As traditional perimeter defences become easy to crack automated and policy based network segmentation solves two biggest challenges for CIOs – security and complexity.
Enterprise Networks are subjected to meet sudden business changes and requirements. In doing so, networks become vulnerable. In worst cases, it turns out to be the next WannaCry, Petya, or NotPetya. Evolving traffic patterns of the cloud era have increased the focus on network security. Not so surprisingly, Gartner highlights a rise in security investments for cyber/information security by 55%. And as security measures proliferate, network segmentation hits a new radar in the IT security tech stacks.
Network Segmentation continues to be a crucial technique for IT teams in today’s dynamic IT ecosystem. So what is Network Segmentation? Implemented in a variety of ways the benefits of network segmentation are numerous. The most basic function and advantage of network segmentation is that it allows network administrators to isolate traffic. In the age of SD-WAN, evolving further into advance techniques like micro-segmentation, network segmentation is allowing IT teams to segment traffic at the granular level.
Network Segmentation with the Perimeter
In most enterprises, network segmentation is used with a perimeter firewall. In addition, Intrusion Prevention System (IPS), Advanced Threat Prevention (ATP) is applied to guard the network perimeter. vLANs and vRFs are the two most common types of network segmentation methods used by networking teams. VLANs provide only site-specific segmentation and on the other hand, VRFs are used for complex wider deployments.
In the perimeter firewall approach, the enterprise network is divided into many smaller networks to reduce the impact radius in the advent of an attack. Further, to control the communications between hosts and services, specific rulesets are developed and applied to each (host and services). Each host and network segmented and segregated at the lowest manageable level. Routers divided the network into separate smaller networks using Virtual LAN (VLAN) or Access Control Lists (ACLs). Network firewalls are then put into action to filter network traffic between segments, and host-based firewalls filter traffic from the local network adding additional security.
However, segmenting today’s traffic using this method – using firewalls and routing- firstly is technically cumbersome and secondly raises security concerns. Enterprise networks become easily hackable for intruders to gain widespread access to the entire network. The lack of a comprehensive network segmentation methodology makes attacks easily pass through the perimeter.
Network Segmentation via SD-WAN
The surge of cloud, distributed network architecture, and the internet has compelled enterprises to augment end to end network segmentation beefing up security with the network infrastructure. The need of the hour for enterprise IT teams is to able to separate different types of traffic using segmentation that can scale i.e allow IT teams to create multiple segments across the enterprise network, creating a new set of standard protocols.
Today’s dynamic IT teams segment new age traffic intelligently and automatically with an intent driven approach. Using software-defined WAN, IT teams are able to manage and configure necessary activity proactively and continuously to reach the desired outcome. No more manual configuration is required. IT teams can simply define segments and assign policies to each. For example, rules are applied as per VPN and firewall segments, and security policies are applied to each individual segment. These policies are automatically applied across edges and cloud. Via intent based segmentation such as ScaleAOn, each segment is automatically isolated with respective policies carried across the WAN.
Further, as WANs become more App friendly, advance segmentation techniques like micro-segmentation is emerging as a beneficial way to enforce security with a nicety – allowing networking teams to breakdown segments further at the level of application and users. Hence today when networking teams are expected to keep WAN always ON, automated policy-based network segmentation is critical to ensure defences are also ON. The end result is an enterprise network that is agile and easy to control, and that provides secure segmentation of traffic as per enterprise business demands.
At Lavelle Networks, our solution ScaleAON allows networking teams to create network segments with Zero errors. Assisted visual aids in the user interface, which allows to create VPN or WAN topology without a single line of actual network interface configuration. ScaleAOn simplifies the configuration and management of network segregation making segmenting of network traffic seamless and scalable.
