Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>In this webinar, Kyle Wickert, Worldwide Strategic Architect at AlgoSec, will get you started on your micro-segmentation journey.</p>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

<p>As cyber threats become more sophisticated, companies of all sizes are struggling to stay secure. Regardless of how many different firewalls you use, it’s merely a matter of time until a threat gets through. To prevent serious breaches, networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to build a micro-segmentation strategy that truly protects your organization’s valuables.</p> <p>In this webinar, Yoni Geva, Product Manager at AlgoSec will cover:</p> <ul> <li>Segmentation challenges</li> <li>Micro-segmentation explained</li> <li>Micro-segmentation strategy benefits</li> <li>Micro-segmentation strategy development – first steps</li> <li>Implementation Do’s and Don’ts</li> </ul>

<p>What links the Antwerp Diamond Heist, one of the world’s largest jewelry thefts and data center security? The famous heist was possible because there was no security within the safe deposit vault, enabling the criminals to stay inside undetected for days and steal items worth $100M.</p> <p>Similarly, to help prevent serious breaches, data center networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to create and manage a micro-segmented data center environment that truly protects your organization’s valuables.</p> <p>In this webinar, Avivi-Siman-Tov, Product Manager at AlgoSec will cover:</p> <ul> <li>How to securely migrate applications to a micro-segmented data center</li> <li>Identifying and avoiding common network segmentation pitfalls</li> <li>Defining and enforcing effective security policies for the micro-segmented data center</li> <li>Managing micro-segmented data centers alongside traditional networks and devices</li> <li>Identifying and managing security risk and compliance in a micro-segmented data center</li> </ul>

Micro-segmentation good things really come small packages

<p>For years, organizations have focused most of their network security efforts on the perimeter. First there were firewalls, then intrusion prevention systems came along followed by web proxies, and recently advanced malware detection (AKA sandboxing) solutions. This perimeter-focused approach is often referred to as the M&amp;M Strategy – a hard crunchy outside and soft chewy inside. The problem of course, is once hackers successfully penetrate the perimeter of the network or the data center, (and let’s face it, this has not been a rare occurrence in recent years) there is very little restriction of lateral movement between servers in the data centers.</p> <p>Enter network segmentation. The need for effective network segmentation is common knowledge, but it is hardly common practice. A poll which we ran (as part of this great webinar) asked IT professionals to describe their network segmentation strategy. Just 30% of respondents said that they strategically set segmentation around business drivers for the latest threats. About a third of respondents said they “set and forget” their segmentation and an equal number reported that they occasionally revisit it—typically around audit time. A brutally honest 6% said “My network what?”</p> <p>Maintaining effective network segmentation is hard. For starters, you have to figure out how to categorize your assets: what should I protect, who should be able to access it, what is the classification and regulatory environment of data, to name a few. Once you have done it, you need to put in network segmentation controls, typically firewalls. These add cost and perhaps more importantly, add complexity and management overhead. Anyone who has had to process a network access change request that traverses multiple network segments and firewalls, while ensuring that the security and compliance posture is intact, would probably have preferred to schedule a root canal procedure instead.</p> <p>So onto the million dollar question: Additional network segments adds security and granularity but it also adds cost and complexity… so how many segments does it make sense to have in my network? Well lately, some argue “as many as possible” – say hello to micro-segmentation.</p> <p>At its core, micro-segmentation is a fancy term for host-based firewalling. This concept has been around since the beginning of firewalls, and never really caught on because of the unreasonable cost and complexity of placing a firewall on every server. But recent developments in cloud and software-defined networking are reinvigorating this security concept. Amazon Web Services for example, offers free built-in “Security Groups” on every instance – this is essentially micro-segmentation in which the security controls are abstracted from the user. The VMWare NSX platform offers hypervisor level virtual firewalling on every host.</p> <p>Here are some key things to consider when looking at micro-segmentation:</p> <p> Security – network firewalls are typically rugged, hardened appliances that are very difficult to attack. According to Gartner, 95% of firewall breaches are the result of misconfiguration, not firewall flaws. We must ensure that host-based firewalls cannot be easily disabled or circumvented by an attacker who is able to get access to the machine which runs it.</p> <p> Integration with Legacy Firewalls – the big box with blinking lights at the perimeter or at the entrance to the data center isn’t going away anytime soon. Companies will still need a way to manage traditional firewalls alongside host-based firewalls, in the data center or in the cloud. In a recent survey, 79% of companies expressed the need for better visibility across on-premise and cloud environments.</p> <p> Automation – if you think manual firewall operations are tough today (and they are!), wait until you have a firewall on every machine! Without automation across environments and devices, micro-segmentation is simply not feasible.</p> <p>So is micro-segmentation the way of the future? It’s probably too early to tell, but its certainly worthy of consideration, if not on every machine, then in areas of your network where the “honeycomb” segmentation strategy truly adds value.</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

Why thinking small is the key for network security

<p>Tsippi Dach explains why micro-segmentation is vital to minimize damage left by lateral movement across the network</p> <p>On the 15th August 2020, cruise company Carnival Corporation fell victim to a cyberattack that may have resulted in the loss of personal data belonging to millions of passengers and crew.</p> <p>Carnival is the world’s largest travel leisure business, hosting around 13 million passengers per year which equates to a lot data. The company has not revealed how many customers or which brands were targeted, but what we do know is that law enforcement agencies were notified after one of its brands detected a ransomware attack that breached an encrypted portion of its network.</p> <p>This isn’t the first time that Carnival has been breached by hackers. In 2019, a cyberattack on Princess Cruises and Holland America Line resulted in the personal data of hundreds of passengers and crew being compromised. The criminals stole passenger names, Social Security numbers, passport numbers and credit card information.</p> <p>Whilst many of us would presume that thinking about the big picture is the best way to look for ways to protect large companies, the answer actually lies in something much smaller &#8211; network micro-segmentation.</p> <p>Damage limitation with micro-segmentation</p> <p>Hackers are never going to give up targeting large corporations, and ransomware attacks like that on Carnival are not going to disappear. As cybercrime becomes more sophisticated, it is not going to be easy to completely defend your network from malicious hackers. What companies can do, however, is limit the potential damage hackers can cause if they do gain access to sensitive company or customer data.</p> <p>One way to do this is through network micro-segmentation, which is regarded as one of the most effective methods to reduce an organization’s attack surface. A lack of it has often been cited as a contributing factor in some of the largest data losses in ransomware attacks.</p> <p>Micro-segmentation minimizes the damage that hackers can do if they gain access, by stopping lateral movement across your networks. Just as the watertight compartments in a ship should contain flooding if the hull is breached, segmentation isolates servers and systems into separate zones to contain intruders or malware as well as insider threats, limiting the potential security risks and damage.</p> <p>Controlling your borders</p> <p>Although micro-segmentation is recognized as an effective method to enhance security, some businesses have been slow to adopt it because it can be complex and costly to implement, especially in traditional on-premise data centers.</p> <p>However, as more organizations move to virtualized data centers using Software-Defined Networking (SDN), some of the barriers associated with micro-segmentation have been eliminated.&nbsp;</p> <p>SDN’s flexibility enables more advanced, granular zoning, allowing networks to be divided into hundreds of microsegments, delivering a level of security that would be prohibitively expensive and complicated to implement in a traditional data center.</p> <p>It’s important to recognize that the opportunity presented by virtualized data centers does not eliminate all the challenges. Enforcing successful micro-segmentation policies still requires deploying a filtering policy that the micro-segmented fabric will enforce, and writing this policy is the first, and largest, hurdle that must be cleared.</p> <p>We have published a new eBook to help guide you through the process of implementing and managing your micro-segmentation strategy.</p> <p>Simplifying micro-segmentation with AlgoSec Security Management Suite</p> <p>The AlgoSec Security Management Suite (ASMS) employs the power of automation to make it easy for businesses to define and enforce their micro-segmentation strategy, ensure that it does not block critical business services, and also meet compliance requirements.</p> <p>AlgoSec supports micro-segmentation by:</p> <p>Providing application discovery based on netflow informationIdentifying unprotected network flows that do not cross any firewall and are not filtered for an applicationAutomatically identifying changes that will violate the micro-segmentation strategyAutomatically implementing network security changesAutomatically validating changes</p> <p>Although network segmentation used to be a costly manual process, the arrival of SDN data centers, combined with the automation capabilities of the AlgoSec Security Management Suite, mean that implementing an effective network micro-segmentation strategy is now possible.</p> <p>Find out more about how micro-segmentation can help you boost your security posture, or request your personal demo.</p>

<p>Dave Shackleford, the owner and principal consultant of Voodoo Security and a SANS analyst hosts Professor Avishai Wool, AlgoSec&#8217;s CTO and co-founder, in this practical webinar to unveil why organizations are increasingly micro-segmenting for their networks and guide you through each stage of a micro-segmentation project from development of the correct micro-segmentation strategy to effective implementation and maintenance of a micro-segmented network.</p> <p>Organizations heavily invest in a mix of security solutions to keep their networks safe, but still, struggle to close the security gaps. Micro-segmentation helps protect the organizations&#8217; network against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren&#8217;t sure where to begin or what approach to take.</p> <p>Register now to this live webinar to learn:</p> <p> What micro-segmentation is<br /> Why and how micro-segmentation can be part of the equation in protecting your network.<br /> Common pitfalls in microsegmentation projects and how to avoid them.<br /> The stages of a successful microsegmentation project.<br /> How to monitor and maintain your micro-segmented network.<br /> The role of policy management, change management, and automation in micro-segmentation.</p> <p>Dave Shackleford</p> <p>Dave Shackleford, a SANS analyst, instructor, course author, GIAC technical director and member of the board of directors for the SANS Technology Institute, is the founder and principal consultant with Voodoo Security. He has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering. A VMware vExpert, Dave has extensive experience designing and configuring secure virtualized infrastructures. He previously worked as chief security officer for Configuresoft and CTO for the Center for Internet Security. Dave currently helps lead the Atlanta chapter of the Cloud Security Alliance.</p> <p>Avishai Wool</p> <p>Prof. Avishai Wool, AlgoSec’s CTO and co-founder, is a world-renowned researcher and security industry veteran. He is a professor in the School of Electrical Engineering at Tel Aviv University and serves as the deputy-director of the Interdisciplinary Cyber Research Center at TAU. Prof. Wool has published more than 110 research papers and holds 13 US Patents, and has served on the program committee of the leading IEEE and ACM conferences on computer and network security. Prof. Wool has a B.Sc. (Cum Laude) in Mathematics and Computer Science, and a M.Sc. and Ph.D. in Computer Science.</p>

A blueprint for a successful micro segmentation implementation

<h2 class="MsoNormal">Avishai Wool, CTO and co-founder of AlgoSec, looks at how organizations can implement and manage SDN-enabled micro-segmentation strategies</h2> <p> </p> <p><a href="https://www.algosec.com/micro-segmentation/" target="_blank" rel="noopener noreferrer">Micro-segmentation</a> is regarded as one of the most effective methods to reduce an organization’s attack surface, and a lack of it has often been cited as a contributing factor in some of the largest data breaches and ransomware attacks. One of the key reasons why enterprises have been slow to embrace it is because it can be complex and costly to implement – especially in traditional on-premise networks and data centers. In these, creating internal zones usually means installing extra firewalls, changing routing, and even adding cabling to police the traffic flows between zones, and having to manage the additional filtering policies manually.</p> <p>However, as many organizations are moving to virtualized data centers using Software-Defined Networking (SDN), some of these cost and complexity barriers are lifted.  In SDN-based data centers the networking fabric has built-in filtering capabilities, making internal network segmentation much more accessible without having to add new hardware. SDN’s flexibility enables advanced, granular zoning:  In principle, data center networks can be divided into hundreds, or even thousands, of microsegments. This offers levels of security that would previously have been impossible – or at least prohibitively expensive – to implement in traditional data centers.</p> <p>However, capitalizing on the potential of micro-segmentation in virtualized data centers does not eliminate all the challenges. It still requires the organization to deploy a filtering policy that the micro-segmented fabric will enforce, and writing this a policy is the first, and largest, hurdle that must be cleared.</p> <h3>The requirements from a micro-segmentation policy</h3> <p>A correct micro-segmentation filtering policy has three high-level requirements:</p> <p><strong>It allows all business traffic</strong> – The last thing you want is to write a micro-segmented policy and have it block necessary business communication, causing applications to stop functioning.</p> <p><strong>It allows nothing else</strong> – By default, all other traffic should be denied.</p> <p><strong>It is future-proof </strong>– ‘More of the same’ changes in the network environment shouldn’t break rules. If you write your policies too narrowly, when something in the network changes, such as a new server or application, something will stop working. Write with scalability in mind.</p> <h3>A micro-segmentation blueprint</h3> <p>Now that you know what you are aiming for, how can you actually achieve it?  First of all, your organization needs to know what your traffic flows are – what is the traffic that should be allowed. To get this information, you can perform a ‘discovery’ process. Only once you have this information, can you then establish where to place the borders between the microsegments in the data center and how to devise and manage the security policies for each of the segments in their network environment.</p> <p>I welcome you to <a href="https://pages.algosec.com/Ebook-Micro-segmentation-from-Strategy-to-Execution-LP.html">download AlgoSec’s new eBook</a>, where we explain in detail how to implement and manage micro-segmentation.</p> <h3>AlgoSec Enables Micro-segmentation</h3> <p>The AlgoSec Security Management Suite (ASMS) employs the power of automation to make it easy to define and enforce your micro-segmentation strategy inside the data center, ensure that it does not block critical business services, and meet compliance requirements.</p> <p>AlgoSec supports micro-segmentation by:</p> <ul> <li>Providing application discovery based on netflow information</li> <li>Identifying unprotected network flows that do not cross any firewall and are not filtered for an application</li> <li>Automatically identifying changes that will violate the micro-segmentation strategy</li> <li>Automatically implementing network security changes</li> <li>Automatically validating changes</li> </ul> <p>The bottom line is that implementing an effective network micro-segmentation strategy is now possible. It requires careful planning and implementation, but when carried out following a proper blueprint and with the automation capabilities of the AlgoSec Security Management Suite, it provides you with stronger security without sacrificing any business agility.</p> <p>Find out more about how <a href="https://www.algosec.com/micro-segmentation/" target="_blank" rel="noopener noreferrer">micro-segmentation</a> can help you boost your security posture, or <a href="https://www.algosec.com/products/#request-demo-container">request your personal demo</a>.</p> <p> </p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

Micro-segmentation good things really come small packages

<p>For years, organizations have focused most of their network security efforts on the perimeter. First there were firewalls, then intrusion prevention systems came along followed by web proxies, and recently advanced malware detection (AKA sandboxing) solutions. This perimeter-focused approach is often referred to as the M&amp;M Strategy – a hard crunchy outside and soft chewy inside. The problem of course, is once hackers successfully penetrate the perimeter of the network or the data center, (and let’s face it, this has not been a rare occurrence in recent years) there is very little restriction of lateral movement between servers in the data centers.</p> <p>Enter network segmentation. The need for effective network segmentation is common knowledge, but it is hardly common practice. A poll which we ran (as part of this great webinar) asked IT professionals to describe their network segmentation strategy. Just 30% of respondents said that they strategically set segmentation around business drivers for the latest threats. About a third of respondents said they “set and forget” their segmentation and an equal number reported that they occasionally revisit it—typically around audit time. A brutally honest 6% said “My network what?”</p> <p>Maintaining effective network segmentation is hard. For starters, you have to figure out how to categorize your assets: what should I protect, who should be able to access it, what is the classification and regulatory environment of data, to name a few. Once you have done it, you need to put in network segmentation controls, typically firewalls. These add cost and perhaps more importantly, add complexity and management overhead. Anyone who has had to process a network access change request that traverses multiple network segments and firewalls, while ensuring that the security and compliance posture is intact, would probably have preferred to schedule a root canal procedure instead.</p> <p>So onto the million dollar question: Additional network segments adds security and granularity but it also adds cost and complexity… so how many segments does it make sense to have in my network? Well lately, some argue “as many as possible” – say hello to micro-segmentation.</p> <p>At its core, micro-segmentation is a fancy term for host-based firewalling. This concept has been around since the beginning of firewalls, and never really caught on because of the unreasonable cost and complexity of placing a firewall on every server. But recent developments in cloud and software-defined networking are reinvigorating this security concept. Amazon Web Services for example, offers free built-in “Security Groups” on every instance – this is essentially micro-segmentation in which the security controls are abstracted from the user. The VMWare NSX platform offers hypervisor level virtual firewalling on every host.</p> <p>Here are some key things to consider when looking at micro-segmentation:</p> <p> Security – network firewalls are typically rugged, hardened appliances that are very difficult to attack. According to Gartner, 95% of firewall breaches are the result of misconfiguration, not firewall flaws. We must ensure that host-based firewalls cannot be easily disabled or circumvented by an attacker who is able to get access to the machine which runs it.</p> <p> Integration with Legacy Firewalls – the big box with blinking lights at the perimeter or at the entrance to the data center isn’t going away anytime soon. Companies will still need a way to manage traditional firewalls alongside host-based firewalls, in the data center or in the cloud. In a recent survey, 79% of companies expressed the need for better visibility across on-premise and cloud environments.</p> <p> Automation – if you think manual firewall operations are tough today (and they are!), wait until you have a firewall on every machine! Without automation across environments and devices, micro-segmentation is simply not feasible.</p> <p>So is micro-segmentation the way of the future? It’s probably too early to tell, but its certainly worthy of consideration, if not on every machine, then in areas of your network where the “honeycomb” segmentation strategy truly adds value.</p>

<p>What links the Antwerp Diamond Heist, one of the world’s largest jewelry thefts and data center security? The famous heist was possible because there was no security within the safe deposit vault, enabling the criminals to stay inside undetected for days and steal items worth $100M.</p> <p>Similarly, to help prevent serious breaches, data center networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to create and manage a micro-segmented data center environment that truly protects your organization’s valuables.</p> <p>In this webinar, Avivi-Siman-Tov, Product Manager at AlgoSec will cover:</p> <ul> <li>How to securely migrate applications to a micro-segmented data center</li> <li>Identifying and avoiding common network segmentation pitfalls</li> <li>Defining and enforcing effective security policies for the micro-segmented data center</li> <li>Managing micro-segmented data centers alongside traditional networks and devices</li> <li>Identifying and managing security risk and compliance in a micro-segmented data center</li> </ul>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

<p>Dave Shackleford, the owner and principal consultant of Voodoo Security and a SANS analyst hosts Professor Avishai Wool, AlgoSec&#8217;s CTO and co-founder, in this practical webinar to unveil why organizations are increasingly micro-segmenting for their networks and guide you through each stage of a micro-segmentation project from development of the correct micro-segmentation strategy to effective implementation and maintenance of a micro-segmented network.</p> <p>Organizations heavily invest in a mix of security solutions to keep their networks safe, but still, struggle to close the security gaps. Micro-segmentation helps protect the organizations&#8217; network against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren&#8217;t sure where to begin or what approach to take.</p> <p>Register now to this live webinar to learn:</p> <p> What micro-segmentation is<br /> Why and how micro-segmentation can be part of the equation in protecting your network.<br /> Common pitfalls in microsegmentation projects and how to avoid them.<br /> The stages of a successful microsegmentation project.<br /> How to monitor and maintain your micro-segmented network.<br /> The role of policy management, change management, and automation in micro-segmentation.</p> <p>Dave Shackleford</p> <p>Dave Shackleford, a SANS analyst, instructor, course author, GIAC technical director and member of the board of directors for the SANS Technology Institute, is the founder and principal consultant with Voodoo Security. He has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering. A VMware vExpert, Dave has extensive experience designing and configuring secure virtualized infrastructures. He previously worked as chief security officer for Configuresoft and CTO for the Center for Internet Security. Dave currently helps lead the Atlanta chapter of the Cloud Security Alliance.</p> <p>Avishai Wool</p> <p>Prof. Avishai Wool, AlgoSec’s CTO and co-founder, is a world-renowned researcher and security industry veteran. He is a professor in the School of Electrical Engineering at Tel Aviv University and serves as the deputy-director of the Interdisciplinary Cyber Research Center at TAU. Prof. Wool has published more than 110 research papers and holds 13 US Patents, and has served on the program committee of the leading IEEE and ACM conferences on computer and network security. Prof. Wool has a B.Sc. (Cum Laude) in Mathematics and Computer Science, and a M.Sc. and Ph.D. in Computer Science.</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

A blueprint for a successful micro segmentation implementation

<h2 class="MsoNormal">Avishai Wool, CTO and co-founder of AlgoSec, looks at how organizations can implement and manage SDN-enabled micro-segmentation strategies</h2> <p> </p> <p><a href="https://www.algosec.com/micro-segmentation/" target="_blank" rel="noopener noreferrer">Micro-segmentation</a> is regarded as one of the most effective methods to reduce an organization’s attack surface, and a lack of it has often been cited as a contributing factor in some of the largest data breaches and ransomware attacks. One of the key reasons why enterprises have been slow to embrace it is because it can be complex and costly to implement – especially in traditional on-premise networks and data centers. In these, creating internal zones usually means installing extra firewalls, changing routing, and even adding cabling to police the traffic flows between zones, and having to manage the additional filtering policies manually.</p> <p>However, as many organizations are moving to virtualized data centers using Software-Defined Networking (SDN), some of these cost and complexity barriers are lifted.  In SDN-based data centers the networking fabric has built-in filtering capabilities, making internal network segmentation much more accessible without having to add new hardware. SDN’s flexibility enables advanced, granular zoning:  In principle, data center networks can be divided into hundreds, or even thousands, of microsegments. This offers levels of security that would previously have been impossible – or at least prohibitively expensive – to implement in traditional data centers.</p> <p>However, capitalizing on the potential of micro-segmentation in virtualized data centers does not eliminate all the challenges. It still requires the organization to deploy a filtering policy that the micro-segmented fabric will enforce, and writing this a policy is the first, and largest, hurdle that must be cleared.</p> <h3>The requirements from a micro-segmentation policy</h3> <p>A correct micro-segmentation filtering policy has three high-level requirements:</p> <p><strong>It allows all business traffic</strong> – The last thing you want is to write a micro-segmented policy and have it block necessary business communication, causing applications to stop functioning.</p> <p><strong>It allows nothing else</strong> – By default, all other traffic should be denied.</p> <p><strong>It is future-proof </strong>– ‘More of the same’ changes in the network environment shouldn’t break rules. If you write your policies too narrowly, when something in the network changes, such as a new server or application, something will stop working. Write with scalability in mind.</p> <h3>A micro-segmentation blueprint</h3> <p>Now that you know what you are aiming for, how can you actually achieve it?  First of all, your organization needs to know what your traffic flows are – what is the traffic that should be allowed. To get this information, you can perform a ‘discovery’ process. Only once you have this information, can you then establish where to place the borders between the microsegments in the data center and how to devise and manage the security policies for each of the segments in their network environment.</p> <p>I welcome you to <a href="https://pages.algosec.com/Ebook-Micro-segmentation-from-Strategy-to-Execution-LP.html">download AlgoSec’s new eBook</a>, where we explain in detail how to implement and manage micro-segmentation.</p> <h3>AlgoSec Enables Micro-segmentation</h3> <p>The AlgoSec Security Management Suite (ASMS) employs the power of automation to make it easy to define and enforce your micro-segmentation strategy inside the data center, ensure that it does not block critical business services, and meet compliance requirements.</p> <p>AlgoSec supports micro-segmentation by:</p> <ul> <li>Providing application discovery based on netflow information</li> <li>Identifying unprotected network flows that do not cross any firewall and are not filtered for an application</li> <li>Automatically identifying changes that will violate the micro-segmentation strategy</li> <li>Automatically implementing network security changes</li> <li>Automatically validating changes</li> </ul> <p>The bottom line is that implementing an effective network micro-segmentation strategy is now possible. It requires careful planning and implementation, but when carried out following a proper blueprint and with the automation capabilities of the AlgoSec Security Management Suite, it provides you with stronger security without sacrificing any business agility.</p> <p>Find out more about how <a href="https://www.algosec.com/micro-segmentation/" target="_blank" rel="noopener noreferrer">micro-segmentation</a> can help you boost your security posture, or <a href="https://www.algosec.com/products/#request-demo-container">request your personal demo</a>.</p> <p> </p>

Why thinking small is the key for network security

<p>Tsippi Dach explains why micro-segmentation is vital to minimize damage left by lateral movement across the network</p> <p>On the 15th August 2020, cruise company Carnival Corporation fell victim to a cyberattack that may have resulted in the loss of personal data belonging to millions of passengers and crew.</p> <p>Carnival is the world’s largest travel leisure business, hosting around 13 million passengers per year which equates to a lot data. The company has not revealed how many customers or which brands were targeted, but what we do know is that law enforcement agencies were notified after one of its brands detected a ransomware attack that breached an encrypted portion of its network.</p> <p>This isn’t the first time that Carnival has been breached by hackers. In 2019, a cyberattack on Princess Cruises and Holland America Line resulted in the personal data of hundreds of passengers and crew being compromised. The criminals stole passenger names, Social Security numbers, passport numbers and credit card information.</p> <p>Whilst many of us would presume that thinking about the big picture is the best way to look for ways to protect large companies, the answer actually lies in something much smaller &#8211; network micro-segmentation.</p> <p>Damage limitation with micro-segmentation</p> <p>Hackers are never going to give up targeting large corporations, and ransomware attacks like that on Carnival are not going to disappear. As cybercrime becomes more sophisticated, it is not going to be easy to completely defend your network from malicious hackers. What companies can do, however, is limit the potential damage hackers can cause if they do gain access to sensitive company or customer data.</p> <p>One way to do this is through network micro-segmentation, which is regarded as one of the most effective methods to reduce an organization’s attack surface. A lack of it has often been cited as a contributing factor in some of the largest data losses in ransomware attacks.</p> <p>Micro-segmentation minimizes the damage that hackers can do if they gain access, by stopping lateral movement across your networks. Just as the watertight compartments in a ship should contain flooding if the hull is breached, segmentation isolates servers and systems into separate zones to contain intruders or malware as well as insider threats, limiting the potential security risks and damage.</p> <p>Controlling your borders</p> <p>Although micro-segmentation is recognized as an effective method to enhance security, some businesses have been slow to adopt it because it can be complex and costly to implement, especially in traditional on-premise data centers.</p> <p>However, as more organizations move to virtualized data centers using Software-Defined Networking (SDN), some of the barriers associated with micro-segmentation have been eliminated.&nbsp;</p> <p>SDN’s flexibility enables more advanced, granular zoning, allowing networks to be divided into hundreds of microsegments, delivering a level of security that would be prohibitively expensive and complicated to implement in a traditional data center.</p> <p>It’s important to recognize that the opportunity presented by virtualized data centers does not eliminate all the challenges. Enforcing successful micro-segmentation policies still requires deploying a filtering policy that the micro-segmented fabric will enforce, and writing this policy is the first, and largest, hurdle that must be cleared.</p> <p>We have published a new eBook to help guide you through the process of implementing and managing your micro-segmentation strategy.</p> <p>Simplifying micro-segmentation with AlgoSec Security Management Suite</p> <p>The AlgoSec Security Management Suite (ASMS) employs the power of automation to make it easy for businesses to define and enforce their micro-segmentation strategy, ensure that it does not block critical business services, and also meet compliance requirements.</p> <p>AlgoSec supports micro-segmentation by:</p> <p>Providing application discovery based on netflow informationIdentifying unprotected network flows that do not cross any firewall and are not filtered for an applicationAutomatically identifying changes that will violate the micro-segmentation strategyAutomatically implementing network security changesAutomatically validating changes</p> <p>Although network segmentation used to be a costly manual process, the arrival of SDN data centers, combined with the automation capabilities of the AlgoSec Security Management Suite, mean that implementing an effective network micro-segmentation strategy is now possible.</p> <p>Find out more about how micro-segmentation can help you boost your security posture, or request your personal demo.</p>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

Five practical steps to implementing a zero-trust network

<p>Professor Avishai Wool, Co-founder and CTO at AlgoSec discusses the five practical steps that organizations can take to implement a Zero-Trust Network Policy&nbsp;</p> <p>While the concept of Zero Trust&nbsp;was created 10 years ago, the events of 2020 have thrust it to the top of enterprise security agendas. The COVID-19 pandemic has driven mass remote working, which means that organizations’ traditional perimeter-based security models have been broken up, in many cases literally overnight.&nbsp; In this new normal of remote working, an organization&#8217;s network is no longer a single thing in one location: it is everywhere,&nbsp;all of&nbsp;the time. Even if we look at organizations that use a single data center located in one place, this data center is accessed by multiple users on multiple devices.&nbsp;</p> <p>With the sprawling, dynamic nature of today’s networks, if you don’t adopt a Zero-Trust approach, then a breach in one part of the network could quickly cripple your organization as malware, and especially ransomware, makes it way unhindered throughout the network. We have seen multiple examples of ransomware attacks in recent years: organizations&nbsp; spanning all sectors, from&nbsp;hospitals, to local government and&nbsp;major corporations, have all suffered large-scale outages. Put simply, few could argue that a purely perimeter-based security model makes sense anymore.&nbsp;&nbsp;</p> <p>Five Practical Steps to Zero-Trust Networking&nbsp;</p> <p>These five steps represent the most logical way to achieve Zero-Trust networking, by finding out what data is of value, where that data is going and how it is being used:&nbsp;</p> <p>Identifying and segmenting data &#8211;&nbsp;The foundation of Zero Trust is visibility, because you&nbsp;cannot&nbsp;protect what you&nbsp;cannot&nbsp;see. Once you have identified the data you want to protect, you can define your segments by identifying and grouping together servers that support the same business intent.&nbsp;Mapping&nbsp;the traffic flows of your sensitive data &#8211;&nbsp;Once you have identified your sensitive data, the next step is knowing&nbsp;where the data is going, what it is being used for and what it is doing. Automated discovery tools can help you to understand the&nbsp;intent&nbsp;of&nbsp;the network flows carrying&nbsp;your data.&nbsp;Once you have that, you can then get to the Zero-Trust part of saying “and everything else will not be&nbsp;allowed.”&nbsp;Architecting the network &#8211;&nbsp;Once you know what flows should be allowed you can move onto designing a network architecture, and a filtering policy that enforces your network’s micro-perimeters.&nbsp;After going through the discovery process, you&nbsp;are able to&nbsp;understand the intent of the flows,&nbsp;place boundaries between the different zones and segments, and write the filtering policies that ensure all legitimate business traffic is allowed – and nothing else&nbsp;Monitoring &#8211;&nbsp;With the microsegments and policies deployed, it is essential to monitor&nbsp;all aspects of the network to ensure continuous compliance and understand intent before making the big switch from a default ‘allow’ policy to a default ‘deny,’ or organizational ‘D-Day.’&nbsp;Automate and orchestrate &#8211;&nbsp;Finally, the only way you will ever get to D-day is with the help of a policy engine, the central ‘brain’ behind your whole network policy. Without this, you&nbsp;have to&nbsp;do everything manually across the entire infrastructure every time there is a need for a change.&nbsp;Your policy engine, enabled by automation orchestration,&nbsp;is able to&nbsp;compare any change request against what you have defined as your legitimate business connectivity requirements. Only requests that fall outside the guidelines of acceptable use need to be reviewed and approved by human experts.&nbsp;</p> <p>Focus on business outcomes, rather than security outcomes&nbsp;</p> <p>Removing the complexity of security enables real business outcomes, since processes become faster and more flexible without compromising security or compliance. Using the&nbsp;steps&nbsp;I’ve outlined to automate Zero Trust practices means that the end-to-end time from making a change request to deployment and enforcement goes down to one day, or even a few hours – without introducing risk.&nbsp;&nbsp;&nbsp;</p> <p>The AlgoSec Security Management Solution allows security teams to eliminate time-consuming, error-prone manual security processes, such as connectivity mapping, migrating, and ongoing maintenance of their environments. Our smart and easy network mapping tool takes away the hardship of getting automation up and running. This frees up teams to strategically maximize the benefits of the SDN deployment and reap its rewards of increased flexibility and enhanced network security.&nbsp;&nbsp;</p> <p>Get in touch for more information on how AlgoSec can help make&nbsp;Zero-Trust&nbsp;networking a reality.&nbsp;</p>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

<p>What links the Antwerp Diamond Heist, one of the world’s largest jewelry thefts and data center security? The famous heist was possible because there was no security within the safe deposit vault, enabling the criminals to stay inside undetected for days and steal items worth $100M.</p> <p>Similarly, to help prevent serious breaches, data center networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to create and manage a micro-segmented data center environment that truly protects your organization’s valuables.</p> <p>In this webinar, Avivi-Siman-Tov, Product Manager at AlgoSec will cover:</p> <ul> <li>How to securely migrate applications to a micro-segmented data center</li> <li>Identifying and avoiding common network segmentation pitfalls</li> <li>Defining and enforcing effective security policies for the micro-segmented data center</li> <li>Managing micro-segmented data centers alongside traditional networks and devices</li> <li>Identifying and managing security risk and compliance in a micro-segmented data center</li> </ul>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

Five practical steps to implementing a zero-trust network

<p>Professor Avishai Wool, Co-founder and CTO at AlgoSec discusses the five practical steps that organizations can take to implement a Zero-Trust Network Policy&nbsp;</p> <p>While the concept of Zero Trust&nbsp;was created 10 years ago, the events of 2020 have thrust it to the top of enterprise security agendas. The COVID-19 pandemic has driven mass remote working, which means that organizations’ traditional perimeter-based security models have been broken up, in many cases literally overnight.&nbsp; In this new normal of remote working, an organization&#8217;s network is no longer a single thing in one location: it is everywhere,&nbsp;all of&nbsp;the time. Even if we look at organizations that use a single data center located in one place, this data center is accessed by multiple users on multiple devices.&nbsp;</p> <p>With the sprawling, dynamic nature of today’s networks, if you don’t adopt a Zero-Trust approach, then a breach in one part of the network could quickly cripple your organization as malware, and especially ransomware, makes it way unhindered throughout the network. We have seen multiple examples of ransomware attacks in recent years: organizations&nbsp; spanning all sectors, from&nbsp;hospitals, to local government and&nbsp;major corporations, have all suffered large-scale outages. Put simply, few could argue that a purely perimeter-based security model makes sense anymore.&nbsp;&nbsp;</p> <p>Five Practical Steps to Zero-Trust Networking&nbsp;</p> <p>These five steps represent the most logical way to achieve Zero-Trust networking, by finding out what data is of value, where that data is going and how it is being used:&nbsp;</p> <p>Identifying and segmenting data &#8211;&nbsp;The foundation of Zero Trust is visibility, because you&nbsp;cannot&nbsp;protect what you&nbsp;cannot&nbsp;see. Once you have identified the data you want to protect, you can define your segments by identifying and grouping together servers that support the same business intent.&nbsp;Mapping&nbsp;the traffic flows of your sensitive data &#8211;&nbsp;Once you have identified your sensitive data, the next step is knowing&nbsp;where the data is going, what it is being used for and what it is doing. Automated discovery tools can help you to understand the&nbsp;intent&nbsp;of&nbsp;the network flows carrying&nbsp;your data.&nbsp;Once you have that, you can then get to the Zero-Trust part of saying “and everything else will not be&nbsp;allowed.”&nbsp;Architecting the network &#8211;&nbsp;Once you know what flows should be allowed you can move onto designing a network architecture, and a filtering policy that enforces your network’s micro-perimeters.&nbsp;After going through the discovery process, you&nbsp;are able to&nbsp;understand the intent of the flows,&nbsp;place boundaries between the different zones and segments, and write the filtering policies that ensure all legitimate business traffic is allowed – and nothing else&nbsp;Monitoring &#8211;&nbsp;With the microsegments and policies deployed, it is essential to monitor&nbsp;all aspects of the network to ensure continuous compliance and understand intent before making the big switch from a default ‘allow’ policy to a default ‘deny,’ or organizational ‘D-Day.’&nbsp;Automate and orchestrate &#8211;&nbsp;Finally, the only way you will ever get to D-day is with the help of a policy engine, the central ‘brain’ behind your whole network policy. Without this, you&nbsp;have to&nbsp;do everything manually across the entire infrastructure every time there is a need for a change.&nbsp;Your policy engine, enabled by automation orchestration,&nbsp;is able to&nbsp;compare any change request against what you have defined as your legitimate business connectivity requirements. Only requests that fall outside the guidelines of acceptable use need to be reviewed and approved by human experts.&nbsp;</p> <p>Focus on business outcomes, rather than security outcomes&nbsp;</p> <p>Removing the complexity of security enables real business outcomes, since processes become faster and more flexible without compromising security or compliance. Using the&nbsp;steps&nbsp;I’ve outlined to automate Zero Trust practices means that the end-to-end time from making a change request to deployment and enforcement goes down to one day, or even a few hours – without introducing risk.&nbsp;&nbsp;&nbsp;</p> <p>The AlgoSec Security Management Solution allows security teams to eliminate time-consuming, error-prone manual security processes, such as connectivity mapping, migrating, and ongoing maintenance of their environments. Our smart and easy network mapping tool takes away the hardship of getting automation up and running. This frees up teams to strategically maximize the benefits of the SDN deployment and reap its rewards of increased flexibility and enhanced network security.&nbsp;&nbsp;</p> <p>Get in touch for more information on how AlgoSec can help make&nbsp;Zero-Trust&nbsp;networking a reality.&nbsp;</p>

<p>Dave Shackleford, the owner and principal consultant of Voodoo Security and a SANS analyst hosts Professor Avishai Wool, AlgoSec&#8217;s CTO and co-founder, in this practical webinar to unveil why organizations are increasingly micro-segmenting for their networks and guide you through each stage of a micro-segmentation project from development of the correct micro-segmentation strategy to effective implementation and maintenance of a micro-segmented network.</p> <p>Organizations heavily invest in a mix of security solutions to keep their networks safe, but still, struggle to close the security gaps. Micro-segmentation helps protect the organizations&#8217; network against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren&#8217;t sure where to begin or what approach to take.</p> <p>Register now to this live webinar to learn:</p> <p> What micro-segmentation is<br /> Why and how micro-segmentation can be part of the equation in protecting your network.<br /> Common pitfalls in microsegmentation projects and how to avoid them.<br /> The stages of a successful microsegmentation project.<br /> How to monitor and maintain your micro-segmented network.<br /> The role of policy management, change management, and automation in micro-segmentation.</p> <p>Dave Shackleford</p> <p>Dave Shackleford, a SANS analyst, instructor, course author, GIAC technical director and member of the board of directors for the SANS Technology Institute, is the founder and principal consultant with Voodoo Security. He has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering. A VMware vExpert, Dave has extensive experience designing and configuring secure virtualized infrastructures. He previously worked as chief security officer for Configuresoft and CTO for the Center for Internet Security. Dave currently helps lead the Atlanta chapter of the Cloud Security Alliance.</p> <p>Avishai Wool</p> <p>Prof. Avishai Wool, AlgoSec’s CTO and co-founder, is a world-renowned researcher and security industry veteran. He is a professor in the School of Electrical Engineering at Tel Aviv University and serves as the deputy-director of the Interdisciplinary Cyber Research Center at TAU. Prof. Wool has published more than 110 research papers and holds 13 US Patents, and has served on the program committee of the leading IEEE and ACM conferences on computer and network security. Prof. Wool has a B.Sc. (Cum Laude) in Mathematics and Computer Science, and a M.Sc. and Ph.D. in Computer Science.</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

Why thinking small is the key for network security

<p>Tsippi Dach explains why micro-segmentation is vital to minimize damage left by lateral movement across the network</p> <p>On the 15th August 2020, cruise company Carnival Corporation fell victim to a cyberattack that may have resulted in the loss of personal data belonging to millions of passengers and crew.</p> <p>Carnival is the world’s largest travel leisure business, hosting around 13 million passengers per year which equates to a lot data. The company has not revealed how many customers or which brands were targeted, but what we do know is that law enforcement agencies were notified after one of its brands detected a ransomware attack that breached an encrypted portion of its network.</p> <p>This isn’t the first time that Carnival has been breached by hackers. In 2019, a cyberattack on Princess Cruises and Holland America Line resulted in the personal data of hundreds of passengers and crew being compromised. The criminals stole passenger names, Social Security numbers, passport numbers and credit card information.</p> <p>Whilst many of us would presume that thinking about the big picture is the best way to look for ways to protect large companies, the answer actually lies in something much smaller &#8211; network micro-segmentation.</p> <p>Damage limitation with micro-segmentation</p> <p>Hackers are never going to give up targeting large corporations, and ransomware attacks like that on Carnival are not going to disappear. As cybercrime becomes more sophisticated, it is not going to be easy to completely defend your network from malicious hackers. What companies can do, however, is limit the potential damage hackers can cause if they do gain access to sensitive company or customer data.</p> <p>One way to do this is through network micro-segmentation, which is regarded as one of the most effective methods to reduce an organization’s attack surface. A lack of it has often been cited as a contributing factor in some of the largest data losses in ransomware attacks.</p> <p>Micro-segmentation minimizes the damage that hackers can do if they gain access, by stopping lateral movement across your networks. Just as the watertight compartments in a ship should contain flooding if the hull is breached, segmentation isolates servers and systems into separate zones to contain intruders or malware as well as insider threats, limiting the potential security risks and damage.</p> <p>Controlling your borders</p> <p>Although micro-segmentation is recognized as an effective method to enhance security, some businesses have been slow to adopt it because it can be complex and costly to implement, especially in traditional on-premise data centers.</p> <p>However, as more organizations move to virtualized data centers using Software-Defined Networking (SDN), some of the barriers associated with micro-segmentation have been eliminated.&nbsp;</p> <p>SDN’s flexibility enables more advanced, granular zoning, allowing networks to be divided into hundreds of microsegments, delivering a level of security that would be prohibitively expensive and complicated to implement in a traditional data center.</p> <p>It’s important to recognize that the opportunity presented by virtualized data centers does not eliminate all the challenges. Enforcing successful micro-segmentation policies still requires deploying a filtering policy that the micro-segmented fabric will enforce, and writing this policy is the first, and largest, hurdle that must be cleared.</p> <p>We have published a new eBook to help guide you through the process of implementing and managing your micro-segmentation strategy.</p> <p>Simplifying micro-segmentation with AlgoSec Security Management Suite</p> <p>The AlgoSec Security Management Suite (ASMS) employs the power of automation to make it easy for businesses to define and enforce their micro-segmentation strategy, ensure that it does not block critical business services, and also meet compliance requirements.</p> <p>AlgoSec supports micro-segmentation by:</p> <p>Providing application discovery based on netflow informationIdentifying unprotected network flows that do not cross any firewall and are not filtered for an applicationAutomatically identifying changes that will violate the micro-segmentation strategyAutomatically implementing network security changesAutomatically validating changes</p> <p>Although network segmentation used to be a costly manual process, the arrival of SDN data centers, combined with the automation capabilities of the AlgoSec Security Management Suite, mean that implementing an effective network micro-segmentation strategy is now possible.</p> <p>Find out more about how micro-segmentation can help you boost your security posture, or request your personal demo.</p>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

<p>As cyber threats become more sophisticated, companies of all sizes are struggling to stay secure. Regardless of how many different firewalls you use, it’s merely a matter of time until a threat gets through. To prevent serious breaches, networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to build a micro-segmentation strategy that truly protects your organization’s valuables.</p> <p>In this webinar, Yoni Geva, Product Manager at AlgoSec will cover:</p> <ul> <li>Segmentation challenges</li> <li>Micro-segmentation explained</li> <li>Micro-segmentation strategy benefits</li> <li>Micro-segmentation strategy development – first steps</li> <li>Implementation Do’s and Don’ts</li> </ul>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

Five practical steps to implementing a zero-trust network

<p>Professor Avishai Wool, Co-founder and CTO at AlgoSec discusses the five practical steps that organizations can take to implement a Zero-Trust Network Policy&nbsp;</p> <p>While the concept of Zero Trust&nbsp;was created 10 years ago, the events of 2020 have thrust it to the top of enterprise security agendas. The COVID-19 pandemic has driven mass remote working, which means that organizations’ traditional perimeter-based security models have been broken up, in many cases literally overnight.&nbsp; In this new normal of remote working, an organization&#8217;s network is no longer a single thing in one location: it is everywhere,&nbsp;all of&nbsp;the time. Even if we look at organizations that use a single data center located in one place, this data center is accessed by multiple users on multiple devices.&nbsp;</p> <p>With the sprawling, dynamic nature of today’s networks, if you don’t adopt a Zero-Trust approach, then a breach in one part of the network could quickly cripple your organization as malware, and especially ransomware, makes it way unhindered throughout the network. We have seen multiple examples of ransomware attacks in recent years: organizations&nbsp; spanning all sectors, from&nbsp;hospitals, to local government and&nbsp;major corporations, have all suffered large-scale outages. Put simply, few could argue that a purely perimeter-based security model makes sense anymore.&nbsp;&nbsp;</p> <p>Five Practical Steps to Zero-Trust Networking&nbsp;</p> <p>These five steps represent the most logical way to achieve Zero-Trust networking, by finding out what data is of value, where that data is going and how it is being used:&nbsp;</p> <p>Identifying and segmenting data &#8211;&nbsp;The foundation of Zero Trust is visibility, because you&nbsp;cannot&nbsp;protect what you&nbsp;cannot&nbsp;see. Once you have identified the data you want to protect, you can define your segments by identifying and grouping together servers that support the same business intent.&nbsp;Mapping&nbsp;the traffic flows of your sensitive data &#8211;&nbsp;Once you have identified your sensitive data, the next step is knowing&nbsp;where the data is going, what it is being used for and what it is doing. Automated discovery tools can help you to understand the&nbsp;intent&nbsp;of&nbsp;the network flows carrying&nbsp;your data.&nbsp;Once you have that, you can then get to the Zero-Trust part of saying “and everything else will not be&nbsp;allowed.”&nbsp;Architecting the network &#8211;&nbsp;Once you know what flows should be allowed you can move onto designing a network architecture, and a filtering policy that enforces your network’s micro-perimeters.&nbsp;After going through the discovery process, you&nbsp;are able to&nbsp;understand the intent of the flows,&nbsp;place boundaries between the different zones and segments, and write the filtering policies that ensure all legitimate business traffic is allowed – and nothing else&nbsp;Monitoring &#8211;&nbsp;With the microsegments and policies deployed, it is essential to monitor&nbsp;all aspects of the network to ensure continuous compliance and understand intent before making the big switch from a default ‘allow’ policy to a default ‘deny,’ or organizational ‘D-Day.’&nbsp;Automate and orchestrate &#8211;&nbsp;Finally, the only way you will ever get to D-day is with the help of a policy engine, the central ‘brain’ behind your whole network policy. Without this, you&nbsp;have to&nbsp;do everything manually across the entire infrastructure every time there is a need for a change.&nbsp;Your policy engine, enabled by automation orchestration,&nbsp;is able to&nbsp;compare any change request against what you have defined as your legitimate business connectivity requirements. Only requests that fall outside the guidelines of acceptable use need to be reviewed and approved by human experts.&nbsp;</p> <p>Focus on business outcomes, rather than security outcomes&nbsp;</p> <p>Removing the complexity of security enables real business outcomes, since processes become faster and more flexible without compromising security or compliance. Using the&nbsp;steps&nbsp;I’ve outlined to automate Zero Trust practices means that the end-to-end time from making a change request to deployment and enforcement goes down to one day, or even a few hours – without introducing risk.&nbsp;&nbsp;&nbsp;</p> <p>The AlgoSec Security Management Solution allows security teams to eliminate time-consuming, error-prone manual security processes, such as connectivity mapping, migrating, and ongoing maintenance of their environments. Our smart and easy network mapping tool takes away the hardship of getting automation up and running. This frees up teams to strategically maximize the benefits of the SDN deployment and reap its rewards of increased flexibility and enhanced network security.&nbsp;&nbsp;</p> <p>Get in touch for more information on how AlgoSec can help make&nbsp;Zero-Trust&nbsp;networking a reality.&nbsp;</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

Five practical steps to implementing a zero-trust network

<p>Professor Avishai Wool, Co-founder and CTO at AlgoSec discusses the five practical steps that organizations can take to implement a Zero-Trust Network Policy&nbsp;</p> <p>While the concept of Zero Trust&nbsp;was created 10 years ago, the events of 2020 have thrust it to the top of enterprise security agendas. The COVID-19 pandemic has driven mass remote working, which means that organizations’ traditional perimeter-based security models have been broken up, in many cases literally overnight.&nbsp; In this new normal of remote working, an organization&#8217;s network is no longer a single thing in one location: it is everywhere,&nbsp;all of&nbsp;the time. Even if we look at organizations that use a single data center located in one place, this data center is accessed by multiple users on multiple devices.&nbsp;</p> <p>With the sprawling, dynamic nature of today’s networks, if you don’t adopt a Zero-Trust approach, then a breach in one part of the network could quickly cripple your organization as malware, and especially ransomware, makes it way unhindered throughout the network. We have seen multiple examples of ransomware attacks in recent years: organizations&nbsp; spanning all sectors, from&nbsp;hospitals, to local government and&nbsp;major corporations, have all suffered large-scale outages. Put simply, few could argue that a purely perimeter-based security model makes sense anymore.&nbsp;&nbsp;</p> <p>Five Practical Steps to Zero-Trust Networking&nbsp;</p> <p>These five steps represent the most logical way to achieve Zero-Trust networking, by finding out what data is of value, where that data is going and how it is being used:&nbsp;</p> <p>Identifying and segmenting data &#8211;&nbsp;The foundation of Zero Trust is visibility, because you&nbsp;cannot&nbsp;protect what you&nbsp;cannot&nbsp;see. Once you have identified the data you want to protect, you can define your segments by identifying and grouping together servers that support the same business intent.&nbsp;Mapping&nbsp;the traffic flows of your sensitive data &#8211;&nbsp;Once you have identified your sensitive data, the next step is knowing&nbsp;where the data is going, what it is being used for and what it is doing. Automated discovery tools can help you to understand the&nbsp;intent&nbsp;of&nbsp;the network flows carrying&nbsp;your data.&nbsp;Once you have that, you can then get to the Zero-Trust part of saying “and everything else will not be&nbsp;allowed.”&nbsp;Architecting the network &#8211;&nbsp;Once you know what flows should be allowed you can move onto designing a network architecture, and a filtering policy that enforces your network’s micro-perimeters.&nbsp;After going through the discovery process, you&nbsp;are able to&nbsp;understand the intent of the flows,&nbsp;place boundaries between the different zones and segments, and write the filtering policies that ensure all legitimate business traffic is allowed – and nothing else&nbsp;Monitoring &#8211;&nbsp;With the microsegments and policies deployed, it is essential to monitor&nbsp;all aspects of the network to ensure continuous compliance and understand intent before making the big switch from a default ‘allow’ policy to a default ‘deny,’ or organizational ‘D-Day.’&nbsp;Automate and orchestrate &#8211;&nbsp;Finally, the only way you will ever get to D-day is with the help of a policy engine, the central ‘brain’ behind your whole network policy. Without this, you&nbsp;have to&nbsp;do everything manually across the entire infrastructure every time there is a need for a change.&nbsp;Your policy engine, enabled by automation orchestration,&nbsp;is able to&nbsp;compare any change request against what you have defined as your legitimate business connectivity requirements. Only requests that fall outside the guidelines of acceptable use need to be reviewed and approved by human experts.&nbsp;</p> <p>Focus on business outcomes, rather than security outcomes&nbsp;</p> <p>Removing the complexity of security enables real business outcomes, since processes become faster and more flexible without compromising security or compliance. Using the&nbsp;steps&nbsp;I’ve outlined to automate Zero Trust practices means that the end-to-end time from making a change request to deployment and enforcement goes down to one day, or even a few hours – without introducing risk.&nbsp;&nbsp;&nbsp;</p> <p>The AlgoSec Security Management Solution allows security teams to eliminate time-consuming, error-prone manual security processes, such as connectivity mapping, migrating, and ongoing maintenance of their environments. Our smart and easy network mapping tool takes away the hardship of getting automation up and running. This frees up teams to strategically maximize the benefits of the SDN deployment and reap its rewards of increased flexibility and enhanced network security.&nbsp;&nbsp;</p> <p>Get in touch for more information on how AlgoSec can help make&nbsp;Zero-Trust&nbsp;networking a reality.&nbsp;</p>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>As cyber threats become more sophisticated, companies of all sizes are struggling to stay secure. Regardless of how many different firewalls you use, it’s merely a matter of time until a threat gets through. To prevent serious breaches, networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to build a micro-segmentation strategy that truly protects your organization’s valuables.</p> <p>In this webinar, Yoni Geva, Product Manager at AlgoSec will cover:</p> <ul> <li>Segmentation challenges</li> <li>Micro-segmentation explained</li> <li>Micro-segmentation strategy benefits</li> <li>Micro-segmentation strategy development – first steps</li> <li>Implementation Do’s and Don’ts</li> </ul>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

<p>Dave Shackleford, the owner and principal consultant of Voodoo Security and a SANS analyst hosts Professor Avishai Wool, AlgoSec&#8217;s CTO and co-founder, in this practical webinar to unveil why organizations are increasingly micro-segmenting for their networks and guide you through each stage of a micro-segmentation project from development of the correct micro-segmentation strategy to effective implementation and maintenance of a micro-segmented network.</p> <p>Organizations heavily invest in a mix of security solutions to keep their networks safe, but still, struggle to close the security gaps. Micro-segmentation helps protect the organizations&#8217; network against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren&#8217;t sure where to begin or what approach to take.</p> <p>Register now to this live webinar to learn:</p> <p> What micro-segmentation is<br /> Why and how micro-segmentation can be part of the equation in protecting your network.<br /> Common pitfalls in microsegmentation projects and how to avoid them.<br /> The stages of a successful microsegmentation project.<br /> How to monitor and maintain your micro-segmented network.<br /> The role of policy management, change management, and automation in micro-segmentation.</p> <p>Dave Shackleford</p> <p>Dave Shackleford, a SANS analyst, instructor, course author, GIAC technical director and member of the board of directors for the SANS Technology Institute, is the founder and principal consultant with Voodoo Security. He has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering. A VMware vExpert, Dave has extensive experience designing and configuring secure virtualized infrastructures. He previously worked as chief security officer for Configuresoft and CTO for the Center for Internet Security. Dave currently helps lead the Atlanta chapter of the Cloud Security Alliance.</p> <p>Avishai Wool</p> <p>Prof. Avishai Wool, AlgoSec’s CTO and co-founder, is a world-renowned researcher and security industry veteran. He is a professor in the School of Electrical Engineering at Tel Aviv University and serves as the deputy-director of the Interdisciplinary Cyber Research Center at TAU. Prof. Wool has published more than 110 research papers and holds 13 US Patents, and has served on the program committee of the leading IEEE and ACM conferences on computer and network security. Prof. Wool has a B.Sc. (Cum Laude) in Mathematics and Computer Science, and a M.Sc. and Ph.D. in Computer Science.</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

Reducing your risk of ransomware attacks

<p>Tim Bloomer, a Sales Engineer at AlgoSec, discusses the basic security principles organizations should use to minimize risk of cyber attacks&nbsp;</p> <p>Recently I’ve been reading numerous articles and hearing about&nbsp;Ransomware&nbsp;attacks from my technical colleagues.&nbsp; Ransomware basically locks users out of their devices until companies pay a given amount of money, which is&nbsp;a serious problem. While it is not a new attack, the methods continue to change. The common question I’m asked from the companies I talk with is, “What’s the best practices for dealing with ransomware, and how can we stop it from hitting our company?”&nbsp;</p> <p>In order to find a solution for stopping ransomware, we first have to understand the&nbsp;methods&nbsp;used to gain access to your company computers/users. The most popular ones are:&nbsp;</p> <p>Phishing Emails&nbsp;– This is where the attacker tries to trick users into clicking on a link or opening an infected attachment.&nbsp;Remote Desktop Protocol&nbsp;– This is where companies have this protocol open so IT can service employees’ computers by connecting to them.&nbsp;Drive-By Downloads from Compromised Websites&nbsp;– When ransomware is downloaded by the user visiting an infected website; users usually are not even aware of what just happened.&nbsp;USB &amp; Removable Media&nbsp;– This is when a user inserts the USB or removable media into their computer. There are several reasons for this like getting a given software installed, transferring files that were supposed to be there, or simple curiosity.&nbsp;</p> <p>Best practice security principles&nbsp;</p> <p>Now that you understand a bit more on how ransomware is initiated, let’s look at how we can stop it from hitting our companies, and the best practices for doing so.&nbsp;</p> <p>This is not something where you buy a given solution off the shelf and all your worries are over.&nbsp;&nbsp;This is about adopting a true defense-in-depth methodology and using solutions that work in tandem with one another. I believe that you should never put all your eggs in one basket. The best practice should be building a network of products that work together to offer automated intelligence and are able to react quickly to whatever is playing out on the company networks.&nbsp;&nbsp;You need a combination of&nbsp;EDR, IDS/IPS, SIEM, SOAR, and our&nbsp;ASMS&nbsp;to have a well-defined&nbsp;solution. They all have a unique role in helping security engineers to make the right choice at the right time with the right information.&nbsp;&nbsp;This really allows your SOC team to have visibility and react accordingly.&nbsp;</p> <p>When you utilize multiple solutions, you gain the benefits of knowing that you are covered from multiple angles and have more confidence that the data is accurate, and you can act upon it.&nbsp;&nbsp;Without this approach you are basically watching the front door of your house believing it to be the only way anybody can get into your house, forgetting to check windows and the backdoor. So why would you do so on the company network?&nbsp;</p> <p>This is all relevant for overall security, but when people are asking me about best practices, they are usually referring to their firewalls.&nbsp;&nbsp;So, how do you setup your firewalls to protect your environment? It really comes down to the basics.&nbsp;&nbsp;</p> <p>Building your security wall&nbsp;&nbsp;</p> <p>Firewalls are designed to block all traffic except for traffic that has been explicitly allowed by the firewall rules.&nbsp;&nbsp;But over time, they get bloated with extra “stuff” that has been placed in there over years.&nbsp;&nbsp;So, here are my recommendations for managing your firewalls:&nbsp;</p> <p>Remove the clutter from the firewalls&nbsp;– Over time your firewall probably has had numerous admins and we all know that everyone manages devices differently.&nbsp;&nbsp;From naming conventions such as objects to just adding rules to the bottom of the firewall rule base. Get rid of duplicate objects and remove unused rules too.&nbsp;&nbsp;Keep in mind, you need to have a solid audit trail for all this too. You want to have a good checks and balances process in place.&nbsp;Validate the rules on an ongoing basis&nbsp;– Just because you added a rule to a firewall six months or two years ago doesn’t mean it’s still being used or still needed.&nbsp;&nbsp;You should have a process for recertifying your rule base on an ongoing basis, just as if it was another change request.&nbsp;&nbsp;Doing so would prevent having to “shut down” changes while you recertify the entire rule base.&nbsp;&nbsp;Doing this on an ongoing process ensures your team is still meeting or exceeding your customer expectations.&nbsp;Remove Objects that are not routed through that firewall&nbsp;– Often times you’ll see a change request added to every firewall in the path simply because the admin do not have time or the automation to do it correctly. Just because traffic was requested doesn’t always mean the firewall in the path needs to have the rule added.&nbsp;&nbsp;A good automated system will evaluate firewall change request for each firewall and make sure “noise” isn’t added to firewalls.&nbsp;Establish a change procedure&nbsp;– You should have a change procedure in place that provides full documentation on why it’s needed and the full audit trail on what and who has&nbsp;taken action&nbsp;on that change procedure.&nbsp; All teams need to be involved and embrace this process, such has DevOps, Cloud Teams, Network Teams, &amp; especially Security teams.&nbsp;&nbsp;Leaving anyone out of this process leaves gaps in your security posture and no way to audit it.&nbsp;</p> <p>I have to say, though, there is one phrase that I learned long ago that has stuck with me.&nbsp;&nbsp;That is, “more than half the time, attackers are insiders” and this seems to still hold true&nbsp;today.&nbsp;&nbsp;</p> <p>The basic recommendations I’ve shared are a minimum of what needs to happen in an organization. Is this a complete list? Absolutely not. But it is at the core of what every company should adopt and add their business practices to.&nbsp;&nbsp;</p> <p>Once you have the basic principles in place, you can further tighten your security posture by introducing micro-segmentation. This allows you to reduce the attack surface and stop lateral movement across your network to minimize any damage caused by ransomware attacks and insider threats. Read more about the benefits of thinking small in network security&nbsp;here.&nbsp;</p>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>What links the Antwerp Diamond Heist, one of the world’s largest jewelry thefts and data center security? The famous heist was possible because there was no security within the safe deposit vault, enabling the criminals to stay inside undetected for days and steal items worth $100M.</p> <p>Similarly, to help prevent serious breaches, data center networks must be internally segmented to stop hackers moving freely inside the network and exfiltrating data – but network segmentation must be designed and managed correctly if it’s to be successful. This webinar will examine how to create and manage a micro-segmented data center environment that truly protects your organization’s valuables.</p> <p>In this webinar, Avivi-Siman-Tov, Product Manager at AlgoSec will cover:</p> <ul> <li>How to securely migrate applications to a micro-segmented data center</li> <li>Identifying and avoiding common network segmentation pitfalls</li> <li>Defining and enforcing effective security policies for the micro-segmented data center</li> <li>Managing micro-segmented data centers alongside traditional networks and devices</li> <li>Identifying and managing security risk and compliance in a micro-segmented data center</li> </ul>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

<p>Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take.</p> <p>In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network.</p> <p>Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy:</p> <p> What is micro-segmentation.<br /> Common pitfalls in micro-segmentation projects and how to avoid them.<br /> The stages of a successful micro-segmentation project.<br />  The role of policy change management and automation in micro-segmentation.</p> <p>Don&#8217;t forget to also click on the links in the Attachments tab.</p>

<p>Micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, yet successfully implementing a defense-in-depth strategy using micro-segmentation is complicated. In this technical webinar, Jothi Prakash Prabakaran, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, will provide a step-by-step blueprint to implementing this strategy using the micro-segmentation capabilities of Cisco Tetration and network security policy management capabilities of AlgoSec.</p> <p>They will demonstrate how to tighten your security posture within the data center using an allow-list approach. They will also show how to enforce these granular micro-segmented policies enforced on the workloads with Cisco Tetration and a coarse grain policy enforced across the infrastructure through AlgoSec network security policy management.</p> <p>Watch the webinar to learn how to:</p> <p> Understand your business applications to create your micro-segmentation policy<br /> Validate your micro-segmentation policy is accurate<br /> Enforce these granular policies on workloads and summarized policies across your infrastructure<br /> Use risk and vulnerability analysis to tighten your workload and network security<br /> Identify and manage security risk and compliance in your micro-segmented environment</p>

Fighting ransomware – CTO roundtable insights

<p>Yitzy Tannenbaum sits down with&nbsp;AlgoSec&nbsp;CTO, Avishai Wool and&nbsp;Guardicore&nbsp;CTO, Ariel Zeitlin, to discuss the role of micro-segmentation in the fight against cybercriminals&nbsp;</p> <p>I recently had the pleasure of moderating a virtual panel with AlgoSec co-founder and CTO, Avishai Wool and Guardicore CTO, Ariel Zeitlin, in which the two industry leaders discussed how organizations can fight ransomware using micro-segmentation.  </p> <p>According to recent survey figures, more than 60% of organizations claim not to have experienced a cyber-attack, but another 40%&nbsp;said they&nbsp;have experienced a&nbsp;significant&nbsp;number of breaches in the past two years alone.&nbsp;During the session I&nbsp;asked both panelists about these two extremes, and&nbsp;whether or not&nbsp;they thought the COVID-19 pandemic had been a contributing factor.&nbsp;</p> <p>Impact of COVID-19&nbsp;of&nbsp;ransomware attacks&nbsp;</p> <p>Avishai began by talking about&nbsp;AlgoSec’s&nbsp;experience of its own customers being targeted more in recent years. He made the point that cybercriminals are opportunists, and once they have discovered a vulnerability or found a tactic that works, they’re likely to keep repeating it. There are frameworks out there which allow bad actors to mount quite sophisticated attacks without much technical knowledge, making cybercrime easier and more lucrative than ever been. The number of potential targets is also growing as COVID-19 has pushed businesses further online.&nbsp;&nbsp;</p> <p>Ariel then highlighted the speed at which businesses had been forced to move to remote working in 2020, and that there wasn’t time to put proper security strategies in place. He said that employees were the number one access point for bad actors, and the move to agile working just made them even more vulnerable.&nbsp;&nbsp;</p> <p>Ariel went on to talk about the move towards reconnaissance and how bad actors would typically choose their targets based on the amount of business-critical or sensitive information they were likely to have. However, he did warn that smaller enterprises shouldn’t become complacent in thinking they are “too small” to be targeted. Ransomware is far too easy to monetize in 2020, so everybody is a target. Ariel also discussed the trend of lateral attacks and exfiltrating small amounts of data at a time, creating a lever to continuously ask for ransom payments.&nbsp;&nbsp;</p> <p>Avishai picked up on Ariel’s comments and highlighted the emphasis on the lateral movement of attackers. Traditionally, a ransomware attack may have been confined to one computer or one very small network. Today, however, the first infection could be an employee working at home who opens the wrong email. That infection could then spread laterally throughout the entire organization making it much harder to defend against, quarantine or eradicate. I asked Avishai what steps could be taken to prevent the lateral spread of something like a ransomware attack, and he talked about the importance of backups, access controls and quality staff training.&nbsp;&nbsp;</p> <p>Minimizing loss with micro-segmentation&nbsp;</p> <p>When asked about the first steps an organization should take if they’ve experienced a ransomware attack, Ariel explained how the number one priority should be to contain and stop the spread of the virus, saving whatever can be saved. Start using back-ups, disallow access to servers, and block SNP ports all over the network to contain the attack. Then it becomes an investigation &#8211; finding out what happened with whatever tools are available, ideally with a rapid response team. Avishai then talked about the advantages of segmenting an overall network into pieces to help with diagnostics and containment.&nbsp;&nbsp;</p> <p>While traditional firewalls can offer some high-level segmentation, it’s not&nbsp;really feasible&nbsp;to deploy multiple firewalls to create smaller segments. Thankfully, that’s not much of a concern nowadays,&nbsp;since all leading public cloud vendors already&nbsp;include network filtering which gives businesses incredible levels of control over their network. However, Avishai went on, the real problem organizations face when it comes to micro-segmentation isn’t a lack of technological capability, it&nbsp;is&nbsp;a lack of policy and strategy.&nbsp;</p> <p>In Avishai’s experience, this is a huge knowledge gap for many businesses. Ariel reinforced this, adding that policies aren’t static and change over time, often hundreds of times per week in larger organizations.&nbsp;&nbsp;</p> <p>While vendors can provide the ability to create micro-segments, it’s down to organizations themselves to write the policy rules around what kind of traffic to allow through each segment.&nbsp;To hear more thoughts on micro-segmentation from Avishai and Ariel, including how to write effective micro-segmentation filtering policies both inside and outside of the data center, you can watch the recorded discussion&nbsp;here.&nbsp;</p>

Build and enforce defense-in-depth

<p>In a recent webinar, Jothi Prakash, Senior Product Manager at Cisco, and Yoni Geva, Product Manager at AlgoSec, discussed how organizations can tighten their security postures with micro-segmentation and an allow list approach</p> <p>Today’s business networks are increasingly complex, with highly dynamic applications running in multi-cloud environments made up of various workload types, from bare metal to virtual. Add to this the fact that application behaviors are unique to each environment, which contributes to an increase in the attack surface and creates gaps in the security infrastructure.</p> <p>The move to hybrid cloud environments has created a shift in security threats, with more cybercriminals targeting applications and API endpoints that are being used in data centers or workloads, as seen with the Kinsing Malware attacks earlier this year.</p> <p>Using a traditional perimeter-based security approach alone is ineffective when addressing these new challenges. That’s why organizations are increasingly migrating to a defense-in-depth strategy. While it is widely acknowledged that micro-segmentation protects your workloads and applications against lateral movement of malware and limits the spread of insider threats, successfully implementing this type of ‘allow list’ defense strategy is complicated.</p> <p>When dealing with distributed, dynamic applications, this approach requires deep insights into applications and their dependencies. It also requires the capability to apply business context and automation to core security policy management processes, such as change management, risk and compliance assessment, and auditing. This is made even more complex across hybrid network estates, with on premise data center, ACI and cloud networks utilizing solutions from a range of vendors.</p> <p>However, by combining the strengths of the Cisco Tetration platform for application policy discovery and workload-based enforcement, with the AlgoSec Security Management Solution for the optimization and control of infrastructure-based segmentation, you can apply defense-in-depth security for applications running in any infrastructure and any cloud. Here’s how.</p> <p>Securing application workloads with Cisco Tetration</p> <p>The goal of Cisco Tetration is to secure application workloads across any infrastructure, any cloud, and any technology from bare metal to serverless. It focuses on four main areas:</p> <p>Minimizing the lateral movement of threats</p> <p>Micro-segmentation is a foundational element of Cisco Tetration. The primary challenge is how you define the policy for a given application. We see a lot of customers flying blind, unsure what the east to west traffic actually looks like for those applications. Tetration provides a mechanism to autogenerate the granular micro-segmentation policy, using an ‘allow list’ approach that takes you a step closer to a Zero Trust model.</p> <p>Automating security policy management</p> <p>After defining the micro-segmentation policy, you need to be able to enforce it, no matter where your workloads and applications are. Applications in the data center are dynamic, which means they constantly change and often exist both on-premise and in the cloud. For example, an application could be based in the on-prem data center but three months later your application team may move that to the public cloud. Tetration offers you a consistent enforcement mechanism across the infrastructure.</p> <p>Enforcing and monitoring your policies</p> <p>With your micro-segmentation policy in place, the next step is being able to enforce it confidently. Before rolling out the policy, Tetration allows customers to test policies with real-time or historical data to determine what the outcomes would be and share that information with the application team to address any errors before launching. Once that has been finalized you can enforce the policy from Tetration, which then pushes it directly to the workload itself, using the operating system firewall mechanisms.</p> <p>Achieving continuous compliance</p> <p>Once you have defined and enforced the policy, Tetration then continuously monitors the behavior of the policy to ensure it is compliant and identifying any deviations in a proactive fashion. If there are any irregularities, then Tetration generates alerts so you can take action immediately and the policy will be updated depending on your decision.</p> <p>Real-time control and total application visibility with AlgoSec</p> <p>Once connectivity and dependency mapping has been created through Tetration, the AlgoSec solution takes this information and integrates it into the enterprise’s wider network security infrastructure, including on-prem firewalls, SDN and public cloud , automatically tagging security policies across every device, platform and technology that support critical business applications.</p> <p>With automated data import from Tetration to the AlgoSec solution, users receive automatic, near real-time updates across their network, enabling them to identify what changes have been made and take an appropriate course of action.</p> <p>By integrating the AlgoSec solution with Cisco’s Tetration platform, customers have access to a single source of truth for application connectivity policies, giving them a business-centric view of their security posture, eliminating inconsistencies and tedious troubleshooting, and supporting continuous compliance with a fully documented audit trail.</p> <p>You can watch the recorded webinar here.</p>

<p>Your network extends into hybrid environments and may include private clouds running Cisco ACI, and on-premises devices. Managing network security policies in your multi-vendor estate is complex.</p> <p>Because your network is made up of multiple vendors and each part of your network estate is managed in its own silo, it is tough to get centralized management of your entire network. Making changes is a chore and validating security is difficult.</p> <p>Learn how to unify, consolidate, and automate your entire network security policy management across your Cisco and multi-vendor estate.</p> <p>In this session Roxana Diaz, Worldwide Technical Solutions Architect at Cisco, and Yonatan Klein, AlgoSec’s Director of Product, will discuss how to manage the Cisco and multi-cloud estate and how to:</p> <p> Capitalize on your Cisco ACI investment to take advantage of its full capabilities<br /> Bring centralized visibility, automation, and compliance monitoring into your Cisco and multi-vendor network ecosystem<br /> Get full visibility of your entire hybrid network estate, including items within the Cisco ACI security environment, as well as outside it, including Cisco firewalls and routers, as well as multi-vendor devices.<br /> Take advantage of Cisco Tetration Analytics and AlgoSec’s intelligent discovery to get a full picture of your network and application traffic and to design and provision a micro-segmentation network policy design.<br /> Unify, consolidate, and automate your network security policy management<br /> Proactively assess risk throughout your entire network, including Cisco ACI contracts, and recommend the necessary changes to eliminate misconfigurations and compliance violations</p>

<p>Network segmentation is an effective strategy for protecting access to key data assets, and impeding the lateral movement of threats and cyber criminals inside your data center. With network virtualization, such as VMware NSX and Cisco ACI now a reality it&#8217;s far simpler to set up granular security policies for east-west traffic within the data center. Yet the added granularity of securities policies creates significant complexity.</p> <p>Presented by renowned industry expert Professor Avishai Wool, this technical webinar will provide strategies and best practices to help organizations migrate and manage security policies efficiently within a micro-segmented data center.</p> <p>In this webinar, Prof. Wool will discuss how to:</p> <ul> <li>Identify and securely migrate legacy applications to a micro-segmented data center</li> <li>Effectively define and enforce security policies for East-West traffic</li> <li>Manage the micro-segmented data center alongside traditional on-premise security devices</li> <li>Identify risk and manage compliance in a micro-segmented data center</li> <li>Use network segmentation to reduce the scope of regulatory audits</li> <li>Identify and avoid common network segmentation mistakes</li> </ul>

Five practical steps to implementing a zero-trust network

<p>Professor Avishai Wool, Co-founder and CTO at AlgoSec discusses the five practical steps that organizations can take to implement a Zero-Trust Network Policy&nbsp;</p> <p>While the concept of Zero Trust&nbsp;was created 10 years ago, the events of 2020 have thrust it to the top of enterprise security agendas. The COVID-19 pandemic has driven mass remote working, which means that organizations’ traditional perimeter-based security models have been broken up, in many cases literally overnight.&nbsp; In this new normal of remote working, an organization&#8217;s network is no longer a single thing in one location: it is everywhere,&nbsp;all of&nbsp;the time. Even if we look at organizations that use a single data center located in one place, this data center is accessed by multiple users on multiple devices.&nbsp;</p> <p>With the sprawling, dynamic nature of today’s networks, if you don’t adopt a Zero-Trust approach, then a breach in one part of the network could quickly cripple your organization as malware, and especially ransomware, makes it way unhindered throughout the network. We have seen multiple examples of ransomware attacks in recent years: organizations&nbsp; spanning all sectors, from&nbsp;hospitals, to local government and&nbsp;major corporations, have all suffered large-scale outages. Put simply, few could argue that a purely perimeter-based security model makes sense anymore.&nbsp;&nbsp;</p> <p>Five Practical Steps to Zero-Trust Networking&nbsp;</p> <p>These five steps represent the most logical way to achieve Zero-Trust networking, by finding out what data is of value, where that data is going and how it is being used:&nbsp;</p> <p>Identifying and segmenting data &#8211;&nbsp;The foundation of Zero Trust is visibility, because you&nbsp;cannot&nbsp;protect what you&nbsp;cannot&nbsp;see. Once you have identified the data you want to protect, you can define your segments by identifying and grouping together servers that support the same business intent.&nbsp;Mapping&nbsp;the traffic flows of your sensitive data &#8211;&nbsp;Once you have identified your sensitive data, the next step is knowing&nbsp;where the data is going, what it is being used for and what it is doing. Automated discovery tools can help you to understand the&nbsp;intent&nbsp;of&nbsp;the network flows carrying&nbsp;your data.&nbsp;Once you have that, you can then get to the Zero-Trust part of saying “and everything else will not be&nbsp;allowed.”&nbsp;Architecting the network &#8211;&nbsp;Once you know what flows should be allowed you can move onto designing a network architecture, and a filtering policy that enforces your network’s micro-perimeters.&nbsp;After going through the discovery process, you&nbsp;are able to&nbsp;understand the intent of the flows,&nbsp;place boundaries between the different zones and segments, and write the filtering policies that ensure all legitimate business traffic is allowed – and nothing else&nbsp;Monitoring &#8211;&nbsp;With the microsegments and policies deployed, it is essential to monitor&nbsp;all aspects of the network to ensure continuous compliance and understand intent before making the big switch from a default ‘allow’ policy to a default ‘deny,’ or organizational ‘D-Day.’&nbsp;Automate and orchestrate &#8211;&nbsp;Finally, the only way you will ever get to D-day is with the help of a policy engine, the central ‘brain’ behind your whole network policy. Without this, you&nbsp;have to&nbsp;do everything manually across the entire infrastructure every time there is a need for a change.&nbsp;Your policy engine, enabled by automation orchestration,&nbsp;is able to&nbsp;compare any change request against what you have defined as your legitimate business connectivity requirements. Only requests that fall outside the guidelines of acceptable use need to be reviewed and approved by human experts.&nbsp;</p> <p>Focus on business outcomes, rather than security outcomes&nbsp;</p> <p>Removing the complexity of security enables real business outcomes, since processes become faster and more flexible without compromising security or compliance. Using the&nbsp;steps&nbsp;I’ve outlined to automate Zero Trust practices means that the end-to-end time from making a change request to deployment and enforcement goes down to one day, or even a few hours – without introducing risk.&nbsp;&nbsp;&nbsp;</p> <p>The AlgoSec Security Management Solution allows security teams to eliminate time-consuming, error-prone manual security processes, such as connectivity mapping, migrating, and ongoing maintenance of their environments. Our smart and easy network mapping tool takes away the hardship of getting automation up and running. This frees up teams to strategically maximize the benefits of the SDN deployment and reap its rewards of increased flexibility and enhanced network security.&nbsp;&nbsp;</p> <p>Get in touch for more information on how AlgoSec can help make&nbsp;Zero-Trust&nbsp;networking a reality.&nbsp;</p>

<p>Good old perimeter security, enforced by traditional firewall protection, is now combined with distributed firewalls, public cloud-native security controls and third-party security services. The shared-responsibility security model means that IT organizations need to assume accountability for the data and overall security posture, as this is not exclusively the cloud providers’ responsibility.</p> <p>Today, more than ever, enterprise security teams are challenged to stretch their tried-and-true security policies to their extended deployments. They lack visibility across this growing estate, they can’t keep up with DevOps, and they are unable to properly analyze risk. They need integrated security policy management solutions for hybrid-cloud environments.</p> <p>Join Yonatan Klein, Director of Product Management at AlgoSec to learn how to take advantage of all the benefits of cloud and virtual deployments while maintaining your current security fundamentals.</p> <p>Yonatan will cover how to:</p> <ul> <li>Easily and automatically identify security risks and misconfigurations in your cloud</li> <li>Centrally manage security controls across accounts, regions and VPCs/VNETs</li> <li>Gain complete visibility across subnets and instances, including security groups, network security groups and NACLs</li> <li>Obtain a cross-network-estate risk analysis</li> </ul>

CloudFlow for Microsoft Azure

Customer story securelink

<h1 class="heading title">SecureLink Enables Business Agility with Hybrid Cloud Management</h1> <div class="quote">To be able to apply the same policy on all your infrastructure is priceless</div> <div class="description-text"> <p>SecureLink is Europe’s premier, award-winning, cybersecurity company. Active since 2003, they operate from 15 offices in 8 countries, to build a safe, connected world. More than 2,000 experts and thought leaders are dedicated to delivering unrivalled information security value for over 1,300 customers. They are part of the Orange Group, one of the world’s leading telecommunications operators, and listed on Euronext Paris and the New York Stock Exchange (NYSE).</p> <h2>The Challenge</h2> <p>SecureLink has been an on-site consultant for several years for a large global entertainment company. SecureLink’s client has over 100 firewalls running both on-premises and on Amazon<br /> Web Services (AWS) from several different vendors.</p> <p>Some of the challenges included:</p> <ul> <li>“Shadow IT” had taken over, causing security risks and friction with IT, who had to support it.</li> <li>Security policies were being managed in tedious and unmaintainable Excel spreadsheets</li> <li>Lack of verification if official firewall policies accurately reflected traffic flows</li> </ul> <p>The business units were pushing a migration to a hybrid cloud environment rather than relying exclusively on an on-premises deployment. Business units were unilaterally moving business applications to the cloud, leading to “shadow IT.”</p> <p>Business application owners were unable to comply with security policies, troubleshoot their “shadow network,” nor connect cloud-based servers to local servers. When there were problems, the business units went back to the IT department, who had to fix a mess they didn’t create.</p> <h2>The Solution</h2> <p>SecureLink was searching for a solution that provided:</p> <ul> <li>Automation of security policy change management and documentation of security policy changes</li> <li>Comprehensive firewall support for their multi-vendor, hybrid estate</li> <li>Ability to determine compliance and risk profiles</li> <li>Full visibility and control for IT, while enabling business agility</li> </ul> <p>In order to keep the business happy and agile, but ensure that IT had full visibility and control, they implemented AlgoSec.</p> <p>The client selected AlgoSec’s Security Policy Management Solution, which includes AlgoSec Firewall Analyzer and AlgoSec FireFlow.</p> <p>AlgoSec Firewall Analyzer delivers visibility and analysis of complex network security policies across on-premise, cloud, and hybrid networks. It automates and simplifies security operations including troubleshooting, auditing, and risk analysis. Using Firewall Analyzer, SecureLink can optimize the configuration of firewalls, and network infrastructure to ensure security and compliance.</p> <p>AlgoSec FireFlow enables security staff to automate the entire security policy change process from design and submission to proactive risk analysis, implementation, validation, and auditing. Its intelligent, automated workflows save time and improve security by eliminating manual errors and reducing risk.</p> <h2>The Results</h2> <p>AlgoSec helped SecureLink gain control of shadow IT without slowing down the business. By using AlgoSec to gain full visibility of the entire network, IT was able to regain control over company’s security policy while supporting the move to the cloud. “AlgoSec lets us take ownership and be quick for the business,” said Björn Löfman, a consultant at SecureLink. “The way AlgoSec provides the whole map of the internal and cloud networks is outstanding, and to be able to apply the same policy on all your infrastructure is priceless.”</p> <p>By using the AlgoSec Security Management Solution, SecureLink was able to clean up risky firewall policies, gain increased understanding of their security policies, tighten compliance, and enhance migrations of hardware and implement a hybrid cloud environment with Amazon Web Services (AWS).</p> <p>Some benefits to the client of AlgoSec include:</p> <ul> <li>Greater understanding of network security policies</li> <li>Easier firewall migration – they migrated from Juniper NetScreen to Check Point firewalls</li> <li>Ability to optimize rules and reduce unneeded and duplicate rules and objects. They were able to go from 4,000 rules to 1,110 rules – a 72% reduction.</li> <li>Move to the hybrid cloud with the adoption of Amazon Web Services</li> <li>Able to reduce shadow IT and reclaim ownership of the cloud</li> <li>Full visibility of entire hybrid network – including both on-premise and devices in the cloud including firewalls, <a href="https://www.algosec.com/professor-wool/best-practices-amazon-web-services-aws-security/">AWS security groups</a>, and Access Control Lists (ACLs).</li> </ul> </div>

<p>Migrating applications to the cloud – without creating security holes, application outages or violating compliance – is within reach!</p> <p>In this webinar, Avivi Siman-Tov, Director of Product at AlgoSec, will guide you how to simplify and accelerate large-scale complex application migration projects.</p> <p>The webinar will cover:</p> <ul> <li>Why organizations choose to migrate their applications to the cloud</li> <li>What is required in order to move the security portion of your application and how long it may take</li> <li>Challenges and solutions to lower the cost, better prepare for the migration and reduce the risks involved</li> <li>How to deliver unified security policy management across the hybrid cloud environment</li> </ul>