December - JanuaryENTERPRISE SECURITY| | 9In network micro-segmentation, theintranet is further segmented into smaller segments based on risk profiles or to meet network/application/work-load isolation needs. This concept can be applied to any part of the internal network using a combination of host-based and network-based firewalls. Although physical network micro-segmentation is possible, it is difficult to implement manually and very difficult and complex to maintain, manage and audit. Instead, it is generally implemented through concepts of VLAN on physically networked compute platforms and components, and through implementations like NSX at the hypervisor level on virtual compute platforms like VMware.Here are guidelines for network based micro-segmentation:· Enable distributed Stateful firewalling at a per server or work-load (VM) level, regardless of the underlying physical or logical network overlay.·Enable and programmatically define logical level micro-segmented networks, regardless of the underlying compute and network overlay.·Programmatically create, provision and subsequently manage fine grained security and access control policies across multiple micro segments using a single pane of glass.·Perform full SSL/TLS decryption and network packet inspection and also integrate with advanced intrusion prevention system (IPS) capabilities.Application segmentation limits the attack surface for a given application by using layer 4 controls. Here are guidelines to secure applications:· Perform intra-application segmentation by enforcing a distinct separation between the n tiers of an individual application and using the principle of least privilege to allow only the least amount of access to each tier (e.g., web tier, application tier, database tier)· Isolate a given application from other applications and systems, to restrict vulnerability exploitation and lateral movement from other apps within or outside the network segment in which the app resides. Network segmentation can further enable application segmentation. Accurate asset inventory must exist for all systems and servicesThe capability should exist to create and maintain an accurate asset inventory of all hardware, software, systems, and services within an application (preferably a CMDB) with API and programmatic access. To be effective,dynamically detect and inventory (i.e., adding or updating) all physical and virtual systems and services as they may come on or go off the network.All traffic for all systems and services must be authenticated and authorizedThe traditional way of hauling all authentication and authorization requests to a traditional data center to comply with a Zero Trust model is achievable, but is becoming increasingly difficult to manage and maintain with the advent of distributed computing. An alternative means of proper authentication and authorization is to ensure that secure access decisions are made at the entity (user, system, device, service, or location) initiating the connection itself, generally at the edge computing location. This can be achieved using the concepts defined in Secure Access Service Edge (SASE), which extends the existing concept of identity built upon users, groups and roles to include edge computing and wide area networks (WAN). The SASE paradigm uses a combination of security capabilities defined in software defined wide area network (SD-WAN), cloud access security broker (CASB), secure web gateway (SWG), next generation anti-virus (NGAV), virtual private network (VPN), next generation firewall (NGFW) and data loss prevention (DLP) - all delivered as a single service at the network edge.Access control for users, devices, systems and services must be provided using least privilegeAccess for all users, devices, systems and serviced must be continuously assessed and always be provided using the principle of least privilege with continuous re-assessments. All data in transit and at rest must be encrypted end to endEncrypt data in transit end-to-end using techniques such as TLS with ESNI, IPSec using FIPS compliant initial handshake and key management. Data at rest must be encrypted using techniques such asTDE for structured data (e.g., databases), and symmetric encryption algorithms such asAES (128 or 256 bit) for unstructured data (e.g., file shares). ESCISO's must make it their mission to provide clear and concise requirements for Zero Trust, along with practical guidance on implementations to secure their enterprise Raj Badhwar
< Page 8 | Page 10 >