VMware NSX and Split and Smear Micro-Segmentation
While external perimeter protection requirements will most likely command hardware acceleration and support for the foreseeable future, the distributed nature of the services inside the data center calls for a totally different set of specifications.
Some vendors have recently claimed they can achieve micro-segmentation at data center scale while maintaining a hardware architecture. As I described in my recent article in Network Computing, this is unlikely because you have to factor in speed and capacity.
To quickly recap the main points describing the model in the article:
- Our objective is for all security perimeters to have a diameter of one—i.e. deploying one security function for each service or VM in the data center—if we want to granularly apply policies and limit successful attacks from propagating laterally within a perimeter. A larger diameter implies we chose to ignore all inter-service communications within that perimeter.
- This objective is impossible to achieve with our traditional hardware-based perimeters: The service densities and the network speeds found in current data center designs overrun any hardware-based inline inspection models.
- The solution resides in “splitting and smearing” security functions across thousands of servers. This requires an operational model capable of managing large scale distributed functions Continue reading
BT deploys three kinds of Cisco security to defend itself.
In this exciting webinar Q&A, experts from Cisco answer post webinar questions & elaborate on how to capture the huge business opportunity of virtual services.
Nutanix reveals huge losses; HPE gets ousted from Telefónica’s NFV project.
