Penetration Test Report (Bishop Fox): Bishop Fox Research Report Efficacy of micro segmentation V01

EFFICACY OF MICRO-SEGMENTATION
ASSESSMENT REPORT
JUNE 04, 2020
©BISHOPFOX | PROPRIETARY
Bishop Fox
Contact Information
[PII_REDACTED]
contact@BishopFox.com
8240 S. Kyrene Road Suite A-113 Tempe, AZ 85284
©BISHOPFOX | PROPRIETARY ILLUMIO: ASSESSMENT REPORT | CONTACT
EFFICACY OF MICRO-SEGMENTATION
TABLE OF CONTENTS
EXECUTIVE REPORT 01
Project Overview 01
Summary of Testing 02
Assessment Report 06
Test Environment & Policies 06
Methodology 11
Test Results 12
Conclusions 25
©BISHOPFOX | PROPRIETARY ILLUMIO: ASSESSMENT REPORT | TOC
EFFICACY OF MICRO-SEGMENTATION
EXECUTIVE REPORT
Project Overview
Illumio Inc. engaged Bishop Fox to measure the effectiveness of SCOPE
micro-segmentation using the Illumio Adaptive Security Platform (ASP) Illumio ASP platform
as a control in limiting lateral network movement. The following report
DATES
details the findings identified during the course of the engagement,
03/16/2020
which started on March 16, 2020. Kickoff
03/23/2020 – 04/08/2020
GOALS Active testing
05/12/2020
• Create a repeatable testing methodology that can be
Report delivery
leveraged by third parties looking to replicate testing in their
own environment
• Record time required to reach the trophy in each use case test
• Review the level of detectable network traffic generated as a
result of increased micro-segmentation
• Determine the overall efficacy of micro-segmentation as
it relates to the generation of detectable events and time
investment required for an attacker to traverse the network
abstract
Attackers spend a great deal of time on lateral movement during a breach — as they surf a network,
attempting to find the ‘trophies’ they are after — and networks with little or no control over this movement
provide an easy pathway for an attacker to their intended target. This means that once an adversary enters
a network through a beachhead, a weak or insecure target used as a launching point (be it an endpoint,
a workload, a server, etc.), they act as a burglar in a building where all the doors are open, calmly moving
from room to room, picking up anything of value.
Lateral movement is also why malware and, in particular, ransomware can have such a crippling effect on
an entire organization. All high-profile ransomware attacks exploit that same freedom of lateral movement
around the network in order to spread at a devastating pace and bring a network to its knees.
Zero Trust, and specifically micro-segmentation as a capability in a Zero Trust security framework, is
focused on hindering this freedom of lateral movement. Micro-segmentation forces attackers (and
malware) to work harder and smarter. In the best case, micro-segmentation can nullify the threat, and in
the worst case, all that increased activity leads to increased opportunity for detection by the defender.
©BISHOPFOX | PROPRIETARY ILLUMIO: ASSESSMENT REPORT | 01
EFFICACY OF MICRO-SEGMENTATION
EXECUTIVE REPORT
It is widely understood that micro-segmentation controls hamper lateral movement, but by
how much? How effective are various types of micro-segmentation policy in thwarting an
attacker, and do they force any changes in behavior? This is precisely what this assessment
looked to measure.
The results of this engagement highlighted the importance of implementing micro-segmentation
in real world environments. Overall, the team identified that the time needed to gain access to
sensitive information (i.e., obtain the “crown jewels”) increased quantifiably as more strict micro-
segmentation controls were enabled on the tested environments, showing a clear, measurable
benefit by forcing the attacker to exhaust more time in order to access sensitive information
and resulting in the generation of more detectable events, providing a blue team with a better
opportunity to detect the attack.
Summary of Testing
The assessment team performed a succession of attack simulations on network environments
created by Illumio to measure the effectiveness of the product’s micro-segmentation controls
against a series of attacks.
To perform the measurements, the team retained the following indicators prior to the start of
the testing activities:
• Time for an attacker to obtain the “crown jewels” (referred to as Time to Completion)
• Number of hosts/workloads identified on the network
• Number of services identified on the network
The team ran attack simulations in Illumio-controlled environments, which possessed the
following properties:
• All workloads had the Illumio VEN agent installed and were paired with the Management
Platform (the Policy Compute Engine or PCE)
• The workload size was identical for the first four tests
• Two tests were repeated with higher workload sets to determine the impact to the
Time to Completion metric
©BISHOPFOX | PROPRIETARY ILLUMIO: ASSESSMENT REPORT | 02
EFFICACY OF MICRO-SEGMENTATION
EXECUTIVE REPORT
To obtain meaningful measurements, four test cases were defined:
• Control Test: Represented a flat network with no segmentation.
• Use Case 1 – Environmental Separation: Production workloads can only communicate to other
Production workloads, Development workloads can only communicate to other Development workloads.
• Use Case 2 – Application Ring Fencing: Workloads associated with the same application and within the
same environment can communicate with each other – e.g., Ordering Application / Production workloads
can only communicate to other Ordering Application / Production workloads.
• Use Case 3 – Tiered Segmentation: Workloads associated with a specific tier within a specific application
and environment can communicate with each other – e.g., Web Tier / Ordering Application / Production
workloads can only communicate to other Web Tier / Ordering Application / Production workloads.
In an attempt to limit bias during the testing, the assessment team was not made aware of the policies
implemented for the different use cases (except for the control test, which was representative of a flat
network and had no micro-segmentation policy applied). The micro-segmentation policies implementation
details are described later in this report.
For the attack simulations, the assessment team developed a methodology based on the main
components of the MITRE ATT&CK® framework, in an attempt to map their activities against documented
Tactics, Techniques, and Procedures (TTPs) used in real world scenarios. The details of this methodology
can be found in the Methodology section of this report.
TIME TO COMPLETION IN HOURS
25
20
15
10
5
0
HRS CONTROL USE CASE USE CASE USE CASE
FLAT NETWORK ONE TWO THREE
= 100 workloads = 500 workloads = 1,000 workloads
FIGURE 1 – Results and extrapolations based on test outcomes
©BISHOPFOX | PROPRIETARY ILLUMIO: ASSESSMENT REPORT | 03
140
120
100
80
60
40
20
0
0 [PII_REDACTED] 10000 12000
HOST COUNT
©BISHOPFOX | PROPRIETARY ILLUMIO: ASSESSMENT REPORT | 04
SRUOH
EFFICACY OF MICRO-SEGMENTATION
EXECUTIVE REPORT
USE CASE TWO PROJECTIONS
FIGURE 2 – Projections based on use case 2 outcomes
EFFICACY OF MICRO-SEGMENTATION
EXECUTIVE REPORT
100 WORKLOAD TEST RESULTS
Identified Identified Reqiured Total Blocked ALLOWED
TEST hosts Ports Time (HRS) Connections Connections Connections
CONTROL 99 293 0.5 13,361,949 0 13,361,949
USE CASE 01 91 219 1.5 7,705,052 16,902 7,688,150
USE CASE 02 99 173 2.25 11,905,973 64,033 11,841,940
USE CASE 03 99 130 4.75 187,564 181,772 5,792
FIGURE 3 – Results of testing 100 Workload environments
The assessment team observed that for a 100 workloads environment, it would respectively take an
attacker 300% (Use Case 1), 450% (Use Case 2), and 950% (Use Case 3) more time to obtain the crown
jewels, compared to the control environment (flat network scenario).
The team identified that although the number of discovered hosts on the network varied between the
different test cases, they were able to successfully enumerate all of them. However, the number of
discovered services linearly decreased by 44% between the control environment test and Use Ca