Combining inter-system and inter-domain RUP, most firewalls are on the edge of an organizational network with respect to the public internet. That boundary is important, but it ignores an increasingly common function of firewalls inside the network itself: partitioning internal systems into different segments to reduce the impact of a compromise in one place becoming a compromise everywhere.
Effective use of a firewall for segmenting internal networks depends on understanding why flat, undivided networks create risk, and how dividing a network into deliberate zones changes what an attacker can actually do once they get past the initial point of entry.
Here is Why Flat Networks Pose an outsized risk
A flat network is one in which almost all devices and systems can communicate with each other without internal barriers. Part of the reason that many such networks evolve as organizations grow without intentionally revisiting their architecture is that this arrangement is easier to construct and maintain.
The issue becomes evident as soon as an attacker finds a foothold somewhere on what then is considered a flat network. In the absence of internal segmentation, that one compromised device is often worms its way to servers, databases and other systems far beyond what, for example, a compromised marketing station may have no business reason to ever speak with a finance department’s database server but on a flat network, that connection is just as easily made.
That dynamic can be seen over and over again in actual incident reports where attackers, having gained a foothold on some low-value system, move laterally to sensitive targets because nothing inside the network stopped them from trying.
See also: Why Accountability Is the Missing Piece for Most Real Estate Investors
How Segmentation Changes the Equation
Segmentation takes a network and breaks it into separate zones, with systems in each zone having similar business functions or security requirements, and then places a firewall at the boundary of each zone to control which traffic is allowed to cross. Instead of having a single massive trust domain the network breaks down into smaller domains each having their own definition of what can come in and go out.
This addresses the lateral movement problem directly. If an attacker scares up a host inside one zone soon enough, the firewall at that zone’s boundary only allows the attacker to touch some other activity zones. Instead of a breach propagating across the entire flat network, it is isolated to the segment where it originated, giving defenders enough time to detect and respond before damage spreads.
Designing this kind of architecture well requires more than simply adding firewalls at arbitrary points. The structural and security implications of how a modern enterprise network landscape is organized, detailed in NIST’s secure enterprise network guidance, make clear that segmentation decisions need to account for how applications, cloud services, and distributed offices actually connect to each other, rather than assuming a simple, centralized structure.
Semi-Supervised Learning with Attentional Mechanisms: Defining zones based on Function and Sensitivity
When segmenting systems, you should truly be grouping them based on what they do and the data that is handled rather than where it physically lies or what works as it would be convenient. A familiar methodology divides public-facing systems, internal business apps, and especially sensitive resources such as financial or customer data repositories into individual zones valid with firewall guidelines relevant to their threat degree.
Public-facing systems that must accept connections from anyone on the internet tend to have stricter inbound rules but more permissive outbound rules, as these systems are most exposed to external risk. Internal business apps that employees access may be in this zone which permits a broader level of internal access but restricts connections to the most sensitive backend systems. The rules governing these are the most restrictive of all, allowing connections from a limited, explicitly defined and essential few systems containing regulated data like databases or the equivalent only.
Getting these boundaries right requires understanding how traffic actually flows within the network day to day, not just how it is assumed to flow on paper. Much of this internal movement falls into the category of east-west network traffic patterns rather than traffic crossing the network’s outer perimeter, and that distinction matters because the volume and variety of east-west traffic inside a modern data center or cloud environment often dwarfs the traffic crossing the perimeter, which means segmentation decisions have to account for far more internal connections than many organizations initially expect.
Writing Rules that Actually Solve Business Needs
When zones need to be defined, the firewall rules that control traffic between those zones should reflect a real business need, not convenience. One of the most common mistakes in early segmentation attempts is creating rules so wide they don’t break anything, but create a lot of ease, upset and typically only end up replicating much of the same kind of security less access that the segmentation was supposed to remove in the first place.
A more regimented approach would begin by charting out what systems need to communicate with other systems and even for what purpose. This means an application server needs to connect to a certain database server on a specific port for that protocol, and the firewall rule should specify that explicitly, instead of allowing general traffic from one zone to another just because some level of communication is needed between them.
This kind of detail requires more initial effort because it requires understanding application dependencies that are rarely documented. Those organizations that avoid this step typically find themselves either blocking legitimate application traffic when rules are tight, or losing the ability to contain any attackers if rules are too lax. Both results aren’t what segmentation is aimed at.
Maintaining Segmentation as Networks Evolve
Segmentation is not a one-off project that, when executed well, lives for eternity. New apps are deployed, org structures change, and systems that had no incentive to communicate with each other end up via legitimate dependency on one another. So every one of these changes introduces a force for the organization to add new firewall rules and there is little discipline so over time those additions can gradually unravel on the very boundaries that segmentation sought to create.
Since this drifts the architecture out of whack, periodic review of existing rules helps catch it before anyone notices. Specific rules that are added for a temporary project but then never correctly removed, or wide-open permissions that were granted in short order to solve an immediate crisis represent just the sort of accrued liability that periodic audits are intended to find. Such a strategy can quickly regress to an approximation of the flat network, even if it was one that had been successfully designed through years of disciplined action.
Frequently Asked Questions
It does not mean which existing firewalls have to be replaced for network segmentation; rather
Not necessarily. One of the things that can be done is to implement segmentation on many of the organizations with existing firewall capability (at least most organizations have them), some might need to deploy more firewalls at new internal boundaries for proper zone separation.
How many zones should an organization typically have?
There is no universal number. The correct methodology is one that organizes systems by function and sensitivity, such that the number of zones is determined through some measure of system logic or data variability rather than a predefined template.
Does segmentation delay legal business activities?
Yes, if we write rules in an overly restrictive manner or without first mapping application dependencies. It thus minimizes the risk of a breach while ensuring that potential breaches are still contained but is in fact careful planning that goes to reflect real business needs.
