Software-defined WAN has ushered in a new focus on network segmentation and security. All major SD-WAN vendors include some form of network segmentation in their products, touting the technique as a way to address security and path isolation.
A proper network segmentation strategy requires that companies forge a solid understanding of both their systems and goals. SD-WAN vendors have their own definitions of network segmentation, and no single supplier has a cohesive segmentation strategy that will holistically address your organization's segmentation needs. Myriad segmentation considerations are likely to arise -- from authentication and authorization to managing security roles and policies -- and research is critical.
Network teams have traditionally segmented networks by using a variety of tools to create path isolation in different processes. Various tag routing schemes or virtualized routing instances were common, as were security access control lists (ACLs). Almost all methods worked somewhere in Layer 2 through Layer 4, and most were cumbersome and labor-intensive to implement and manage.
Isolation didn't rely on identity; rather it was based on the location of the IP address. That method worked in the days when one machine ran one service or one user sat at one endpoint device, but those days have passed. Now, we have multiple services at an endpoint, and services dynamically move or scale in response to myriad stimuli. Isolation based strictly on an IP address is no longer sufficient or computer science degree jobs.
Comments
Post a Comment