Digital transformation promises to deliver significant benefits for organisations, not least of which are improved efficiencies and agility, and the ability to use cloud services to be productive from anywhere. A key trend that’s starting to emerge in digitally transformed organisations is that the security measures that were carefully chosen and deployed in their on-premises environment have not translated to their hybrid or cloud-based environment, introducing new security gaps.
A key example of this can be seen with micro-segmentation. Network segmentation is a way to segment the network so that, if an attacker were to access part of the network, they would be unable to have free reign throughout the entire network. Micro-segmentation takes this a step further, segmenting individual workloads so that malicious actors are even more constrained. Organisations that have embraced network segmentation and micro-segmentation in their on-premises environments can have a reasonable degree of confidence that a security breach could be well-contained.
However, moving these networks to the cloud can result in an unintentional ‘flattening’ of the network, removing the segments that had been created and eliminating those protections. This challenge is exacerbated by the increasing use of Internet of Things (IoT) devices, dynamic multi-cloud environments, and distributed networks. All of these elements add potential entry points for malicious actors, and need to be included in an overarching security strategy.
Avoiding flat networks in the cloud
Flat, open networks facilitate speed and agility. However, they can be incredibly dangerous because an attacker can move freely throughout a flat network, causing significant damage and disruption along the way. In a flat network, unlike a segmented one, the attacker never comes up against a gateway or barrier that slows them down or stops them in their tracks.
The issue for many organisations comes as they digitally transform. Their segmented networks move to the cloud, which is a dynamic environment. This has led to a perception that segmentation and micro-segmentation can’t work in the cloud.
However, the myth that segmentation can’t work in the cloud is categorically untrue. While many cloud providers promote micro-segmentation, some organisations find it challenging to govern and ensure the correct micro-segmentation controls are in place. Spinning up resources and taking them down just as quickly doesn’t leave much room for careful network security policy management (NSPM). However, not only is it possible to apply micro-segmentation to cloud networks, it’s imperative to do so to provide maximum security as the organisation transforms.
How to properly segment and control transformed networks
Micro-segmentation is a key enabler of a zero trust security approach. By logically separating critical network assets, even down to the device level, businesses can enforce zero trust throughout the network. This prevents unauthorised lateral movement and wraps IT service workloads in an additional layer of protection. Even if an attacker were to gain access to a device, server, or workload, their access would end there.
The first step is to understand the current environment and map application dependencies. While this may sound simple, many businesses simply don’t have the visibility required to do this. The discovery process alone can be onerous and challenging, especially when cloud-based transformations have occurred and there is no consistency or governance in place.
NSPM is essential to ensure that all the security controls that protect the on-premises network are also present and correct in the hybrid or cloud network. Doing this manually is an overwhelming task that could lead to errors, overlooked gaps, and an increased risk of being breached.
Businesses need a tool that can highlight misconfigurations, shadow IT, exposure, and non-compliant security controls without requiring a manual discovery and remediation process. It should include a network security governance layer that assesses every control in the cloud environment against best-practice governance models in real time. Most importantly, the tool should let businesses replicate their on-premises controls across their hybrid and cloud environment automatically for peace of mind and a futureproof security posture.
To find out how ditno can help your business maintain consistent NSPM across hybrid environments seamlessly, contact the team today.
ditno
