Ramping up cloud security with zero trust micro-segmentation
GettyImages/ Weiquan Lin
Connecting state and local government leaders
Micro-segmentation helps protect the country’s critical data and infrastructure, supports cloud-enabled innovation and digital transformation and keeps the public sector workforce productive.
From Solar Winds to Log4j, the last year has been challenging for government CIOs and CISOs, especially when it comes to cloud security.
A new Forrester study confirmed that enterprise decision-makers are struggling with cloud security and zero trust. More than 60% were not prepared for the rapid pace of cloud transformation. The vast majority (75%) agreed that supporting remote workforce productivity required updating technical reference architectures for cloud security and baking zero trust design into cloud adoption. Crucially, 78% said their organizations plan to enhance its zero trust security operations.
The question is how. As agencies build zero trust plans, it's important they start by gaining visibility into network communications to better understand where they’re most vulnerable and where the most critical data lies. Another way to make progress is by isolating large swaths of the environment from other sections with micro-segmentation – this robs attackers of the ability to move around the network after an initial breach, thereby dramatically limiting their impact.
Cloud conundrums
A common misconception about managed cloud environments is that they automatically provide the benefits of micro-segmentation. They may come with network segmentation, but not (host-based) micro-segmentation. In some instances, a managed cloud environment puts data and applications at greater risk, due to increased complexity and expanded opportunities for attackers to gain access to the environment.
Agencies can underestimate multicloud and hybrid infrastructure security risks and fail to take the necessary steps to maintain secure operations. For example, data can easily move undetected throughout the cloud and communicate with other systems, requiring security teams to constantly monitor its movement to protect the workloads. The challenge is that one initial undetected breach can wreak havoc when it allows attackers to move laterally throughout the network. This can bring down the mission or the operation.
Additionally, agencies often assume that cloud service providers isolate services from the internet. By default, many cloud services are open to the internet and can be easy points of entry for a potential attack.
Using micro-segmentation to secure the cloud
Implementing micro-segmentation, a proactive approach that automatically isolates attacks, limits attackers' reach and impact. The process starts with an application dependency map that visualizes communication between all cloud and data center workloads, giving cyber leaders a clear picture of how applications interact across networks. This visibility enables agencies to understand what to prioritize and secure first. Leaders can then put automated micro-segmentation policies in place.
Typically, when attackers gain access to a network, they quickly move around to find and obtain the highest value assets. Agencies can prevent movement throughout the network by applying least-privilege access controls, which ensure authorized users have only the necessary information and access.
This approach greatly limits the impact of an attack by stopping adversary lateral movement, effectively protecting critical applications. IT leaders must determine which resources within the cloud environment can and should communicate with each other.
Stopping the lateral movement of a cyberattacker allows the mission to continue, preserving productivity and end-user services.
The bottom line
The Forrester study recommends organizations start implementing their cloud security strategies by gaining visibility to see open pathways across the interconnected infrastructure and to the internet. Then, though the ‘assume breach’ mentality of zero trust, they can secure their data by building security controls to close those risky pathways.
While agencies evolve their strategies in line with zero trust strategies, the attacks will unfortunately continue. It is critical to take these incremental steps today to reduce risk and increase cyber resiliency tomorrow.
Micro-segmentation is one of the best (and fastest) ways to make immediate progress toward a more secure environment, protect the country’s critical data and infrastructure, support cloud-enabled innovation and digital transformation and keep the government workforce productive – from anywhere.
Mark Sincevich is Federal Director with Illumio.