TheMyths
networkofsegmentation
Segmentation isn’t new, just misunderstood. And with theInternet of Things looming, it’s more important than ever.

Myth #1

Role-based authenticationis segmentation.
Using “typical” authentication to provide users
access to certain services is not enough. There are
a number of ways to break authentication.
Reality Check: Even correctly implemented authentication may
not be totally reliable. If attackers gain physical access, theymight still exploit software flaws to bypass authentication
weaknesses (like pass-the-hash). If you really want to limit
access, you need to segment resources at a physical network
level too, and not rely entirely on user authentication.

Myth #2

Switches and VLANs provide
adequate network segmentation.
Switches, routers and VLANs won’t provide a big enough security
bump between segments. Just having something on a separate
network, doesn’t mean you can apply the proper security policies
to traffic between those two networks.
Reality Check: It's been possible to defeat switch-based VLANs foryears. It's certainly a good practice, but by no means adequate byitself. But when all you have is a hammer (the switch vendors),
everything looks like a nail.

Myth #3

I passed PCI-DSS, my segmentationmust be adequate.
Recent major retail breaches have proven that once hackers
get past the front door, they easily can penetrate the mostprivate protected systems.
Reality Check: Configurations change daily and one error on how
the network is configured or how the rules on either the VLANs oraccess control lists are configured, and you have a hole big
enough to drive a truck through.

Myth #4

Setting up many network segments
is expensive, and requires multiple
security devices/firewalls.
Though traditional firewalls only supported a limited
three-pronged network (WAN/LAN/DMZ), and didn’t offer
extra security services, modern solutions now allow you
to configure many secure network segments without
breaking the bank and installing many appliances.
Reality Check: Today’s next generation firewalls and UTM appliances
offer many independent ports, which you can use to segment yournetwork into multiple trust zones. They also provide a full suite ofsecurity services, allowing you to configure advanced security
policies between each segment. You can now get truly secure
segmentation at a great price.

Myth #5

Network segmentation is justnot a top business priority.
In a recent worldwide survey*, more than half of respondents said
that segmentation is just not a top priority on their security list.
Reality Check: Many don’t perceive network segmentation as apriority since it doesn’t seem to offer direct business benefits. Yet,they forget that not properly segmenting may result in huge businesscosts. The Target® breach is a great example — attackers
transformed access to an external partner portal into full access toTarget’s systems. True segmentation would have made it harder forattackers to jump from one network to another.

WatchGuard® Firebox M440 makes it easy toapply the right policies to the correct network
segment – without complex configurations.

Clear up the myths. Get the facts.
Go to WatchGuard.com/FireboxM440*WatchGuard Worldwide Survey, September 2014