The Spaghetti of Firewall ACLs – Can Micro-Segmentation Help? (Peter Granic)

 If you haven’t been sitting on your ears, you’ve heard the industry buzz on how Micro-Segmentation is one of the required core tenants of a ZeroTrust architecture.

If you need a primer on ZeroTrust, there are plenty of resources available on the Security OEM vendor websites as well as from vendor-agnostic sites like NIST (https://www.nist.gov/publications/zero-trust-architecture), Forrester (https://www.forrester.com/blogs/category/zero-trust-security-framework-ztx/), and BT (https://business.bt.com/why-choose-bt/insights/cyber-security/zero-trust-security/). I can assure you that they will all have their technical & marketing white papers explaining how they view ZeroTrust.

My purpose however is not to promote this latest industry buzzword, but rather to suggest that the core tenant called Micro-Segmentation deserves every Network and Security Engineer’s attention, as it has the potential to make their life easier.

Consider the long and complicated ACLs and firewall rules that have grown in your network over the years. They are the bane of at least a few staff members’ existence within your team.

What can be more fun than pulling a two-thousand-line firewall policy and proving to an auditor that you still have the correct security policy in place to meet PCI compliance? That audit rabbit hole and the associated “Project Work” repercussion is every techie’s nightmare.

However, what I propose is that Micro-Segmentation has the potential to help you shrink that two-thousand-line firewall policy your company maintains in a major way. Think 50%-90% smaller!

At your next hardware refresh cycle will your current firewalls be overkill and would you be able to replace them with less expensive and less beefy models if your rule base has shrunk by 75%?

Will your 3 firewall staff engineers be able to work on more important deliverables if their day-to-day firewall policy admin work has been reduced by 50%?

This is the business case and outcome that I am suggesting is available were your company to leverage Micro-Segmentation. The solution, while usually championed by the security organization, has become more widely sought out and deployed in the marketplace, and further secures a company’s most business-critical applications and assets.

What does Micro-Segmentation mean to the Network Engineer?

For the network operations engineer, I’ll attempt to explain Micro-Segmentation in a simplistic way.

Think of it as meaning that the virtual and physical devices on your network get restricted into smaller and smaller “subnets” (not really subnets, but I’m just trying to help you understand the concept).

This is done by applying very granular security controls. Think of it as applying a specific, customized ACL or firewall policy to a single host that is unique only to that host - its very own firewall.

Some security vendors are doing just this, using host-based firewalls to apply very specific security policies at the host.

Before Micro-Segmentation

Let’s say your Finance web server resides in AWS, your Finance application server resides in AWS, and your Finance database server resides in your on-prem Data Center. You have a hundred other applications deployed using this similar architecture, but in Figure 1, we will show only 3 applications.

Figure 1 – Before Micro-Segmentation: Large Policy Securing with Granularity on the network firewalls

Your three firewalls in Figure 1 will have a unique policy with 5 rules that are unique for all 3 (or 100) applications, and this leads to a total of 15 (or 300) unique rules in the policy. The policy becomes larger and more complex as the number of applications in your environment grows.

After Micro-Segmentation

You deploy host-based firewalls for all 3 (or 100) applications on each individual host. You apply a very granular security policy on these host-based firewalls specific to each host as shown in Figure 2. The core network firewalls can then be deployed using a simplified, broad, and generic policy.

Figure 2 – After Micro-Segmentation: Simplified Policies on the 3 network firewalls. Granular firewall policies on each host using host-based firewalls.

When application traffic transits the core network firewalls in Figure 2, you no longer need your policy to be as large and granular given the controls in place at the server edges. The core firewalls are simplified in this way, while still being relied upon to provide more advanced security and threat protection controls against the traffic it inspects.

Are you less secure?

Let us suggest that a malicious developer with access to the HR App Server in AWS attempts to connect to the Finance DB server in your On-Prem Data Center. That traffic will be blocked even before it reaches the more permissive core firewalls as it gets blocked egress on the HR App Server’s host-based firewall.

Should the developer disable the host-based firewall on the HR App Server, the lateral attempt to connect from the HR App server gets blocked by the ingress Finance DB Server host-based firewall. The core network firewalls never see a completed 3-way handshake, and so a session is never added to their state tables, even though it was not explicitly blocked.

Simplified and Results in a Minimized Attack Surface

I’ve described this relatively straightforward strategy on how to deploy Micro-Segmentation in your environment and reduce the complexity of your core firewalls.

Security aficionados will also appreciate the outcome, as it will achieve a meaningful reduction of attack surface within your company’s network. Should an attacker manage to breach and gain access to that first host, they will be limited in their ability to conduct reconnaissance and move laterally from that point onwards.

For example, the attacker will not be permitted to port scan from the breached host outbound, because almost all ports will be blocked by its host-based firewall. The attacker will have a difficult time discovering hosts outside its application group, and thus will find it more difficult to move onto a higher-valued target in the environment by a significant order of magnitude.

Furthermore, when your company conducts its “Assumed Breach” testing, you may find that your testers make a request that micro-segmentation policies be relaxed somewhat, lest they find it very difficult to identify exploits and move laterally from the “Assumed Breach” starting point. That in itself will be a validation of the Security benefit of micro-segmentation to your organization.

But you are likely thinking all those host-based firewalls are a nightmare to manage.

Commercial Solutions

In my experience, several security vendors such as Illumio, Akamai (Guardicore), Cisco (Tetration), and others have been targeting the Micro-Segmentation challenge of managing host-based firewalls. They have built the tools to manage at scale, and their products handle both on Prem, Cloud, and Hybrid use cases.

To manage the large number of host-based firewalls, the Security vendors have built a software-defined solution using labels. Moves, adds, and changes don’t require an engineer to connect and configure each host-based firewall. Rather, the engineer relies on correct labels having been assigned to the host, and the host-based firewall policy is automatically pushed to the new host as well as to any hosts it communicates with.

Furthermore, if you re-IP your server, or move it from your Data Center to the cloud, the labels follow it even though the IP address has changed, and no stale policy remains with the old IP addressing.

The host-based policy gets updated automatically after its IP change, and any other hosts that require a connection to the modified host also have their host-based policy automatically updated.

This host-based firewall approach to applying Micro-Segmentation policies using the tools of one of the vendor solutions mentioned is a solid strategy. It retains your existing security controls, reduces complexity in your core firewall configurations, and reduces seriously the attack surface in your network should your company get breached.

And to get back to my core argument, you will achieve more efficient operations if you deploy this kind of Micro-Segmentation. If an application is broken, your trained team member will be able to troubleshoot a much smaller firewall policy, whether on a Network firewall or on a very granular host-based firewall.

There is no reason to maintain very granular and complicated network firewalls with two-thousand unique rules. Simplify and summarize these core network firewalls, apply advanced controls to handle advanced security threats for traffic that transits through them, and rely on the tight, granular security policy at each host.

The Entrepreneurs: The Relentless Quest for Value by Derek Lidow

 

Most of us think of an entrepreneur as someone who makes a lot of money for a lot of people very quickly. Entrepreneurs are justifiably a much-studied group - they have influenced us more powerfully than even governments or organized religion. The Entrepreneurs: The Relentless Quest for Value by Derek Lidow distinguishes itself from a crowded field by examining entrepreneurialism throughout recorded history, from Iceman Ötzi (c. 3250 BC) to the present. Entrepreneurs succeed by challenging the status quo and testing the limits, and there are risks involved for everyone. The historical record adds a completely new perspective to the relationship between entrepreneurs and our desire for a sustainable, equitable world.

The history of entrepreneurs is basically the history of mankind – people have been pursuing some sort of profit ever since humans began forming permanent settlements. In the Ötztal Alps in 1991, archaeologists discovered the mummified remains of what is now known as the Iceman (aka Ötzi). With him were found tools, clothing, and various medicines whose sophistication suggested he had obtained them in trade from early entrepreneur specialists.

People often took advantage of their environment – mineral deposits or other natural resources - to produce specialized goods. Balancing the self-benefit from these resources while exchanging goods to benefit others is basic to the nature of entrepreneurship. Stories of the beautiful beads of the Wadi Jilad or the copper smelters of Cabezo Jure’ illustrate how these practices came about. Before governments were sophisticated enough to take care of their citizens, people were forced to scramble and take responsibility for their own survival. Entrepreneurs filled a gap that their rules could not.

Economists don’t always agree on what constitutes an entrepreneur, but given their impact, it is important to have a working definition. Dr. Lidow visits this issue throughout the book and brings it to a crisp conclusion in the final chapter. My cousin is a fourth-generation farmer in North-Central California. The farm dates back to 1923. He took it over from his father, and now grows cherries, walnuts, and basil. Although he is an independent, self-directed businessman, that does not make him an entrepreneur. He has, however, developed new technologies for growing picking, shelling, sorting, etc. that break with tradition and have improved product yield and quality. He exchanges some of his services with neighboring growers to their mutual benefit. That makes him an entrepreneur.

The real power of entrepreneurialism comes from swarms, which rapidly scale new ventures. This made me think of smartphones – the early ones were amazing, but other entrepreneurs soon came along to capitalize on the idea, adding cameras, better cameras, and other distinguishing features to grab a piece of the business. This type of scaling has an enormous impact on the world.

Rapidly growing an entrepreneurial business requires resources, and the first evidence of venture capitalism was found chiseled into a cuneiform tablet. The port towns of 16th century England form the background for some enlightening stories about how early startups were legally organized, and the tale of the Dutch East Indies Trading Company demonstrated how the general public could also be a good source of funding for a joint-stock startup. On the other hand, John Law’s notorious failures at managing money left much of Europe wary of entrepreneurs throughout the 20th Century.

Unburdened by this history, America was an entrepreneurial place from the beginning, with fewer restrictions and a patent system to reward innovation. The management of the increasingly larger scale entrepreneurial endeavors led to a new type of organization – the corporation – which didn’t always follow the original founder’s vision. The stories of Cornelius Vanderbilt, John D. Rockefeller, J. P. Morgan, Henry Ford and, more recently, William Shockley and Jeff Bezos illustrate many of the challenges encountered by entrepreneurs along with their responses. Navigating legal restrictions, raising money, dealing with price competition, smoothing business cycles, and effectively managing large organizations were just a few of the trials they faced.

Early entrepreneurs focused on meeting people’s basic needs, but they soon recognized the market for wants, some of which were once known as “objects of astonishment”. Marketing is illustrated by the story of Josiah Wedgewood’s pottery -he was one of the first to market his premium goods in a retail store where customers could shop (and hopefully impulse buy). No one thought much about bad breath until a clever entrepreneur gave it the medical term “halitosis” and sold a version of a product once used as a medical antiseptic, known as Listerine.

Associating positive emotions with products gave rise to the hospitality industry, where people sought comfort and entertainment along with superior food and alcohol. Entrepreneur Edward Bernays leveraged his propaganda efforts during World War I to spawn the modern public relations industry, connecting certain products with good feelings and promoting the unquenchable desire for more and better things. He is responsible for making it fashionable for women to smoke.

Entrepreneurialism can produce, but it also has the capacity to destroy itself. The swarm is difficult to control, and is capable of unpredictable things, like the way scaling up the production of sugar led to the spread of slavery. Financial difficulties, deforestation, air pollution, and food safety all can be traced to entrepreneurial enterprises. Stories of food safety included a reference to adding opium to beer to make it addictive – reminiscent of the flavored, highly-addictive e-cigarettes that are currently marketed to young people.

Socially responsible entrepreneurship is the ultimate prize, but difficult to attain when entrepreneurs are by definition self-directed. Few can foresee the long-term consequences of their actions, and as some find ways to work around laws, others will follow. The Giving Pledge – notably signed by Bill Gates and Warren Buffett among others – is an example of what Andrew Carnegie had in mind – not worrying too much about the social consequences of your startup but pledging to give away at least half of the money you make to charity. Better than “break it now, fix it later” would be to estimate the future cost of entrepreneurial effort before sanctioning it.

As a former CEO of International Rectifier with a PhD in Applied Physics, Prof. Lidow is well qualified not only to put forth a thorough history of entrepreneurs, but also to highlight the lessons to be learned from their successes and failures throughout the centuries. He leaves the reader with a much clearer picture of what constitutes an entrepreneur, and what can be done to continue reaping the benefits of entrepreneurialism while minimizing the unwanted consequences. More than just an entertaining read, The Entrepreneurs: The Relentless Quest for Value is the beginning of a plan for encouraging good entrepreneurial efforts in the future.

Author Profile - Paul W. Smith - leader, educator, technologist, writer - has a lifelong interest in the countless ways that technology changes the course of our journey through life. In addition to being a regular contributor to NetworkDataPedia, he maintains the website Technology for the Journey and occasionally writes for Blogcritics. Paul has over 40 years of experience in research and advanced development for companies ranging from small startups to industry leaders. His other passion is teaching - he is a former Adjunct Professor of Mechanical Engineering at the Colorado School of Mines. Paul holds a doctorate in Applied Mechanics from the California Institute of Technology, as well as Bachelor’s and Master’s Degrees in Mechanical Engineering from the University of California, Santa Barbara.

Tap Tool setup for Multi-trace Analysis

When working with clients troubleshooting, training, or whatever they need, the topic of multi-trace analysis comes up. In some cases, the client suspects a device is dropping packets, wants to measure the latency across a device or link, or lastly wants to take a baseline measurement for their network management system.

As you well know, there are many ways to accomplish this but in this case, I am usually asked within the context of packet analysis or using multi-traces.

Offloading and Wireshark

I was troubleshooting with a client and they noticed that the client was sending 6k frames and seeing a lot of TCP ack errors. They asked me to look into it.

I immediately recognized what was going on and explained that most current network interfaces support offloading. This is basically where the protocol driver offloads processing to the network controller.

Wi-Fi Survey Basics

Based on your feedback, I’ve been putting together various videos explaining how to test and survey Wi-Fi.

Then I thought, why not get off my butt 😉 and go for a walk to show you some of the tips and tricks instead. I thought it was a fun and different way to convey some info.