Microsegmentation

Microsegmentation limits lateral movement by enforcing least-privilege network access between individual workloads, not just network perimeters.

How it differs from traditional segmentation

• Traditional: VLANs and firewalls at network boundaries.
• Microsegmentation: Policies at the workload or process level.

Implementation approaches

• Host-based firewalls: iptables, Windows Firewall with policy management.
• Cloud security groups: AWS Security Groups, Azure NSGs.
• Service mesh: Istio, Linkerd for container environments.
• SDN solutions: VMware NSX, Cisco ACI.
• Agent-based: Illumio, Guardicore for workload policies.

Zero Trust foundation Microsegmentation is a core Zero Trust control:

• Default deny between workloads.
• Explicit allow rules based on identity and context.
• East-west traffic inspection and control.
• Continuous verification of communication.

Use cases

• Isolate sensitive databases from web tiers.
• Contain blast radius of compromised workloads.
• Meet compliance requirements (PCI DSS cardholder data isolation).
• Protect legacy applications that cannot be patched.

Implementation steps

1. Map application dependencies and traffic flows.
2. Define security policies based on workload identity.
3. Deploy in monitor/alert mode first.
4. Gradually enforce policies, starting with critical assets.
5. Continuously refine based on traffic analysis.

Cloud-native options

• AWS: Security Groups + VPC endpoints.
• Azure: NSGs + Application Security Groups.
• GCP: Firewall rules + VPC Service Controls.
• Kubernetes: Network Policies.