A Forrester Consulting Thought Leadership Paper Commissioned By VMware July 2015 Leverage Micro- Segmentation To Build A Zero Trust Network
Table Of Contents Executive Summary... 1 Current Security Implementations Are Lacking And Need A Clear Strategy... 2 Network Virtualization Enables Micro-segmentation... 3 Micro-segmentation Sets The Stage For Zero Trust... 5 Key Recommendations... 7 Appendix A: Methodology... 8 Appendix B: Survey Demographics... 8 Appendix C: Endnotes... 9 ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2015, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to www.forrester.com. [1-TS0C58/1-UUYZA6]
1 Executive Summary In an increasingly connected world, data is and will continue to be a vital component of any business. Whether it is customer data, proprietary business data, or otherwise, data is a valuable resource and therefore must be secured and protected. However, certain types of data are more valuable than others, and hackers know that and will stop at nothing to obtain that sensitive data. Cyberthreats today are more persistent and sophisticated than ever before, and protecting against these threats requires companies to evaluate their current security strategy to ensure they are capable of defending against them. While most companies will claim that they are capable of protecting their data effectively, the truth is that their security can always use improvement. New security approaches must consider the varying levels of sensitivity of data types and be able to protect them accordingly. In April 2015, VMware commissioned Forrester Consulting to explore the hypothesis that businesses that are looking for improved agility, security, and compliance in a more virtualized world need to pursue a Zero Trust (ZT) security model where there is no longer a trusted and untrusted network, but rather all networks are untrusted and need to be secure with network virtualization and microsegmentation as important pieces for enabling this model. organization. This suggests an overall lack of awareness about security risks and a general lack of clear, cohesive security strategies. Network virtualization helps to reduce risk and supports a higher-level security strategy. Sixty percent of respondents reported having adopted network virtualization to some extent. The top benefits of network virtualization include enabling more segmented security controls and improving automation to accelerate delivery of the right services to each user. Network virtualization is thus a tactical means to reducing risk and delivering the foundation for a cohesive strategy built on the Zero Trust model of information security. Micro-segmentation provided through network virtualization paves the way for implementing a Zero Trust model. Network virtualization tools build Zero Trust segments by default. There must be an explicit rule created that allows traffic to move between virtualized segments, which ultimately builds segmentation into the underlying technology. This allows businesses to more easily set up micro-perimeters around their data based on data sensitivity and business needs. This eliminates the old concept of trusted and untrusted networks and makes all segments untrusted and subject to security controls. To test this hypothesis, Forrester conducted an online survey of 210 security and IT professionals involved with virtualization and networking from enterprise organizations in the US, the UK, Germany, France, China, and Japan. Through this research, Forrester found that although many organizations are better segmenting and securing parts of their network, they still face challenges with their overall security strategy and could benefit from a strategy aligned with the Zero Trust model. KEY FINDINGS Forrester s study yielded three key findings: Security gaps and disconnects are the unfortunate norm. Perception and reality reveal two different pictures. While most security teams have a high level of confidence in the security capabilities of their firm s current infrastructure, a smaller proportion indicated that they have confidence in their ability to stop data breaches. Many are also confident in their ability to meet compliance requirements, yet less than half are actually in compliance with relevant data protection regulations that apply to their
2 Current Security Implementations Are Lacking And Need A Clear Strategy Providing complete, impenetrable security for a business computing infrastructure is the grand vision of any IT security professional. In reality, no network can ever be completely immune to threats; however, with the right security strategy, the risks can be greatly reduced. From our custom survey, we discovered that in the past year, on average, businesses faced between three and five securityrelated incidents, with the majority of those attacks coming from external threats, followed by internal incidents (see Figure 1). When asked if this was comparable with previous years, 39% of respondents said they felt there hadn t been any change in the level of susceptibility of their company to security threats. This is both good news and bad news. The good news is that current security measures are keeping on pace with evolving security threats, thus keeping the level of network security relatively consistent. The bad news is that security is not outpacing these evolving threats, meaning businesses will continue to be susceptible to multiple attacks per year unless they are able to get ahead of the curve to prevent future incidents more effectively. The inability of companies to outpace emerging threats with improved security measures can be attributed to a number of causes: Overconfidence in current security capabilities. When asked to rate the security of their computing infrastructure on a scale from 1 to 10, respondents, on average, rated themselves a 7.6, with 6% of users ranking themselves a 10. This reflects a fairly high level of confidence in the security capabilities of current infrastructures. Yet, interestingly, only 23% of respondents have full confidence in IT s ability to stop data breaches. This is a significant disconnect and gets at the very root of current security shortcomings. Lack of awareness of full security risks. Overconfidence in security capabilities can also stem from having a limited understanding of security risks. Traditional security measures are commonly centered on protecting the perimeter of a business through firewalls FIGURE 1 Businesses Experience Several Security Incidents A Year From Various Sources Approximately how many data and/or security incidents has your company experienced over the past 12 months? More than 10 14% Don t know 2% 0 17% What were the most common ways in which security incidents occurred in the past 12 months? * (Select up to two) External attack targeting organization Internal incident within our organization 33% 56% 5 to 10 21% Est. avg. between 3 and 5 1 to 2 20% External attack targeting a business partner/ third-party supplier Misconfiguration of security controls Lost/stolen assets 17% 15% 30% Internal incident with business partner/third-party supplier 15% 3 to 5 26% Base: 210 IT and risk and compliance decision-makers at organizations with 500 or more employees *Base: 175 IT and risk and compliance decision-makers at organizations with 500 or more employees and experiencing one or more security incidents within the past 12 months Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015
3 and other methods, yet as the survey data revealed, security perimeters can be breached, thus leaving the entire network accessible. Threats can also originate internally, where there is immediate access to trusted networks with limited or no security protection. Lack of a cohesive security strategy. A comprehensive security strategy must not only consider security, but also ensure business agility and meet compliance regulations. Furthermore, an effective security model should be implementable both strategically and tactically. For example, two-thirds of survey respondents reported they are efficient at meeting data compliance standards, yet when asked about their progress in adhering to various data compliance regulations, they said full compliance was achieved in less than 50% of all efforts. While companies feel they are taking the right steps strategically, they are falling short tactically, failing to put the right compliance controls in place. THE NEED FOR ZERO TRUST NETWORKS Organizations need to employ a new security approach one that can be implemented both strategically and tactically. Forrester s Zero Trust model states that security and risk professionals must eliminate the idea of an internal trusted network and an external untrusted network. In a Zero Trust network, all networks are untrusted. Three concepts underpin Zero Trust. Security and risk professionals must: 1) verify and secure all resources regardless of location; 2) limit and strictly enforce access control across all user populations, devices, channels, and hosting models; and 3) log and inspect all traffic, both internal and external. 1 Zero Trust takes a singular approach to data protection, regardless of device type, location, or user: All network activity and data access is monitored and controlled regardless of whether or not the activity is from trusted sources. With businesses facing several security incidents per year, and with 33% being internal security incidents, the ZT model supports the argument that traditional, perimeter-based security configurations are no longer a sufficient measure for protecting the network. The ZT model offers businesses a clear strategic vision of how all resources must be secured and how access must be strictly enforced across the enterprise. Likewise, it also defines the tactical steps necessary to achieving this security model, including microsegmentation of the network through network virtualization. Network Virtualization Enables Micro-segmentation Whether or not the end goal is a Zero Trust model, network virtualization is an important step that many organizations are taking to better protect their network from security threats. Our custom survey data showed that 60% of FIGURE 2 Levels Of Network Virtualization Are Increasing Which of the following measures has your company implemented or does it plan to implement within the next six to 12 months to help address concerns with data security? Implemented Planning to implement No plans to implement Average percent of network virtualized Network virtualization 60% 31% 9% 41% Network segmentation 60% 30% 11% Network analysis and visibility 65% 29% 6% Base: 210 IT and risk and compliance decision-makers at organizations with 500 or more employees (percentages may not total 100% because of rounding) Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015
4 respondents reported having adopted network virtualization to some extent virtualizing, on average, 41% of their network (see Figure 2). When asked to rate the importance of a variety of potential benefits of network virtualization, the results showed these top two benefits as the most important (see Figure 3): Enabling more segmented security controls. Network segmentation is a beneficial byproduct of network virtualization. As networks are virtualized, data inherently becomes segmented into buckets to allow users greater visibility and control over all information on the network. This segmentation provides better security controls, helping businesses separate the day-to-day business data from the sensitive or proprietary data within the organization. From there, security and risk teams can place the proper security and access controls on sensitive data. This is the first step in the Zero Trust model. Improving automation to accelerate delivery of the right services for each user. The segmentation provided through virtualization fosters business agility by allowing businesses to respond more quickly to changing business and security needs. If organizations understand where data exists and which users are supposed to have access to it, then data and services can be better monitored and flow more quickly through an organization to the appropriate users, thus improving overall business agility. BARRIERS TO NETWORK VIRTUALIZATION Despite the majority of companies adopting some degree of network virtualization, there are still a number of concerns and barriers that companies face in making the change (see Figure 4): Adequate network performance maintenance. Maintaining network uptime and performance is the top concern for 52% of respondents who are adopting or are interested in adopting network virtualization. Any major change to the network is likely to elicit concerns, but as the technology is still new, there is little real-world data on actual performance impacts. As well, part of the concern may be caused by a lack of full understanding of the new technology. Security concerns. Thirty-eight percent of survey respondents stated that security was a top concern for them in adopting network virtualization. This concern is likely related more to the technology being new and relatively untested, as opposed to a specific security concern. This is evidenced by the continued high demand for network virtualization, showing that security issues are FIGURE 3 Segmentation And Improved Automation Are The Most Desired Attributes Of Network Virtualization How important are the following attributes of network virtualization for your company? Very important Enable more segmented security controls Improve automation to accelerate delivery of the right services for each user Create faithful representation of networks fully in software Enable management by business units Create a fabric of horizontally interconnected components 27% 26% 23% 21% 21% Important 49% 47% 46% Base: 192 IT and risk and compliance decision-makers at organizations with 500 or more employees Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015 more tertiary concerns, rather than significant issues impeding adoption. 51% 53% Lack of network visibility. Through virtualization, security and risk professionals want to ensure they maintain their visibility into the network. As pieces of the network are virtualized and segmented, there is concern about being able to sustain visibility and awareness of all network activity given the new implementation. This concern is compounded by the fact that roughly a quarter of respondents see lack of technical expertise as a major barrier to adoption of network virtualization.
5 FIGURE 4 Top Concerns And Barriers With Network Virtualization What were, or are, your company s top concerns around implementing network virtualization or the barriers your company had/has to overcome in adopting network virtualization? (Select all that apply) Maintaining adequate network performance Security concerns Lack of network visibility Lack of budget Lack of technical expertise/ need for training Redundancy concerns (e.g., concern about asingle point of failure) 27% 24% 22% 38% 38% 52% Base: 192 IT and risk and compliance decision-makers at organizations with 500 or more employees Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015 Micro-segmentation Sets The Stage For Zero Trust Businesses want to adopt network virtualization to help configure their network to be better suited to support a new Zero Trust model a change that will achieve the following benefits (see Figure 5): Improved security. While there are initial concerns about security with virtualization, businesses recognize that virtualization is a catalyst for enabling a Zero Trust security model, and that security will get better, not worse, through virtualization. For example, virtualization makes routing traffic to the appropriate interface of a segmentation gateway much simpler, which allows much more granular Layer 7 control of the network traffic. Easier segmentation of network. Network segmentation automatically interweaves connections and services to create micro-perimeters around specific sets of data and information. This greatly simplifies planning, deploying, and managing Zero Trust networks. By leveraging this segmentation, security and risk professionals and their networking counterparts can more easily create microperimeters around sensitive data and build powerful Zero Trust networks. Through this micro-segmentation, security professionals have full visibility into these assets and a FIGURE 5 Network Virtualization Segments The Network And Provides Improved Security And Agility What were, or are, the key business benefits your company hopes to achieve through adopting network virtualization? (Please rank the top three, with 1 being the most important benefit) Rank 1 Rank 2 Rank 3 Improve security N = 128 58% 24% 18% Easier segmentation of network N = 44 48% 23% 30% Improve agility and speed N = 108 44% 31% 25% Improve customer experiences N = 56 36% 43% 21% Better meet data compliance standards N = 50 16% 42% 42% Base: 210 IT and risk and compliance decision-makers at organizations with 500 or more employees (top five responses shown) Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015
6 deeper understanding of how the business uses the data. 2 Improved agility and speed. Network virtualization and micro-segmentation improve agility and speed from a business perspective, as well as from a security perspective. Business agility is improved, as network admins can more quickly identify privileges for certain data types, thus enabling business users to work with network data faster and more efficiently. Security agility is improved, as micro-segmentation allows for businesses to quickly respond to changing security needs by increasing security or privileges on certain segments of the network based on immediate needs. This makes security much more fluid and agile and reduces the risk of security breaches, enabling organizations to keep one step ahead of the ever-changing threat landscape. ACHIEVING ZERO TRUST Zero Trust is not a one-time project but a new way of thinking about information security. Network virtualization and micro-segmentation are steps in the right direction for implementing a Zero Trust network, but not a final destination. Micro-segmentation provides the network visibility and control needed for making security ubiquitous throughout the network, but it requires continues monitoring and management. With the network visibility in place, organizations position themselves to more effectively control and protect the data within their organization as they move toward building a Zero Trust model. The Zero Trust Model is simple: Security professionals must stop trusting packets as if they were people. Instead, they must eliminate the idea of a trusted network (usually the internal network) and an untrusted network (external networks). In Zero Trust, all network traffic is untrusted (see Figure 6). 3 Therefore, it must be secured and controlled. FIGURE 6 In Zero Trust, All Interfaces Are Untrusted Current Model Zero Trust Model Source: Forrester Research, Inc.
7 Key Recommendations As the threat landscape for data breaches continues to advance in both volume and sophistication, businesses must mature their security strategies to confront and hopefully outpace these new challenges. Unless changes are made to existing security protocols, it is only a matter of time before security barriers are penetrated and valuable data is lost. While there is no silver bullet to ensure complete protection from data breaches, companies can greatly reduce their risk and exercise greater control over their network by taking the following steps: Create a model of security designed to be both strategically resonant and tactically implementable. Adopt a Zero Trust mindset. Strategically, Zero Trust suggests making all network ports untrusted, thus ensuring data is protected across all layers and not just at perimeter access points. Tactically, Zero Trust identifies clear steps companies can take to achieve this model. Micro-segmentation is one of these critical steps, and it must be accomplished for Zero Trust to be tactically implementable. Architect your Zero Trust network by enabling micro-segmentation of the network through network virtualization. Modern networks must be segmented so that micro-perimeters can be created and data controlled more granularly. Virtualized network micro-segmentation is the easiest way to build these micro-perimeters. Set up micro-perimeters to manage your toxic data, and map how this data needs to flow through your organization. Zero Trust is data centric. By understanding how your data works and how it needs to move on your network, you can create a more robust solution that will enable both data usage and protection. In the process of mapping out how your data flows, you may also identify opportunities to improve and optimize data movement. Build a cross-functional team to implement Zero Trust concepts. Zero Trust breaks down silos. Use your Zero Trust initiative to solve business problems by creating a team from various stakeholder groups. Involve representatives from security, networking, application development, and enterprise architecture.
8 Appendix A: Methodology In this study, Forrester conducted an online survey of 210 IT and risk and compliance decision-makers at organizations with 500 or more employees in the US, the UK, Germany, France, China, and Japan. Company sizes ranged from 500 to more than 5,000 employees, and companies served a variety of industries. Respondents were mostly at the manager or director level or higher and had responsibility for and insight into their companies security, compliance, and risk decision-making processes. Respondents were offered a small incentive as a thank you for time spent on the survey. The survey was completed in June 2015. Appendix B: Survey Demographics FIGURE 7 Country And Company Size In which country do you work? United States 30% China 15% France 14% Using your best estimate, how many employees work for your firm/organization worldwide? 5,000 or more employees 38% 500 to 999 employees 16% United Kingdom 14% Japan 13% Germany 14% 1,000 to 4,999 employees 46% Base: 210 IT and risk and compliance decision-makers at organizations with 500 or more employees (percentages may not total 100% because of rounding) Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015
9 FIGURE 8 Title And Industry Which title best describes your position at your organization? Which of the following best describes the industry to which your company belongs? Manager 29% C-level executive 30% Manufacturing and materials Financial services and insurance 18% 21% Telecommunications services 14% Vice president 5% Business or consumer services Healthcare Retail 7% 7% 10% Director 36% Consumer product manufacturing Electronics Government Energy, utilities, and waste management Travel and hospitality Transportation and logistics Education and nonprofits Construction Media and leisure Other 4% 3% 2% 2% 2% 2% 1% 1% 1% 3% Base: 210 IT and risk and compliance decision-makers at organizations with 500 or more employees (percentages may not total 100% because of rounding) Source: A commissioned study conducted by Forrester Consulting on behalf of VMware, June 2015 Appendix C: Endnotes 1 Source: Five Steps To A Zero Trust Network, Forrester Research, Inc., January 28, 2015. 2 Source: Three Technical Innovations Will Ignite Zero Trust, Forrester Research, Inc., May 5, 2015. 3 Source: No More Chewy Centers: The Zero Trust Model Of Information Security, Forrester Research, Inc., Oct 7, 2014.