登录查看更多内容

How can you secure your application with microsegmentation?

由人工智能和领英社区提供技术支持

Microsegmentation is a technique that divides your application network into smaller and more isolated zones, each with its own security policies and controls. This way, you can reduce the attack surface, limit the lateral movement of threats, and enforce the principle of least privilege. In this article, you will learn how to secure your application with microsegmentation, and what are the benefits and challenges of this approach.

此文章中的业界达人

由社区从 5 条内容中精选。了解更多

David Shergilashvili

?? T-Shaped .NET Solution Architecture

1 What is microsegmentation?

Microsegmentation is based on the idea that not all parts of your application network need the same level of access or trust. For example, you may have different tiers of services, such as web, application, and database, or different environments, such as development, testing, and production. By creating smaller segments or zones within your network, you can apply granular security policies and rules that define who or what can communicate with each segment, and how. This can prevent unauthorized or malicious traffic from reaching sensitive or critical areas of your application.

添加您的观点

David Shergilashvili

?? T-Shaped .NET Solution Architecture
举报内容
Microsegmentation is a security technique that divides a network into smaller, isolated segments Each segment contains resources with similar security requirements, such as applications or workloads Communication between segments is tightly controlled based on granular security policies Microsegmentation provides a more fine-grained approach to network security compared to traditional perimeter-based models

已翻译

赞

2 Why do you need microsegmentation?

Microsegmentation can help you improve your application security in several ways. First, it can reduce the attack surface, meaning that you can minimize the exposure of your application to potential threats. By isolating each segment, you can limit the blast radius of an attack, and prevent it from spreading to other parts of your network. Second, it can enforce the principle of least privilege, meaning that you can grant only the minimum necessary access or permissions to each segment. By doing so, you can avoid granting excessive or unnecessary privileges that could be exploited by attackers. Third, it can enhance your visibility and monitoring, meaning that you can track and analyze the traffic and activity within each segment, and detect any anomalies or suspicious behavior.

添加您的观点

Terrence Chou

Sr. Security Architect, APAC Professional Services at Akamai Technologies | Content Creator
举报内容
The peripheral (north-south) protection is based on the network-layer boundary to function. It was good enough in the past decades, but it is not nowadays, especially for modernised/emergent cyberattacks. What the peripheral protection primarily lacks could be summarised below: - It is not capable of visualising the east-west accesses. If the infiltration happens within the segment, what you could do? - Its access control could only leverage the IP address. In terms of zero-trust access, you should consider involving more granular parameters; for instance, identity (which user) and application (which process/daemon). The host-based firewall (layer-4) is still not sufficient and that is why micro-segmentation (layer-7) joins the game.

已翻译

赞

3 How to implement microsegmentation?

There are different ways to implement microsegmentation, depending on your application architecture, network infrastructure, and security requirements. One of the most common methods is to use software-defined networking (SDN) or network virtualization, which allows you to create and manage virtual segments or zones within your physical network. This way, you can decouple the security policies and controls from the underlying hardware, and apply them dynamically and consistently across your network. Another method is to use containerization or microservices, which allows you to break down your application into smaller and independent units that run in isolated environments. This way, you can control and secure the communication and interaction between each unit, and scale them independently.

添加您的观点

David Shergilashvili

?? T-Shaped .NET Solution Architecture
举报内容
Define security zones based on application components, environments, or data sensitivity Identify the communication flows and dependencies between segments Create granular security policies that specify allowed traffic between segments based on identity, role, or application Leverage network virtualization technologies like software-defined networking (SDN) or network function virtualization (NFV) Use microsegmentation solutions that integrate with your existing infrastructure and management tools

已翻译

赞

4 What are the benefits of microsegmentation?

Microsegmentation can bring several benefits to your application security, such as increased protection from attacks like denial-of-service, ransomware, or data breaches, improved compliance with regulatory or industry standards such as PCI-DSS, HIPAA, or GDPR, and enhanced performance with reduced complexity and overhead of the network. This enables the optimization of speed and efficiency of the application and avoids bottlenecks or congestion.

添加您的观点

David Shergilashvili

?? T-Shaped .NET Solution Architecture
举报内容
Enhanced security posture by reducing the attack surface and limiting lateral movement Improved visibility and control over network traffic flows and application dependencies Faster incident response and containment by isolating compromised segments Simplified compliance management through granular security policies and auditing capabilities Increased operational efficiency by automating security policy enforcement and management Better support for dynamic, cloud-native environments through software-defined segmentation

已翻译

赞
Terrence Chou

Sr. Security Architect, APAC Professional Services at Akamai Technologies | Content Creator
举报内容
Continue with my previous feedback on the 2nd point. - The micro-segmentation solutions reside in the operation systems as a tiny proxy to observe every horizontal and vertical flow which covers all the angles. - The micro-segmentation control is not just layer 4, but layer 7 instead. Every access could be inspected by which user tries initialising the request or which process/daemon tries forwarding the traffic even if all of them happen in the same host. - Most importantly, the micro-segmentation could leverage custom labels to manage accesses granularly; every workload could be logically grouped across segments (subnets) and environments (on-premises/clouds). Also, consistent policy enforcement is another key you could embrace.

已翻译

赞

5 What are the challenges of microsegmentation?

Microsegmentation can also pose some challenges to your application security, such as complexity, compatibility, and adaptability. Creating more segments and policies can increase the difficulty and cost of managing and maintaining your network, as well as introduce potential human errors or inconsistencies. Additionally, using different technologies or tools can lead to compatibility or interoperability issues between your segments, which can affect the functionality or availability of your application. Furthermore, changing or updating your application or network can require frequent adjustments or modifications of your segments and policies, potentially impacting the security or stability of your network.

添加您的观点

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Application Development

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you secure your application with microsegmentation?

1

2

3

4

5

6

1 What is microsegmentation?

2 Why do you need microsegmentation?

3 How to implement microsegmentation?

4 What are the benefits of microsegmentation?

5 What are the challenges of microsegmentation?

6 Here’s what else to consider

Application Development

给文章评分

感谢您的反馈

更多Application Development相关文章

更多相关阅读内容