In an ideal world, all your critical data and the devices protecting it would be disconnected from the rest of the world, air-gapped, in a bunker under a mountain guarded by security detail. That way you know it is secure. If it’s not connected, then how can a remote attacker gain access?
But we don’t live in an ideal world, so in practice the systems with critical data are not only fed by other systems but often push to other systems so they do need to be connected. However, they only need to be connected to what is essential for operation. This is a key part of effective segmentation, and fundamental to zero trust principles.
“Zero-Trust Segmentation (ZTS) isolates critical resources so that if a network is compromised, the attacker can’t gain access.” Forrester
For example, does the laptop used by an employee from Human Resources for their day-to-day work need to be connected physically to the same network that houses or has access to a more secure segment, such as a Cardholder Data Environment (CDE)?
The ultimate mitigating control is to physically separate these segments. If the HR laptop becomes infected with a modern variant of ransomware, it cannot move laterally to more critical areas of the network such as the CDE.
Let’s imagine for a second that you are already breached - what does your Network Infrastructure Topology look like?
|
Is everything flat? If an attacker lands on a machine on the network, this leaves them only one hop away from the CDE and also exposes a huge attack surface to deploy an attack such as ransomware with a greater impact. |
|
|
Are some parts of the network like the CDE for instance isolated and segmented but everything else remains flat? Leaving a minimal attack surface for the CDE but a large remaining attack surface for the rest of the organization's network. |
|
|
Is everything isolated and segmented according to network function? Thus keeping the attack surfaces as minimal as physically possible to support the organization’s operation. If it’s not physically connected in some way, the attacker cannot get to it. |
|
Could that attacker access that firewall, escalate their privileges and open up a route from that segment to the CDE? What about beyond the CDE? Is every router, switch and firewall on the network secure?
Just by doing this, we have already started look at things through an attacker’s lens and highlighting the criticality of certain devices such as routers, switches and firewalls in protecting and controlling access to CDE.
ZT Effective Network Segmentation gives you:
Organizations that have adopted ZTS save an average of $20.1m in application downtime and deflect five cyber disasters per year.Venture Beat
Zero Trust Segmentation is absolutely critical in attack prevention and prevention of attack proliferation - containerizing the threat and preventing unwanted privilege escalation & lateral movement across the network. But effective network segmentation relies on the security and compliance of every router, switch and firewall. To see how Nipper and Nipper Enterprise can support this visit our solutions section.
Effective segmentation is reliant on effective attack surface management, which comprises:
This approach ensures we're looking at our networks, considering them from all angles, the way that an attacker would. It can help target remediation effort and resource – using threat intelligence to inform risk prioritization and remediation, allowing organizations to view what is most critical to them but also what is most likely to be exploited right now.
To learn more about how Nipper Enterprise can support asset assessment, watch Ian Robinson, Chief Architect at Titania talks through this and how Nipper Enterprise enables the shift from ad-hoc, sampled assessments to continuous compliance assurance for the Enterprise.