The best offense is a strong defense: Improve cloud security with visibility and zero trust segmentation

State and local governments continue to grapple with more complex cloud ecosystems as they support hybrid work, adapt to shifting needs of citizens and manage growing volumes of internet-of-things and edge-generated data. There are more devices connecting from more locations than ever before, introducing new opportunities for business and innovation along with new cybersecurity challenges. And adversaries continue to take advantage of the complexity and confusion.

In many cases, state and local governments are following the lead of the federal government when it comes to modernizing and bolstering cyber defenses. That’s why, as more state and local governments and educational institutions fend off evolving ransomware concerns, cyber mandates from the federal government – particularly surrounding zero trust initiatives – are essential. 

For example, the guidelines in the White House zero trust memorandum (Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, finalized in January) require federal agencies to put zero trust plans into action -- including developing pilot programs.

A comprehensive zero trust roadmap centers around five core pillars: identity, devices, networks, applications and workloads and finally data. But historically, as state and local governments build and prioritize zero trust plans, the focus has overwhelmingly been on the first three pillars: identity, devices and networks. The challenge is that none of the first three pillars are designed to stop attacks from moving laterally across a hybrid or multicloud estate; for this agencies would need to implement zero trust at the application or workload level. And while a cloud deployment may have built-in network segmentation, it does not have native zero trust segmentation, also known as microsegmentation.

First things first: Network discovery

Given what we saw with SolarWinds and Log4j, detecting and containing bad actors (i.e., prohibiting them from moving across the IT estate) is priority No. 1. It is when attackers have free rein to move unrestricted that they’re able to access mission-critical data and infrastructure. This will ultimately wreak havoc on an agency or government bodies and can impact the citizens that rely upon those services too.

But before teams can put zero trust controls like microsegmentation in place, they need reliable, real-time visibility. What you cannot see will ultimately hurt you.

This includes maximizing network discovery (visualization) and establishing a real-time and very clear picture of applications, workloads and interdependencies. This network discovery process should provide the team with the ability to find, prioritize and lockdown open (risky) ports. The team can also create a plan to segment high-value assets – for example, mission-critical applications or workloads. These initial steps will reduce the attack vector.

Understanding zero trust segmentation – network vs. application and workload

Creating a microsegmentation plan falls under the application and workload pillar of zero trust, called out in the memorandum and endorsed by Cybersecurity and Infrastructure Security Agency. Unfortunately, using a cloud provider does not automatically bring microsegmentation into an environment, a common misconception in recent years.

While agencies and government bodies work to add microsegmentation to their security architecture, the majority are failing to account for adaptive, application-level microsegmentation -- focusing only on network segmentation, which ultimately leaves them vulnerable to breaches moving laterally across other IT estates and undermining larger resilience efforts.

State and local government IT leaders can rapidly improve cyber resiliency by focusing on workload and application level microsegmentation. Understanding and unpacking the differences between the different kinds of segmentation can help agencies and organizations prioritize protecting their high-value assets first:

• Traditional network segmentation: Relies on the network itself, creating virtual local-area networks or subnets, deploying firewall appliances or using a software-defined network. Network segmentation alone is not granular enough to build thorough resilience against today's sophisticated threats. It also cannot scale because it is dependent upon the network architecture.
   
• Zero trust segmentation: Extends microsegmentation to cloud workloads and containers, starting with an application dependency map that visualizes communication between all cloud and data center workloads. Microsegmentation uses the host workload instead of subnets or firewalls, creating a map of cloud and on-prem compute environments and applications. The map helps leaders visualize and rank vulnerabilities, and it puts automated microsegmentation policies in place, with labels instead of IP addresses or firewalls. In fact, the IP-addresses follow the labels.

As state and local government IT leaders build out their zero trust plans, prioritizing microsegmentation at the workload and application level early on will allow agencies to accelerate zero trust journeys while reducing cyber risk. It will help prevent threats from spreading laterally to compromise data, missions, and critical citizen service delivery.

The important thing is to get started on implementing and advancing zero trust plans today, with real-time application and workload dependency mapping and scalable, adaptive microsegmentation. Because when you’re fighting an enemy you can’t see, the best offense is a strong defense.

Mark Sincevich is federal director at Illumio.