Traditional perimeter firewalls designed for north-south traffic can’t deliver the control and performance needed to protect today’s applications and dynamic workloads. Organizations can technically use firewalls inside the perimeter to implement a layered security model, but it’s simply impractical for most businesses due to the expense and amount of time needed to configure and manage the necessary policies. As a result, today’s enterprises need a better way to defend large volumes of east-west network traffic against cyberattacks.
With a relatively flat network, any port or server can communicate with any other. This means that if a server firewall gets breached, a threat actor can move easily to any number of others in the network.
Preventing lateral movement within the data center provides a strong defense against attackers that overcome perimeter security measures. A microsegmentation firewall alternative can help businesses enforce increasingly granular policy controls to control east-west activity and limit the impact of a successful breach.
Enforcing segmentation policies at the application layer (Layer 7) effectively prevents lateral movement, since Layer 7 is where network services integrate with the operating system. The latest advances in microsegmentation at this level allow IT security to visualize and control activity at Layer 7, as well as use the traditional Layer 4 approach. This means that, instead of relying on IP addresses and ports, organizations can use specific processes to define segmentation policies for inside the data center. It also allows administrators to fulfill specific security and compliance requirements by defining policies based on attributes like processes, user identity, or fully qualified domain names.
Microsegmentation also offers several advantages over traditional methods, making it ideal as an internal segmentation firewall for the data center. Rather than introducing choke points in the infrastructure, it runs agents on each system that can organize with each other to create and enforce software-defined segmentation policies. Because of this, microsegmentation provides many more points of visibility from which to discover and contextualize activity in your environments, regardless of what the underlying infrastructure is today and wherever your evolving IT strategy takes you. This also makes it possible to create and manage policies without infrastructure changes or downtime. Not only is this much faster and easier, but it also leaves you with one set of controls that IT security teams can extend anywhere. With a microsegmentation (https://www.akamai.com/our-thinking/microsegmentation) firewall alternative, if you move a workload from the data center to the cloud, its policies will migrate with it automatically.