Where custom auth source code fits into the micro-segmentation, zero-trust architecture

Question

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of small chunks, and at every connection point do some sort of authentication/authorization.

What I'm wondering though is how you go about adding code to the network to do this kind of zero-trust micro-segmentation architecture. I am a Node.js/JavaScript developer and don't really see how, for example, I could add a token-based authentication system in the interface between a printer and a server. I don't understand if I should be somehow adding code to the printer directly, or if all my code lives on my custom servers, or if there is an intermediate layer where I add the custom code. By custom code I mean any security/auth logic.

Basically I would like to know to what devices do I add custom security/auth code, if it's just servers, or maybe there is a way to add custom code/logic to managed switches or routers or printers or other devices to which I have yet to encounter in learning about this.

Sorry if this is a basic or confusing question, I am just trying to understand how the pieces fit together currently.

Answer 1

As presented in the whitepaper, custom auth source code doesn't come into the picture at all. Neither, for that matter, do physical devices like switches, routers, servers, etc. It's specifically a set of tools and techniques for configuring and managing the virtual networks that sit on top of the physical networks inside of what they call a software-defined-data-center. So, this is all software, not hardware. And network management, not custom application code.

What they're advocating is, again, a set of tools and techniques for redefining virtual networks not merely as a set of addresses, routes, and endpoints, but as a set of isolated workloads and then tying a specific virtual network to each of those workloads in an isolated fashion in order to prevent lateral movement.

This way, if a resource for a given workload is breached, the attacker does not have access to the broader network that they might see on a traditional server in a traditional network segment, but only access to the specific network resources and endpoints provisioned for the virtual network for that specific workload.