2

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of small chunks, and at every connection point do some sort of authentication/authorization.

What I'm wondering though is how you go about adding code to the network to do this kind of zero-trust micro-segmentation architecture. I am a Node.js/JavaScript developer and don't really see how, for example, I could add a token-based authentication system in the interface between a printer and a server. I don't understand if I should be somehow adding code to the printer directly, or if all my code lives on my custom servers, or if there is an intermediate layer where I add the custom code. By custom code I mean any security/auth logic.

Basically I would like to know to what devices do I add custom security/auth code, if it's just servers, or maybe there is a way to add custom code/logic to managed switches or routers or printers or other devices to which I have yet to encounter in learning about this.

Sorry if this is a basic or confusing question, I am just trying to understand how the pieces fit together currently.

1

As presented in the whitepaper, custom auth source code doesn't come into the picture at all. Neither, for that matter, do physical devices like switches, routers, servers, etc. It's specifically a set of tools and techniques for configuring and managing the virtual networks that sit on top of the physical networks inside of what they call a software-defined-data-center. So, this is all software, not hardware. And network management, not custom application code.

What they're advocating is, again, a set of tools and techniques for redefining virtual networks not merely as a set of addresses, routes, and endpoints, but as a set of isolated workloads and then tying a specific virtual network to each of those workloads in an isolated fashion in order to prevent lateral movement.

This way, if a resource for a given workload is breached, the attacker does not have access to the broader network that they might see on a traditional server in a traditional network segment, but only access to the specific network resources and endpoints provisioned for the virtual network for that specific workload.

  • Somewhere I need to write code to implement this, I just don't know where. – Lance Pollard Jan 1 at 18:38
  • 1
    @LancePollard Not to do what they're talking about in this paper. You need to migrate your data center to run on VMWare products. It's all implemented in their software. – Xander Jan 1 at 18:54
  • Oh I was wondering how their source code then fits into the mix. I would like to implement it myself rather than use a third party. – Lance Pollard Jan 1 at 18:59
  • 1
    @LancePollard The entire concept requires infrastructure virtualization, so at minimum, you need a hypervisor (server virtualization) and a network virtualization layer that you control and can modify before you can start to think about building this architecture on top of it. You can't build this with just physical infrastructure and applications. – Xander Jan 1 at 19:49

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.