Network microsegmentation

Most systems are set up to allow communication between devices and assume that all users who are within the security perimeter of the network are fully trustworthy. This means that, having gained access to the network or a device on it, an intruder will find it easy to traverse the network, discovering and compromising other mission-critical systems. This is known as a lateral movement attack.

What is Network Microsegmentation?

Network microsegmentation is a security technique that tackles this risk head-on by dividing network devices, access, and communications (typically, traffic in a data center) into unique logical units. These units encapsulate specific services and security policies according to the individual workflows of the devices and their users within the data center or organization. This means that each segment of the network will only handle the traffic and access necessary for a specific workflow, thereby limiting the extent of a potential breach.

In addition to preventing lateral movement within your network, there are several other benefits to network microsegmentation. Understanding and implementing this technique provides you with an arsenal of tools to enhance security within your network or data center. In this article, we’ll take a deep dive into what network microsegmentation is, what it can offer you, and how you can implement it for your organization using Tailscale.

Microsegmentation Security

There are a number of benefits that network microsegmentation can offer your business, including reducing attack surface, preventing lateral movement, making threats more visible, and making it easier for you to comply with regulations.

Reducing attack surface

An attack surface consists of any device that may present a hardware or software vulnerability; as long as a device is communicating over or within your network, it has the potential to be exploited by a threat actor.

Possible attack surfaces include workstations and laptops, network file servers, network application servers, switches and routers, multifunction printers, and mobile devices. The more devices and applications you have on a single network, the larger your attack surface and the easier it can be for cybercriminals to compromise your network.

Microsegmentation can drastically reduce your attack surface as your devices are isolated into smaller logical network segments. In a microsegmented system, even if your network is compromised, the breach will affect only the particular segment that acted as an entry point, whereas the rest of your network will remain protected from that breach.

Preventing lateral movement

As soon as threat actors gain access to a network, they immediately look for ways to sustain their access and try to find other devices or services within the network that they may be able to compromise. In order to do this, they use tools to scan, discover, and gather information on the network to identify where they are on the network and the other connected devices.

In a microsegmented network, this process becomes almost impossible. Communications between users and devices within the various logical network segments are governed by zero trust policies that define and restrict what kind of communications may take place between users and devices.

This means that an attacker is prevented from scanning to discover other nodes; even if they do, they’re restricted from further interaction as unauthorized communications are rejected or blocked.

Visibility of threats

The granular nature of microsegmentation allows for heightened visibility of threats within the network. Most, if not all, communications between users and devices within a microsegmented network may be tagged according to workloads. This means that abnormalities in network access, the type of requests, and traffic will be easier to spot. Intrusion detection and prevention systems can work quicker to flag where a node is compromised because they are tuned to focus on each segment according to the specific workload, as opposed to scanning everything on the entire network. This also allows for faster incident response and mitigation of attacks.

Microsegmentation and Compliance

Ongoing compliance with data regulations like GDPR and PCI DSS can be quite a challenge. This is due to the evolution in the sophistication of data and network requirements and technologies in organizations with both on-premise and cloud network infrastructure.

With microsegmentation, protected data infrastructure can be roped off into isolated environments, with strict access and security policies enforced and maintained accordingly. Doing this also provides easy visibility for regulatory bodies during compliance checks and validation.

With all these benefits in mind, let’s take a look at what setting up network microsegmentation for your organization would entail.

How to implement network microsegmentation

As network technologies and environments vary from organization to organization, there’s no one-size-fits-all way of implementing microsegmentation. All the same, there are some fundamental steps that will be relevant to the majority of cases, from gaining visibility into your network architecture to dealing with the challenges you might face in long-term implementation.

Take inventory of network resources and assets

To be able to properly implement microsegmentation, visibility into your system is key. You must start by clearly mapping out and understanding your current network architecture. You should also identify the various network components, users, applications, and data points within the network. Document it all.

This grants you the necessary visibility over your network resources and assets and their connections, which you’ll need for the next step.

Categorize network resources

After gaining more insight into your network, observe and identify the network patterns, workloads, and traffic flows. This will help you understand which users and departments access which applications, servers, or data. Useful factors should become clear — for example, which server ports need to remain open and accessible, or which machines should be able to communicate with each other and whether this communication should be one-way or two-way.

This will allow you to categorize the network nodes and components according to the unique contexts of their workloads and data flows. Depending on the network technologies you may be using, this can be done using network zones or subnets, tags, and groups.

For example, users from the finance department will be accessing network file storage meant for them. This means three things:

1. All users in the finance department will be categorized into one group, e.g., Finance. Subgroups can also be created to further categorize these users according to their role in the department.
2. All network devices or resources that are shared by the department will be tagged, e.g., finance_resource.
3. Network devices such as user workstations can be placed in a single subnet or zone. Depending on your network, each of these subnets can be placed behind perimeter devices such as gateway routers or firewalls.

Tools like Tailscale can help you easily implement the contextual categorization explained above. Tailscale provides tags for machine categorization in your network, groups for users, and hosts for grouping nodes within a subnet of your network.

Depending on your setup, you may also need subnet routers and exit nodes, especially for an easier transition from large network subnets. These tags, groups, and hosts will then have various access control policies (ACLs) applied to them in the next step.

Formulate and configure access policies

Access policies are one of the most important aspects of network microsegmentation. They contain and apply the rules that define and control access to and from various nodes and segments of the network. This is where the zero trust approach mentioned earlier comes into play.

Zero trust means that, by default, all communications between network users and devices are not trusted and therefore are blocked or rejected unless specifically allowed by the ACLs. Tailscale offers a robust network access control system that allows you to easily implement policies that can be applied to individual users, groups, machines, and tags. This in turn provides you with granular control over any object within your network.

Once categorization is done, as shown in the previous step, policies may be established in the following ways:

• Machine to machine: These access policies regulate machine-to-machine communication, usually using IPs and machine names — for example, the web server can only access a Postgres database server via port 5432, but not vice versa, to allow a CMS on the web server to access and display content from the database. But because the database server does not need anything from the web server, all communications to the web server will be blocked or restricted.
• User to machine: Here, users’ access is restricted to specific resources — for example, a server administrator can access a database server via SSH on port 22 for system administration functions, such as performing backups or system updates and maintenance.

Using Tailscale, in addition to the above, you can also define policies in the following ways:

• Tag to tag: Think of this as groups for machines or devices on your network, such as classifying all printers under one tag or all web servers under one tag. This can also be used to implement machine-to-machine access policies without binding the policies based on IP addresses and specific machine names. As seen in the machine-to-machine example above, you can have multiple servers with the tag web-server accessing the same database server or servers with the db-server tag.
• User to tag: A single user may be granted access to all servers with a specific tag. For example, a webmaster might need access to all web servers with the web-server tag via SSH port 22 and http/https via ports 80 and 443, respectively, in order to view their web pages and perform certain tasks on the file system of all the servers with the web-server tag.
• Group to tag: These policies ensure all users within a specific group have access to all network resources with a specific tag — for instance, all users in the IT-support group can have access to all workstations with the general-staff tag via RDP to be able to provide support for employees when needed.

Simulation and validation

Once created and enforced, policies must be checked to ensure they’re functioning as expected. You need to go through each use case and scenario to ensure the right access controls are in place.

You should also test out edge cases: Try to violate the various policies by accessing different applications, services, or machines with other user accounts or machines and evaluate the results. This will help you identify security gaps or workloads you might have missed.

Again, Tailscale provides a simple but effective tests feature that allows you to create test cases with assertions for the various access rules or policies you implemented in the previous step. These test cases may fail or pass according to the assertions you define. This test feature also helps you run checks whenever you make modifications to your ACLs, so you become aware of the impact of your changes even before they’re accepted and rolled out.

Challenges to setting up microsegmentation

If your network infrastructure requirements are extensive because of the size of your organization, the initial stages — in other words, taking inventory of and categorizing your network resources — may be time-consuming and labor-intensive.

When you first embark on microsegmentation, it’s a good idea to start small: Consider microsegmenting your network in phases and moving methodically from one section of the network to another. Once you have one unit functioning as expected, move to the next while maintaining visibility into the entire network until the entire organization’s network is microsegmented. This process may take days to months or even years.

But there are other challenges to network microsegmentation, especially in the long term: Not only is your organization and its requirements likely to evolve, but so might technologies and broader regulations. For example, IP- and name-based policies may fail over time as your organization grows because some devices with these IPs and names may be replaced with different devices for different purposes, or may be completely removed, resulting in a breach of existing policies. This means that policies must be structured and set up to be adaptive for long-term use.

Taking proactive steps such as defining access policies as described above can help mitigate this challenge. With Tailscale’s tags and groups, you can more efficiently categorize and define access policies according to the role they play as well as their purpose or function.

Tailscale’s robust ACLs give you the ability to create policies that will hold true and work over a sustained period of time. Tags can further be used to automate machine enrollment on your Tailscale network, thereby applying the respective ACLs on that device without further intervention or supervision.

Tailscale for network microsegmentation

We’ve already covered some of Tailscale’s innovative features that can help you in implementing microsegmentation. But those aren’t the only benefits Tailscale can offer your business.

An intuitive user interface

Implementing microsegmentation can be a complicated and tedious process, especially when dealing with a diverse range of technologies and topologies. Tailscale provides you with a single, intuitive, and easy-to-use UI for managing your entire network.

Robust encryption

Through Tailscale, you have your own private network, called a tailnet, which treats security as an absolute priority. Tailnets employ end-to-end encryption to secure all communications between every single device on your network.

A comprehensive solution

Coupled with its intuitive UI is a comprehensive set of features, especially the centralized access control, that allows you to meet almost all your security requirements in your network, irrespective of location or topology. This also includes detailed yet easy-to-follow product documentation to help you complete setup smoothly and quickly.

Conclusion

In this article, you learned about network microsegmentation and its power in honing network security. You’ve seen some major benefits, including how the technique can reduce your attack surface, give you a better warning around threats, prevent lateral movement, and help you with compliance. You also learned the key steps in implementation and how Tailscale can facilitate your aim of creating an effective, secure, and sustainable microsegmented network.

Tailscale is a cost-effective VPN solution for businesses looking to take full advantage of the security benefits of network microsegmentation. It works seamlessly across locations and networks globally. You can download Tailscale on any device and begin exploring the possibilities for free.