How Macro-segmentation Works
Macro-segmentation is often implemented as an overlay on an organization’s physical network infrastructure. This is accomplished using a combination of firewalls and virtual local area networks (VLANs).
A VLAN is a virtualized network that defines how traffic should be routed over the physical network. This means that, if two systems are on different VLANs, it may not be possible for traffic to be routed directly between them. Instead, the VLANs are configured so that all traffic between VLANs must first pass through a firewall. This makes it possible for the firewall to enforce boundaries between VLANs – i.e. block any traffic that attempts to cross a VLAN boundary without authorization – and perform security inspection and enforcement of access control policies.
Macro-segmentation vs Micro-segmentation
Macro-segmentation and micro-segmentation are both methods of dividing an organization’s network into sections and can provide a number of benefits. However, macro-segmentation and micro-segmentation policies are very different:
- Macro-segmentation: Macro-segmentation breaks up a network into groups of systems, providing the ability to divide network infrastructure and systems based upon departments or other criteria. It is typically implemented using VLANs and firewalls.
- Micro-segmentation: Micro-segmentation usually divides an organization’s infrastructure at the system or even the application level. It is used to provide highly granular visibility and control over data flows within an organization’s network, enabling the implementation of a zero trust security strategy. It is often deployed using software-defined solutions because these systems already require deep visibility and control for routing purposes (making inspection and policy enforcement easier).
Main Benefits of Macro-Segmentation
Macro-segmentation transforms an organization’s network from a monolith to a collection of discrete subnets. This provides a number of advantages to an organization:
- Enhanced Visibility and Control: Without implementing macro-segmentation, an organization only has deep visibility into and control over network traffic at the network perimeter, where it passes through the perimeter firewall. With macro-segmentation, internal network firewalls provide a much deeper level of understanding and control for data flows within an organization’s network.
- Improved Security: A primary reason that organizations implement macro-segmentation is to provide increased resistance to cyberattacks. An attacker inside an organization’s network is likely to need to move laterally through it to achieve their objective because commonly compromised systems (user workstations, etc.) are unlikely to be the attacker’s goal. Macro-segmentation allows an organization to inspect internal data flows at segment boundaries, increasing the probability of detecting this lateral movement.
- Increased Network Performance: Macro-segmentation allows an organization to segment a network based upon its business needs. This can help to decrease network latency and congestion by ensuring that systems that communicate frequently with one another are closely connected and that superfluous network flows do not consume valuable bandwidth.
- Regulatory Compliance: Some data protection regulations, like the Payment Card Industry Data Security Standard (PCI DSS) mandate that organizations limit access to protected data (like payment cards) based upon need-to-know. Macro-segmentation is an essential component of PCI DSS regulatory compliance because compliant organizations must isolate the systems used for payment card processing from the rest of the enterprise network.
Implementing Macro-segmentation with Check Point
Macro-segmentation uses internal network firewalls to define VLANs and perform content inspection of traffic flowing across VLAN boundaries. This provides a number of different advantages to an organization, and is likely a critical component of a company’s data security and regulatory compliance strategy.
However, organizations must also consider the usability of their network infrastructure when designing and implementing a strategy for deploying macro-segmentation within their networks. If all internal network traffic crossing segment boundaries will be forced to pass through internal network firewalls, then organizations need firewalls with high throughput and robust, security inspection capabilities in order to maximize both network performance and security.
Check Point’s security solutions enable organizations to implement effective macro-segmentation through their entire network infrastructure. Check Point next-generation firewalls (NGFWs) provide robust security and high throughput for on-premises infrastructure, while Check Point CloudGuard provides cloud-native visibility and security solutions for an organization’s cloud-based deployments. To see these solutions in action, request demos of Check Point NGFW and CloudGuard Infrastructure as a Service (IaaS) solutions.
Feedback