9, 2018, accessed August 13, 2018
https://www.meritalk.com/articles/feds-can-achieve-better-security-through-network-segmentation/
__________________________________________________________
SCIENCE & TECHNOLOGY HIGHLIGHTS
TRUMP ADMINISTRATION – YEAR ONE
https://www.whitehouse.gov/wp-content/uploads/2018/03/Administration-2017-ST-Highlights.pdf
We're on the verge of new technological revolutions that could
improve, virtually, every aspect of our lives, create vast new wealth
for American workers and families, and open up bold, new frontiers
in science, medicine, and communication.
President Donald J. Trump

2. CYBERSECURITY & GOVERNMENT IT SERVICES
Our goal is to lead a sweeping transformation of the Federal Government's
technology that will deliver dramatically better services for citizens and
stronger protection from cyberattacks.
On April 28, 2017, President Trump signed Executive Order 13794 –
Establishment of the American Technology Council.
The Administration worked with Congress to pass the 2018 National Defense
Authorization Act, which included a section on modernizing government
technology. [President Trump demonstrated his commitment to the importance
of Federal scientifc exploration by requesting $151.2 billion for Federal R&D
investment in the FY 2018 budget – a 2% increase over FY 2017. Furthermore,
the President's FY 2018 Budget Request would result in the highest percent of
the budget for the conduct of R&D since the FY 2014 Budget Request. In
August, OSTP and OMB released the annual Administration R&D budget
priorities for FY 2019, advising agencies to prioritize basic and early-stage
applied research, the foundation for the development of transformative
commercial products and services.] Source: The White House. Empowering
Americans to Innovate: Science and Technology Highlights Since Inauguration.
March 7, 2018. https://www.whitehouse.gov/articles/science-technology-in-the-frst-year-of-the-
trump-administration/
On May 11, 2017, President Trump signed Executive Order 13800 –
Strengthening the Cybersecurity of Federal Networks and Critical
Infrastructure.
On December 5, the National Institute for Standards and Technology released
the second draft of the proposed update to the Framework for Improving
Critical Infrastructure Cybersecurity.
__________________________________________________________

3. ANALYSIS OF NETWORK SEGMENTATION TECHNIQUES
IN CLOUD DATA CENTERS
By Ramaswamy Chandramouli, Ph.D, M.S., B.S. Supervisory Computer Scientist and Director of
NIST Personal Identity Verifcation Program, Computer Security Division, Information Technology
Laboratory, National Institute of Standards & Technology.
https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=918440
[Excerpt]
Cloud Data centers are predominantly made up of Virtualized hosts. The
networking infrastructure in a cloud (virtualized) data center, therefore, consists
of the combination of physical IP network (data center fabric) and the virtual
network residing in virtualized hosts. Network Segmentation (Isolation), Trafc
fow control using frewalls and IDS/IPS form the primary network-based
security techniques with the frst one as the foundation for the other two. In
this paper, we describe and analyze three generations of network segmentation
techniques – Virtual Switches & Physical NIC-based, VLANbased & Overlay-
based. We take a detailed look at the overlaybased virtual network
segmentation and its characteristics such as scalability and ease of
confguration.
With the increasing adoption of cloud services by large enterprises that have to
host multi-tier applications, the data center network administrators need a
fexible virtual networking topology with capability to obtain the required
isolation through network segmentation.
At the same time, it is necessary that these virtual network segments span
multiple, arbitrary IP subnets of the data center and also several hypervisor
clusters. As of now, the only virtual networking technology that can provide
these capabilities without a great deal of physical network reconfguration or
addition of networking resources is the overlay-based virtual networking.
This degree of independence between the virtual networks and the physical
networks provided by overlaybased techniques also provides the scalability
and confguration ease that are needed for maintaining the logical network
segmentation within large data centers. The foundational security for IaaS
cloud consumer workloads thus becomes an economically and operationally
viable proposition.

4. DOES NETWORK MICRO-SEGMENTATION
PROVIDE ADDITIONAL SECURITY?
By Steve Jaworski, GSEC and Mohammed Haron, GSEC
SANS Institute
September 8, 2018, accessed August 13, 2018
https://www.giac.org/paper/gsec/5496/network-micro-segmentation-provide-additional-security/11034
Network segmentation is a concept of taking a large group of hosts and creating
smaller groups of hosts that can communicate with each other without
traversing a security control. The smaller groups of hosts each have defned
security controls, and groups are independent of each other. Network micro-
segmentation takes the smaller group of hosts by confguring controls around
individual hosts. The goal of network microsegmentation is to provide more
granular security and reduce an attacker’s capability to easily compromise an
entire network. If an attacker is successful in compromising a host, he or she is
limited to only the network segment on which the host resides. If the host
resides in a micro-segment, then the attacker is restricted to only that host.
Network segmentation is a defense in depth strategy that helps prevent
attackers from moving laterally within an organization’s network. (AlgoSec,
n.d.) A lateral movement within a network is commonly called east-west trafc.
Segmentation creates choke points within the network and is separated by a
security control and is also a way to reduce the attack surface of an
organization (Northcutt, n.d.).
Breaking up a network with VLANs and Layer 3 network interfaces also
segments the network but will not provide efective security. By default, the
network will permit all trafc between VLANS.
Access Control Lists (ACLs) on the Layer 3 network interfaces can be used to
restrict trafc, but they are limited in their capabilities.
The ACL's on routers are not the same as frewall rules, depending on the
network vendor they may slow down trafc, and they can become too complex
to manage if too many exceptions are required. Layer 3 ACLs are most efective
when they are small and used for explicit denies.

5. 4 LAYERS OF ENTERPRISE SECURITY
By Patrick Marshall. GCN
Apr 12, 2018, accessed August 13, 2018
https://gcn.com/articles/2018/04/12/cyber-tools.aspx
The new cyber landscape. Apr 13, 2018
https://gcn.com/articles/2018/04/13/cyber-landscape.aspx
Although threats to government IT security continue unabated, agencies do
have some mature solutions for protecting enterprise assets from malicious
intruders.
With tight budgets the only constant, agencies face a fast-evolving range of
challenges – from securing hybrid networks and authenticating users who
connect via mobile devices and the cloud. For IT managers at government
agencies, it might seem like a perfect storm is gathering: tight budgets and
demands to upgrade aging network infrastructure; mandates to move
applications into the cloud and beyond their traditional network security
perimeter; calls to support rapidly growing numbers of users on mobile devices;
and, above all, warnings from intelligence agencies to expect ever greater
cyberthreats.
Tools that verify trafc, isolate networks, prevent data loss and protect the
endpoints are helping agencies lock down government data.
“We are constantly fguring out how to whack the next mole and beat the bad
guys at the next level of the game,” said Susannah Schiller, deputy CIO at the
National Institute of Standards and Technology. “It is a constantly evolving
thing, and it has been getting worse every year.”
According to agency staf, vendors and analysts alike, there has been a major
shift in network security strategy. Trying to contain data behind network
perimeters secured by frewalls and other tools is giving way to data-centric and
user-centric strategies that aim to protect data wherever it resides – whether it's
within the agency's perimeter, in the cloud or on a mobile device.

6. “As we move to more of a distributed data mode, with users on
nongovernment-furnished mobile devices, we have to move the security
protection closer to the asset, and we have to tie security policies to the user,”
said Chris Townsend, Symantec's vice president for federal. “That approach
aligns more to a risk mitigation strategy where we quantify the value of the
assets [and] risk of loss and then align scarce security resources accordingly.”
While pushing the federal government in that direction, the 2017 “Report to
the President on Federal IT Modernization” noted that “agencies have
attempted to modernize their systems but have been stymied by a variety of
factors, including resource prioritization, ability to procure services quickly,
and technical issues.”
No one advocates abandoning the traditional protections – frewalls and secure
routers, network analytic and intruder detection tools, for example. However,
new strategies are helping agencies verify trafc, isolate networks, prevent data
loss and protect the endpoints in support of locking down government data.
For efective network segmentation, a dedicated security control should exist
between hosts and networks.
Network segmentation does not always reduce the attack surface enough.
Network micro-segmentation is a more granular approach to preventing lateral
movement between hosts where it is more challenging to use traditional
hardware security controls (SDX Central, n.d.).
One network segment could still contain hundreds, if not thousands of hosts. If
a malicious actor compromises a host in a segment, the goal of network
microsegmentation is to prevent or detect the compromise of additional
systems.
By limiting the attacker's scope, the security team should have a better chance
of detecting and remediating the breach, limiting further damage.
__________________________________________________________

7. MICROSEGMENTATION
One increasingly popular technology that can help with implementing a zero-
trust model is microsegmentation, which uses software-defned virtual networks
to create myriad isolated networks. Whereas standard networks use frewalls
and routers to segment trafc for an entire organization, microsegmentation
might defne anetwork that is accessible only to single workgroup or even a
single individual.
Bill Rowan, vice president of federal sales at VMware, compared the concept to
that of a submarine built with various compartments so that a breach in one
compartment would not food the others. “That’s where we are taking the
approach of microsegmenting networks,' he said.
According to Rowan, a well-designed microsegmentation solution imposes
no noticeable cost in terms of network performance and even simplifes
some network chores, such as moving an application from one virtual
network to another. [Emphasis Supplied]
“Because we are separating the physical from the logical, I can simply build
that same network topology on the other side,” he said. “Heretofore, I had to
go back in and change all my network settings to make sure the application
could efectively communicate.”
Townsend, however, said it's not clear whether microsegmentation will be
viable. His main concern is scalability. “The idea is that for every virtual
application and every virtual network segment, you have a security policy that
follows that data or that portion of the network,” he said. That could
overwhelm an agency's IT team.
“Right now, our federal customers are struggling from an operations
standpoint to manage their security environment as it stands today,” he
added. [Emphasis Supplied]