What Is Microsegmentation?

Definition of Microsegmentation

Microsegmentation is a cybersecurity technique that allows organizations to better govern network access between resources (e.g., server-to-server/east-west traffic). By uniquely identifying each resource (e.g., server, application, host, user), your organization can configure permissions that provide fine-grained control of data traffic. When implemented using zero trust principles, microsegmentation enables you to stop lateral movement of threats, prevent workload compromise, and stop data breaches.

Microsegmentation vs. Network Segmentation

Although network segmentation and microsegmentation are often used interchangeably, they’re completely different concepts.

Network segmentation is best used for north-south traffic (i.e., the traffic that moves into and out of the network). With network segmentation, an entity, such as a user, is trusted once inside a designated zone of the network.

Microsegmentation, on the other hand, is best used for east-west traffic, or traffic that moves across the data center or cloud network—server-to-server, application-to-server, and so on. Simply put, network segmentation is like a castle’s outer walls and moat, whereas microsegmentation is like the guards standing at each of the castle’s interior doors.

How Microsegmentation Works

Microsegmentation solutions create secure zones that allow companies to isolate workloads from one another and secure them individually. They’re designed to enable granular (hence, “micro”) partitioning of network traffic to provide greater resistance to cyberattacks.

With an approach that includes microsegmentation policies, IT and security teams can tailor settings to different types of traffic, creating controls that limit network and application flows between workloads to those that are explicitly permitted.

Applying segmentation rules down to the workload level or application allows IT to reduce the attack surface, lowering the risk of an attacker moving from one compromised workload or application to another.

Why Legacy Segmentation Approaches Don’t Work

Legacy network segmentation solutions rely on firewalls that use network addresses to enforce rules. But because networks are constantly changing, policies must be continually updated as applications and devices move, which poses a challenge for on-premises data centers, in multicloud environments, and where IP addresses are ephemeral.

Additionally, network address-based approaches to segmentation can’t identify what’s communicating—for example, they can’t pinpoint the identity of the software. They can only tell you how it’s communicating, such as with the IP address, port, or protocol from which the “request” originated. This means that, as long as they are deemed “safe,” communications are allowed, even though IT and security teams don’t know exactly what’s trying to communicate.

Furthermore, once an entity is inside a "secure zone" on the network, the entity is trusted, which can lead to breaches and, on a flat network, lateral movement.

Why is Microsegmentation Important?

Microsegmentation is unique in that it allows IT to base policies and permissions on resource identity, making it the ideal method for creating intelligent groupings of workloads based on the characteristics of individual workloads communicating inside the data center. 

What’s more, microsegmentation doesn’t rely on dynamically changing networks or the business or technical requirements placed on them, so it’s both stronger and more reliable for network security. In fact, it’s a fundamental part of a zero trust network access (ZTNA) framework, which is proven to simplify access control.

It’s also easier to manage—you can protect a segment with just a few identity-based policies instead of hundreds of address-based firewall policies.

Microsegmentation Features

Some of the technical benefits of microsegmentation include:

• Centralized security controls and management across networks: Because microsegmentation manages east-west traffic rather than north-south traffic, your policies stand up to any traffic that moves through the segments they govern. And, because policy is more defined, you get much greater visibility into network activity than with network segmentation.
• Segmentation policies that adapt automatically: Policies are applied to workloads rather than hardware, so they remain intact regardless of infrastructure changes. This means that IT security teams can extend one set of controls anywhere, no downtime required.
• Gap-free protection: Security policies span cloud, container, on-premises data centers, and hybrid cloud environments. This is because policy is specific to the workload, not the segment of the network, which closes any and all potential vulnerabilities in security coverage.