What is Network Segmentation?

The Inner Workings of Network Segmentation

Network segmentation can be performed in a few different ways. One common approach is firewall segmentation. In this approach, an organization deploys a firewall at a desired network boundary and architects the network, via physical links or virtual local area networks (VLANs), so that all traffic crossing the boundary is routed through that firewall.

By providing the firewall with complete visibility and control over boundary-crossing traffic, the organization can enforce access controls for that boundary. Based upon predefined rules, the firewall can allow or block different types of traffic. These rules can restrict access to a network segment to certain users or applications, block certain types of traffic from crossing the boundary, etc.

Using software defined networking (SDN), an organization also has the option of implementing microsegmentation. Microsegmentation increases the granularity of segmentation by isolating individual workloads from one another, rather than working on the scale of multiple endpoints like traditional network segmentation. This additional granularity amplifies the benefits of network segmentation by providing the organization with a higher level of network visibility and control.

Why Do We Need Network Segmentation?

If all traffic were permitted to enter and leave the enterprise network, the probability of successful cyberattacks would grow exponentially. The organization’s perimeter firewall acts as its first line of defense against external attackers.

However, organizations can also reap significant advantages from implementing internal network segmentation. Examples of some of the major network segmentation benefits include:

• Increased Visibility: A firewall gives an organization visibility into any traffic that passes through it. The more segmented an organization’s network, the greater the visibility an organization has into its internal network traffic.
• Defense in Depth: An organization’s perimeter defenses help to detect and block a number of threats from entering the network, but they can’t catch everything. Adding multiple network boundaries between critical assets and the outside world provides additional opportunities to detect and respond to an intrusion.
• Improved Access Control: The firewalls that implement network segmentation can enforce access control policies. This enables an organization to restrict network access based upon need-to-know.
• Restricted Lateral Movement: Cybercriminals typically compromise user workstations and need to move through the network to access critical systems and achieve their objectives. Network segmentation makes this more difficult to achieve and increases their probability of detection as they attempt to cross segment boundaries.
• Insider Threat Management: Perimeter-based defenses can be effective at detecting external threats but are blind to malicious insiders. Internal network segmentation provides visibility and threat detection for malicious employees and compromised accounts.
• Better Network Performance: Network segmentation breaks an organization’s intranet into discrete segments with defined roles. This decreases network congestion and improves performance.
• Protecting Critical Systems. Some systems, like industrial control systems (ICS), have very high availability requirements, making them difficult to update and protect against cyber threats. ICS security best practices include placing them on isolated network segments to minimize their exposure to potential threats.
• Isolating Untrusted Systems. Many organizations have public guest networks, and the growing use of business Internet of Things (IoT) devices introduces a number of insecure and untrusted devices on enterprise networks. Isolating these devices on a separate network segment is an IoT security best practice and limits the threat that they pose to the result of the enterprise network.
• Simplified Regulatory Compliance: The scope of regulatory compliance audits typically includes all machines with access to protected data. Network segmentation limits this scope by containing sensitive and protected information to a particular network segment, simplifying regulatory compliance responsibilities.

Implementing Zero Trust Through Network Segmentation

Implementing a network segmentation policy is a crucial step toward a zero trust security policy. Zero trust security relies upon the ability to enforce access control policies based upon employee job roles. Network segmentation creates boundaries where traffic can be inspected and these access controls can be applied and enforced.

Check Point’s next-generation firewalls are an ideal solution for implementing network segmentation. They not only provide content inspection and access control enforcement but also incorporate a range of threat detection solutions for identifying and blocking malicious traffic attempting to cross segment boundaries. To learn more about Check Point’s solutions, contact us. Then, request a demo to see Check Point NGFWs’ capabilities for yourself.