White Paper

Implementing
Segmentation in Phases
Stopping the lateral movement of threatsand preventing breaches©2022 Zscaler, Inc. All rights reserved.

Segmentation is an effective security strategy tostop the lateral movement of threats inside a cloudor data center environment–whether across virtualprivate clouds (inter-cloud) or inside them (intracloud). Segmentation is not defined by a single
implementation or security control; a broader andmore effective view of segmentation considers
multiple types of controls, all working together toprevent threats from spreading across the network–
across users and workloads.

©2022 Zscaler, Inc. All rights reserved.

White Paper

Introduction2

After working with numerous customers who

Environments include virtual private clouds

have purchased the full suite of products, Zscaler(VPCs), virtual networks (VNets) in public clouds,

has built a complete segmentation strategy thatand on-premises data centers. Zscaler forfocuses on the biggest risk areas first, and thenWorkloads segments and secures app-to-app

layers on subsequent controls in a way that makes

communications and prevents any threats frommicrosegmentation attainable. This strategy is

infecting workloads communicating to

implemented in three phases and follows zerothe internet.

trust principles. Zscaler believes that segmenting
and securing application connectivity is ajourney that requires a thoughtful and measured
approach–one that balances both security
requirements and operational considerations.

Phase three: application-to-application
segmentation within VPCs
Phase three layers on granular process-level

The three phases of segmentation are:control to further lock down connections routing

Phase one: user-to-application
segmentation

well as block the potential for server-to-server

Phase one starts by eliminating the largest threat

application communication down to the process

to your infrastructure: user connectivity. Userslevel; only verified applications can communicate

are often the weakest point in an organization’s

within the VPC to deliver zero trust security.

security posture; therefore, an effective
segmentation solution must protect against
threats from compromised users spreading
across the network and compromising workloads.
Zscaler for Users segments and secures userto-app communication and prevents any threats
from infecting users communicating with theinternet before they go on to accessprivate applications.

Phase two: application-to-application
segmentation across VPCs, regions,and clouds
Phase two ensures that all ingress andegress points are reviewed and remediatedby evaluating connectivity and reducing theattack surface wherever possible. This prevents

through the Zscaler Zero Trust Exchange™, as
lateral movement. Zscaler for Workloads uses
identity to segment and secure application-to-

In summary, the phased approach tosegmentation first controls access into theenvironment and enforces least-privileged
access by defining and filtering all ingressand egress points. This consolidation (andfiltering) of all inbound connectivity drasticallysimplifies the microsegment policy set to makemicrosegmentation more achievable in a realistic
time frame.
For segmentation to be effective, it must follow
zero trust principles–where the network is
assumed to be untrusted, and the identity andcontext of users and workloads must be verified
before any communication is allowed. Let’s look ata three-phased approach to segmentation basedon zero trust.

threats from infected applications or workloads
spreading from one environment to another.

©2022 Zscaler, Inc. All rights reserved.

White Paper

3

Zero trust segmentation, phase one: user-to-app
Infected users are the number one risk to an organization. Legacy architectures admit the user to thecorporate network and allow them to access any application across the enterprise, which is extremely risky.
For example, a salesperson logged in via a VPN, who should have access only to the CRM application,
could see all the other applications in the environment, and could even get access to a sensitive HR
application. To reduce this risk, user access to applications should be restricted to only the necessary
applications (i.e., user-to-app segmentation).
Unlike legacy architectures, Zscaler never places users on the network. The Zero Trust Exchangearchitecture directly connects users to applications for true zero trust security. Because all communications
go through the Zero Trust Exchange, the network is no longer routable. This reduces security risks andgreatly simplifies segmentation policies without the network complexity.

Public Cloud

Public Cloud

Public CloudAC

AC

Factory/Plant

Data Center

IoT/OT Subnet

Zero Trust
ExchangeAC

IoT/OT Subnet
Traditional network
segments of like resources

3rd-Party Contractor
IoT/OT

B2B Customer/Suppliers
Order Fulfillment

Engineering
Source Code Management

Figure 1: Phase 1, user-to-app segmentation. Business policies connect users to apps, not networks. See the colored lines connecting
specific users to specific applications and nothing else. This eliminates the risk of lateral threat movement.

Zscaler makes it simple to achieve user-to-

Implementing phase one is very simple, especiallyapplication segmentation. First, an applicationfor existing Zscaler customers who may havesegment (e.g., a CRM application) needs to be

started with a more open connectivity-oriented

defined. Zscaler provides the ability to define anapproach, because nothing new needs to be

application segment as specifically or granularly

deployed on end user devices, in the cloud, or inas needed. Then, the application segment needs

data centers. Zscaler Client Connectors and App

to be added to a policy where specific users,

Connectors are used to enforce segmentation. All

based on their identity and context (e.g., SAML

that needs to be done is defining segmentation

attributes, device status), are allowed to accesspolicies in the Zero Trust Exchange. User-to-

the application segment–that’s it. To simplify

application segmentation is a foundational first step

policies further, application segments can bethat is often tackled before organizations move to

added to segment groups.

phase two.

©2022 Zscaler, Inc. All rights reserved.

White Paper

4Zero trust segmentation, phase two: app-to-app across environments
The second phase of segmentation is to ensure that application workloads in public clouds can securely
communicate with other applications across VPCs, cloud regions/providers, and back to on-premises data
center applications. This approach secures the remaining ingress and egress points–i.e., traffic leaving
a VPC or re-evaluating VPC connectivity to on-premises data centers–and ensures there is no open,
persistent network connectivity presenting an attack surface and increased risk of lateral threat movement.
Additionally, outbound/egress protection for workloads ensures that workloads can securely communicate
to internet destinations.
Zscaler uses the same Zero Trust Exchange (explained in Phase 1) to directly connect application segments
to other application segments without placing them on the network, yielding true zero trust security andeliminating lateral threat movement across VPCs, regions, and cloud environments.

Public CloudAC

Public Cloud

Public CloudAC

AC

Factory/Plant

Data Center

IoT/OT Subnet

Zero Trust
ExchangeAC

AC

IoT/OT Subnet
Traditional network
segments of like resources

3rd-Party Contractor
IoT/OT

B2B Customer/Suppliers
Order Fulfillment

Engineering
Source Code Management

Figure 2: App-to-app segmentation–lines highlighted in a blue glow show how only specific application workloads securely
communicate across two regions of a public cloud, across clouds, and from the public cloud to data centers.

Legacy approaches to workload connectivity and segmentation have relied on extending the network
to the cloud. This approach uses network-based VPNs and firewalls to create full mesh networks andseparate network segments. This network-based approach requires potentially thousands of firewall rules,
which are complex to create and manage—and it offers little security benefit, since the network remains
routable, and applications can still be discovered and exploited.
In contrast, Zscaler Private Access for Workloads uses the Zero Trust Exchange architecture to directly
connect applications to other applications across any environment. The zero trust architecture that securesuser-to-application access is also used for securing application-to-application access.

©2022 Zscaler, Inc. All rights reserved.

White Paper

5This approach further simplifies segmentation(e.g., Terraform and CloudFormation) for

while extending zero trust security to application-

installing Cloud Connectors in the public cloud

to-application communication. Similar toenvironments–these can be downloaded fromphase one, with the Zero Trust Exchange,

the AWS and Azure marketplaces. Moreover,there is no IP-connected routable network, so

policies are easily defined in the familiar

lateral movement across environments (e.g.,

ZPA console.

VPCs, regions, or clouds) is prevented while
only approved applications can communicate.
Because applications are not on the network,
segmentation policies can be much simpler.

With phases one and two implemented, youwill have made significant progress with yoursegmentation initiatives to stop the lateral
movement of threats from users to applications

Implementing phase two is simple because only

as well as between applications acrossa Cloud Connector virtual appliance needs toenvironments. To further secure app-to-app

be installed at the VPC/VNet gateways. Zscaler

communications within a VPC, you canprovides automated scripts and templates

use microsegmentation.

Zero trust segmentation, phase three: app-to-app within VPCs
This phase of segmentation adds another layer of security to applications that protects communications
within a VPC environment by getting rid of the flat network and stopping lateral movement. This is also
commonly referred to as microsegmentation.
Legacy firewall-based approaches to microsegmentation result in thousands of rules that are impossible
to manage. This approach is not secure because attackers, once inside an environment, can piggyback
on approved firewall rules. These address-based controls have no visibility into the identity of thecommunicating applications, which makes them exploitable.
Zscaler Workload Segmentation is the only zero trust solution that microsegments applications using theircryptographic identity fingerprint, rather than address-based controls, to protect process-to-process levelcommunication within a VPC or data center environment. This is the highest level of protection for themost sensitive applications.
Zscaler Workload Segmentation provides zero trust protection by verifying the identity of thecommunicating software, including processes, before allowing any communication. Using identity this way
enables you to reduce policies by up to 90% vs. firewall rules, dramatically simplifying microsegmentation.
Zscaler Workload Segmentation provides visibility into application communications and tests effectivenessbefore enforcement using simulated policies, which adapt to allow for the introduction of new applications
or application upgrades in your environment. Workload Segmentation uses an agent-based approach.

©2022 Zscaler, Inc. All rights reserved.

White Paper

6

Public CloudAC

Public Cloud

Public CloudAC

AC

Factory/Plant

Data Center

IoT/OT Subnet

Zero Trust
ExchangeAC

AC

IoT/OT Subnet
Traditional network
segments of like resources

3rd-Party Contractor
IoT/OT

B2B Customer/Suppliers
Order Fulfillment

Engineering
Source Code Management

Figure 3: Identity-based segmentation at the process level. See the top-right corner–workload communications inside a VPC or a data
center are protected by identity verification. Workloads are fingerprinted to establish identity.

Before beginning this phase, all workload and user access should ideally be secured by Zscaler Private
Access for Workloads in phases one and to avoid “local unmanaged” policies, which occur when
agents cannot be installed on certain workloads. If phases one and two are not done, you may need toaccommodate numerous IP ranges representing groups of clients on the network who should have accessto certain applications—which creates lateral movement risk because you cannot verify the source.

Stronger security with the phased approach to segmentation
In summary, accomplishing the three phases of segmentation will offer the highest level of protection fromlateral threat movement while advancing your organization’s zero trust security initiatives. Zscaler delivers aholistic segmentation solution that is easy to implement and delivers measurable value at every phase.

1. User-to-application
segmentation

2. Application-toapplication segmentation
across environments

3. Application-toapplication segmentation
within a VPC

Phase one eliminates the greatest
source of risk–compromised users
infecting application workloads inthe cloud/data center

Phase two provides the second
layer of protection to prevent
threats from entering anenvironment (e.g., when workloads connect to the internet) andinfected workloads moving
laterally across the entire cloud/data center environment

Phase three layers on true
microsegmentation, at theapplication process level, toprevent lateral movement of
threats within a VPC©2022 Zscaler, Inc. All rights reserved.

White Paper

72 App-to-App Segmentation in Hybrid/Multicloud Environments

3 Identity-Based Process Segmentation• VPC to VPC• Unique identity for each app or process• Network segment to network segment (cloud to cloud or DC)• ML models comms, automates policy creation• No network changes required• DC and public cloud (Azure, AWS, Azure)

Public CloudAC

Public Cloud

Public CloudAC

AC

Factory/Plant

Data Center

IoT/OT Subnet

Zero Trust
ExchangeAC

AC

IoT/OT Subnet
Traditional network
segments of like resources

3rd-Party Contractor
IoT/OT

Figure 4: The three phases ofsegmentation work together asa single solution.

B2B Customer/Suppliers
Order Fulfillment
1

Engineering
Source Code Management

User-to-App Segmentation• Business policies connect users to apps, not networks• No lateral threat movement

Talk to your Zscaler representative today to see a demo.
You can also schedule an architecture workshop to startbuilding your segmentation plan.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloud security platform. Learn
more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2022 Zscaler, Inc. All rights reserved.
Zscaler™ and other trademarks listed at
zscaler.com/legal/trademarks are either (i)registered trademarks or service marks or (ii)trademarks or service marks of Zscaler, Inc.
in the United States and/or other countries.
Any other trademarks are the properties of
their respective owners.

zscaler.com