On the offense: Deterring threats with cyber strategy

Cyberspace is truly the fifth domain, but it is a place and not a mission. As Rear Admiral Mike Ryan, commander of the Coast Guard’s Cyber Command, recently said, “if the underpinnings of our nation are attacked or disrupted, that's as equally disabling as if our military power cannot be projected.” Attacks on critical infrastructure (a place) -- from gas pipelines to financial systems to water supplies -- hold the potential to weaken the nation just as kinetic attacks damage military assets.

Stopping cyberattacks is a matter of the highest importance, but a new approach is needed because current attacks continue to get through. The zero-trust philosophy, however, assumes the attacker is already inside the network. By improving threat visibility and control over applications and workloads, IT security teams can stop and contain attacks while making quick progress toward implementing a zero-trust model.

Zero-trust security models and micro-segmentation

Zero-trust security models minimize the chances of attackers gaining access to valuable resources.

In a micro-segmentation approach, if access is denied to all accounts by default and granted only to authorized users for specific resources, then even when attacks make an initial penetration at an agency, they won’t be able to move laterally across the network to cause damage or steal classified information. They’re effectively boxed in at the initial point where the attackers entered the network. And while they’re stuck there, IT teams can triage, analyze and remove any software artifacts on the servers or workloads, mopping up the attack before it spreads. 

Micro-segmentation means limiting or reducing specific application and workload connections to the bare minimum necessary. This approach creates fenced-off areas that are cloaked inside of the network, similar to the water-tight compartments in a submarine, so unauthorized traffic gets stopped in its tracks when a leak occurs.

When networks are micro-segmented to allow only the traffic absolutely required for approved connections, the resources available to attackers greatly diminish. The ports and protocols ransomware attacks rely upon become inaccessible. Even if attackers breach an application or workload, they’ll find themselves trapped there, unable to traverse the network to install more ransomware, to interrupt other operations or to steal more data.

Security experts have long recognized the value of micro-segmentation. Two obstacles, though, can prevent organizations from adopting micro-segmentation and realizing its benefits for defenses against cyberattacks.

The first is a lack of visibility. It’s difficult for agencies to appreciate the full value of micro-segmentation until they see just how open and unfettered their network access really is, even on supposedly secure networks. Fortunately, application and workload dependency mapping reveals all the communications between different workloads, applications, cloud and data center environments and the internet. When dependency mapping software shows organization leaders just how freely traffic is flowing on their networks, despite restrictive access controls and policies, they’re almost always surprised. Often, they quickly discover unauthorized application and workload connections that could jeopardize the mission of the entire command.

Dependency mapping highlights just how vulnerable both unclassified and classified networks are. It’s important to see this clear picture of risk; otherwise, it’s hard to appreciate the scope and the urgency of the problem. After all, sometimes in health care, it takes a shocking X-ray to prompt doctors and patients to embark on a bold course of action. Application dependency mapping provides a clear picture of both the problem and the cure. Part of the cure is showing those locations that have the highest probability of a cyberattack.

The second obstacle is implementing micro-segmentation effectively -- that is, how to apply the cure. Many agencies that have experimented with micro-segmentation have approached it as a network configuration task. They try to implement micro-segmentation policies by configuring network devices such as routers and perimeter firewalls or by configuring containers -- all from a network security perspective. This means they have to log into each hardware and software device and through a command line interface and write policies. This is a major problem because writing policy to a firewall will conflict with writing policy to a virtual machine running Linux. There is no visibility, and this approach simply doesn’t scale -- it’s like trying to direct traffic with a thousand traffic cones instead of a few dozen traffic lights.

Realizing the benefits of micro-segmentation

A much better approach is to shift the action from network gear to the workloads themselves -- a host-based approach to micro-segmentation. In other words, take the fight against cyberattacks to where attacks are occurring. Meet the enemy where they first touchdown, and trap them by writing policy to prevent them from moving beyond specific parameters.

Once agencies gain network visibility, they can micro-segment by applying rules to workloads and applications. When they see what traffic is legitimate, they know what traffic to block by default: everything else. This is done by accessing the firewalls already built into each host – whether it is a workload running a Linux virtual machine or a load-balancer.  Through these host-based firewalls, agencies can implement granular controls, blocking specific IP addresses, ports and protocols and allowing others.

This approach has several benefits. First, it’s fast. Micro-segmentation software can reveal real application traffic and network usage immediately. Within a few hours, legitimate traffic patterns are visible. So are potential vulnerabilities caused by open ports and protocols.

Additionally, it’s practical. By converting access best practices and policies into host-based micro-segmentation controls, agencies gain an effective way of locking down movement on the network. Shutting down the paths that attackers and ransomware depend upon contains threats immediately. A ransomware attack that never spreads beyond a single workload or application isn’t much of a ransomware attack at all. Attackers who breach a workload and can’t see beyond that workload to the network haven’t discovered much at all; just the futility of their attack.

Micro-segmentation takes advantage of a fundamental military strategy called out in the Cyberspace Solarium Report: deny benefits to the attacker. By depriving attackers of the ability to scan or traverse networks, micro-segmentation greatly reduces the attack vector and helps agencies and commands with their mission. It also supports the military’s Defend Forward, strategy, which defends or disrupts bad actors at the source.

Both defense and civilian agencies can benefit from network visibility and applying micro-segmentation as the key zero-trust strategy. Facing adversaries that include nation-states and well-funded, sophisticated criminal syndicates, government organizations must turn to this important cybersecurity strategy now.