Microsegmentation is not a new concept but the implementation of Microsegmentation is not feasible until network virtualization had become mature. Both VMware and Cisco offers Microsegmentation solutions.
What is Microsegmentation?
Segmentation is a security principle used to group entities within a network into one unit and to apply rules/polices to control the traffic in and out of the segment. Usually, this is done by a firewall. Microsegmentation is to be able to provide a way to define rules/policies in a smaller granular way and sometimes as small as a Docker container.Underlying Principles
An important principle for Microsegmentation is Zero Trust. It is simply to say that within a network, nothing is trusted. In the traditional IT security model, the assumption that attack to an IT infrastructure is from the "outside". There is the familiar tools such as DMZ, Intrusion Detection/Protection System and the antivirus software that companies spend a lots of money on to stop hacker from entering into the system. Once inside the system, there is not much being done to check for the traffic inside the perimeter.
Perimeter based security measures are not enough for the modern day IT infrastructure especially when the work load is in the cloud in which the perimeter is not very well defined. It is important to employ a Zero Trust model so as to provide the maximum level of security measure.
Major components for effective Microsegmentation
I read an article by Scott Lowe (I cannot find where it is. Will put in the URL once I find it). According to that article there are 3 main components that defines an effective Microsegmentation implementation
- Network independent policy definition
- Centralized policy definition repository
- Distributed policy enforcement
Traditional firewall rules use the 5 tuples to define access or deny rules. It is enough when service is run in the monolithic process. To provide a more granular way for Microsegmentation, the rules and policies has to be more than just network attributes. One example of network independent definition can be the type of OS kernel or even path level of the same OS.
2. Centralized policy definition repository
Virtual Machine and/or Docker containers can move around. To be effective, Microsegmentation has to have the ability to define the security policy in a central location so that no matter where the segment is moved, the policy can be easily retrieved.
3. Distributed policy enforcement
The enforcement point of the security policy has to be as close to the source as possible so that it will not be a bottleneck when applying the security policy.
Microservices opens up Security risk
Microservices architecture is perfect for cloud native application, agile and with the ability to scale in and out depending on the need. On the other hand, Microservices architecture opens up security risk that needs to be addressed:- Frequent and short life span
- Increase of East-West traffic
- Services are not as isolated
How is short life span a security risk? It is a security risk when the security rules cannot keep track on when and on which host machine the services are being deployed. Over time the ACL which is a common form of security rule for segmentation can become unmanageable and thus create security risk. This problem is aggregated when the Microservices have frequent life span. A Docker container can be provisioned in a matter of millisecond. We need to have the security measure to catch up with the pace otherwise there is going to create interval of security exposures.
Increase of East-West traffic
The traffic between client and server is defined as North-South traffic and traffic between servers are defined as East-West traffic. Why would increase in east-west traffic present a new security threat? Traditional security model has the assumption that attack to an IT infrastructure is from the "outside". There are not much being done to stop hackers from hoping from server to server. With the increase of East-West traffic, it amplifies this security risk that needs to be addressed.
Services are not as isolated
Microservices architecture is to break a monolithic service into smaller services. In the monolithic model components of a service runs within the same process and it is much easier to provide service isolation. Also the traffic to a monolithic service is much easier to control. With Microservices, components of a service are not running as an individual process. Individual processes that work together to perform a service needs to communicate with each other. Traditional firewall rules uses the networking 5 tuples as the bases of the rules as to either allow or deny. Now with Microservices, the use of networking attributes to setup up allow or deny rules are not enough thus making it difficult for the administrator of the IT infrastructure to use traditional firewall rules to provide service segmentation.
If Docker container is used to implement the Microservice architecture, we have the problem of all containers sharing the same OS kernel. In this way, individual micro services are not truly isolated from each other. Lots of development is done on Docker security but at least for now, it is a security risk that we have to address.
Microsegmentation and Microservices fits right in
Microsegmentation and Microservices is a perfect match. How?What Microsegmentation can offer for security is just what Microservices architecture implemented in the form of Docker containers needs. With Network virtualization as the foundation of Microsegmentation, the security policy is able to be ready to secure the fast provisioned Microservices.
The 3 major components of an effective Microsegmentation help to mitigate the security risk that Microservices opened up.
Network independent policy definition
In Microsegmentation, security rules are not limited to the traditional 5 tuples networking attributes and thus we can define a Docker container as a single segment and that the enforcement point of the policy is applied to the networking interface of the Docker container. This can effective monitor and control the East-West traffic of the various Microservices.
Even if a single Docker container is compromised the hacker will not be able to break out from the Docker container because the security rule that is defined for a single Microservice will stop the unexpected traffic. Depending on the implementation of the Microsegmentation, the Docker container once being found to have violated the defined security rule, it can be killed and being spawned back.
Centralized policy definition repository and distributed policy enforcement
Microservices architecture allows the application to be cloud native. Common characteristic of a cloud native application is that they can be provisioned quickly and on-demand. As these Microservices come and go they can be provisioned on different host machines. For the purpose of balancing resources, these Microservices might be moved around different host machine during its life span. Microsegmentation is able to adapt to dynamic and elastic nature of cloud native applications with distributed policy enforcement. The policy defined in a centralized location by the IT infrastructure administrator is enforced regardless of where the Microservices is provisioned.
