What are the biggest challenges when implementing micro-segmentation in an on-prem data center?

All answers to this question.

You are touching on the hardest part of the Zero Trust journey. In a flat network, "Assume Breach" is terrifying because an attacker can go anywhere. To map traffic, you should use an application dependency mapping (ADM) tool. Many modern firewalls and EDR platforms have "Discovery Mode" where they log all flows for 30 days without blocking anything. This gives you a visual graph of who is talking to whom. Once you have that, you create "Allow" rules for those specific flows and then—and only then—do you flip the switch to a "Default Deny" posture. It’s a slow process, but it’s the only way to avoid a catastrophic production outage.

   Answered 2024-05-14 by Melissa Roberts

Have you looked into host-based micro-segmentation using agents on the servers instead of trying to do it all at the network switch level?

   Answered 2024-05-16 by Steven Clark

• We considered host-based, but our older legacy servers can't handle the overhead of an extra agent. We have to stick to the network layer for now. My concern is managing the thousands of firewall rules that will result from this. Is there a way to use "Identity-Based" tags instead of IP addresses to make these rules more manageable in a dynamic environment?

     Commented 2024-05-18 by Thomas Anderson

Focus on the "Crown Jewels" first. Don't try to segment the whole data center at once; just start by isolating your database tier from the rest of the network.

   Answered 2024-05-20 by Elizabeth Clark

• I agree with Elizabeth. Isolating the most critical assets first gives you a quick security win while you work on the more complex web and app tiers.

     Commented 2024-05-21 by Michael Thompson